Colitu VPN for Android 2.5.1

Fix: Russian apps and sites

• Russian banking apps, Gosuslugi, marketplaces and other Russian services used to show a "turn off your VPN" error on Android.
• Russian sites and apps (Russian domains and Russian IP addresses) now connect directly, while all other traffic stays inside the VPN, the same as in the iPhone app.
• Nothing needs to be set up; it works on every server.

Colitu VPN for Android 2.5.0

New: ad blocking (must appear as its own item)

• A new "Ad blocking" switch in Account → Features. It is off by default.
• When it is on, ads and trackers are blocked in every app on the phone by Colitu's own DNS servers, on every server you connect to.
• No query log is kept on these servers.
• If a site or an app stops working properly, turn the switch off; the connection restarts by itself when you change it.

New: label in the server list

• Servers that run Colitu's ad-blocking DNS (Sweden, United Kingdom, Poland) carry an "Ad blocking" label.

Colitu VPN for Android 2.4.2

Download

Official download (with in-app updates): https://colitu.com/download

File	Link	SHA-256
Universal (all phones and TVs)	Colitu-2.4.2.apk	64a232df91287f22fb4f9357e7c624b72e16a835d2c4ac6a759fb652c78ecb96
arm64-v8a (most phones)	Colitu-2.4.2-arm64-v8a.apk	9a351e34d846ad4b72ccbb51ad977bc4d99956a296da0055df56a44a62ae2eb2
armeabi-v7a (older phones, many TV boxes)	Colitu-2.4.2-armeabi-v7a.apk	405a3e3f044a779fc08cf8f15fe03b1a3df714c05776fa074a86951ec4c97f1e
x86	attached below	1528ab5986411bc59308aa86aa6e5661b8a2a23616581f60522e7476ef1273dd
x86_64	attached below	f6c5e00d94cbe7a7083c1ea4ed6f550dcf37b55cc1d4998599dd03c962acfe29

All APKs are attached below, with SHA256SUMS. Signing certificate SHA-256: 900e364616e5fce83766310f74bd06e4743a6936460a9e108edd096dfb5e82fc — an update with any other certificate will not install over Colitu. Installs from colitu.com update themselves.

What's new in 2.4.2

A new server list

• A Fastest server button next to the title, search, categories with icons, and sorting by ping, name or load.
• Recommended servers first, then All servers.
• Every location shows its round country flag, the city, the ping with signal bars, and which services open there (ChatGPT, Gemini, Claude, Netflix and more).

Fixes

• The ping of every server is measured on the device again while the VPN is off, and the last values are kept. Before, the list showed no ping at all.
• Flags look the same on every phone and TV; some devices showed letters or empty boxes instead of emoji flags.

Technical

• Ping = TCP connect time to the node's probe address from the panel (latency_host / latency_port), best of two, 2.5 s timeout, DNS resolved first. Not measured through the tunnel.
• Flags are bundled 1×1 renders of flag-icons (MIT, see assets/flags/LICENSE.txt).

Colitu VPN for Android 2.4.1

Download

Official download (with in-app updates): https://colitu.com/download

File	Link	SHA-256
Universal (all phones and TVs)	Colitu-2.4.1.apk	bd6e90708f5504fd53567c600223071d61e05e4cb33ae1d5b8be86acb240c535
arm64-v8a (most phones)	Colitu-2.4.1-arm64-v8a.apk	72ef620bced1514c86d56fb3b47c9779e49f69acb1415431a7a6c6c5da4616ed
armeabi-v7a (older phones, many TV boxes)	Colitu-2.4.1-armeabi-v7a.apk	61ffe27cd5cf01b598cf4488cef30fe829ce9615076fbfdb9dcce5949212449c
x86	attached below	5006d768c31b2194180975cdcdd5cabf17a2f3ef2362246267f24f04a5637e20
x86_64	attached below	903fbe640800dc8054f61a7c31340b187246df36a677918d67851224d87c0241

All APKs are attached below, with SHA256SUMS. Signing certificate SHA-256: 900e364616e5fce83766310f74bd06e4743a6936460a9e108edd096dfb5e82fc — an update with any other certificate will not install over Colitu. Installs from colitu.com update themselves.

What's new in 2.4.1

New connection method: Resilient

• Every Colitu server now offers a fifth connection method, Resilient. It carries the tunnel as ordinary HTTPS requests and keeps working on mobile networks that slow down or freeze long connections.
• The app picks it by itself when the other methods do not get through. Nothing to set up.

More reliable connecting

• The app now tries every connection method the server offers before it gives up. Before, it started at most three, and after a method that connected but carried no traffic it tried only one more.

Connection methods have names

• The home screen, the account screen and the VPN notification show the method in use as Fast, Stealth, Resilient, Classic or Light instead of a protocol name.

Technical

• Resilient is VLESS over XHTTP with Reality (Xray xhttp transport, mode auto, no Vision flow). The method names map to Hysteria2 (Fast), VLESS Reality (Stealth), VLESS XHTTP (Resilient), Trojan (Classic) and Shadowsocks (Light).
• The device record, including the transports this build supports, is re-sent to the Colitu API once per app version, so phones signed in with an older build are offered the new method after updating.

Colitu VPN for Android 2.4.0

Download

Official download (with in-app updates): https://colitu.com/download

File	Link	SHA-256
Universal (all phones and TVs)	Colitu-2.4.0.apk	f277519e23fb701ee7096c71f0844aad7dde97af9ab040299fedf47d5a987881
arm64-v8a (most phones)	Colitu-2.4.0-arm64-v8a.apk	8fa2b0eafb06dec4a3234632c3cc27037016831f1698aceb3fd64af7fc872cf1
armeabi-v7a (older phones, many TV boxes)	Colitu-2.4.0-armeabi-v7a.apk	2f0bc3b1adff43beae6b0c86a47bfeb3b363a92e23d65dfcf4649e2f0bb448c3
x86	attached below	cdda43f0819e8ee7f0704e5b07df347bae75590ace84248847149d31f6fbfe60
x86_64	attached below	c01377e3f17b0f5d3342bab8cd21e93d7ce9f997d2afd8ba13e5797be7df493d

All APKs are attached below, with SHA256SUMS. Signing certificate SHA-256: 900e364616e5fce83766310f74bd06e4743a6936460a9e108edd096dfb5e82fc — an update with any other certificate will not install over Colitu. Installs from colitu.com update themselves.

What's new in 2.4.0

Sign in on a TV with your phone

• The Android TV / Google TV sign-in screen now shows a QR code and a short code. No more typing an e-mail and password with the remote.
• On your phone open Account → Sign in on a TV, scan the code, check the device name and country, and approve. The TV signs itself in within seconds.
• No Colitu app on the phone? Scan the QR code with the camera or open colitu.com/link, sign in on the website and approve there.
• A request can be declined, codes expire after 10 minutes and work once. Colitu will never ask you to approve a code for someone else.
• E-mail and password sign-in on the TV is still one click away.

Forgot password

• Forgot password on the sign-in screen: enter your e-mail, get a six-digit code, set a new password and you are signed in.
• Changing the password signs the account out on every other device.

Free plan

• Every account gets 10 GB a month for free. The app shows "Free plan · 10 GB every month", the traffic used this month, a "limit reached" badge when the 10 GB are used up, and a "Go unlimited" button. Sign-up texts no longer mention the old 24-hour trial.

Technical

• The QR scanner uses CameraX with the zxing decoder: no Google Play services needed. The camera permission is asked only when you open the scanner, and TVs without a camera still install the app.
• Password reset and device linking use the new /auth/password/* and /auth/link/* endpoints of the Colitu API.

Colitu VPN for Android 2.3.0

Download

Official download (with in-app updates): https://colitu.com/download

File	Link	SHA-256
Universal (all phones and TVs)	Colitu-2.3.0.apk	386af91c71418850fc55450a51ffa7acc3b3d295a6a487328517233695755fce
arm64-v8a (most phones)	Colitu-2.3.0-arm64-v8a.apk	874b46da8818a66b52c80da4740fcc508910d5bf5ec2dd3c7647b9675b351390
armeabi-v7a (older phones)	Colitu-2.3.0-armeabi-v7a.apk	98807fb1ad3e218a1371d58caf457848f29dd7e82734957ffc97f6bc359a01db

The same APKs (plus an x86_64 build) are attached below. Signing certificate SHA-256: 900e364616e5fce83766310f74bd06e4743a6936460a9e108edd096dfb5e82fc — an update with any other certificate will not install over Colitu.

What's new in 2.3.0

Fixed

• Connecting failed with "the VPN engine could not start" on some servers, accounts and TVs: the panel's 64-bit config revision was read as a negative number and the profile was rejected. Every profile is accepted now.
• Cancelling while connecting could leave the tunnel running; cancel now always stops it.
• A short server outage during a session refresh could sign you out and turn the VPN off. Only a rejected session ends it now.
• A server switch that did not reach the panel no longer connects you to the previous server; the app shows the server you are really on.

Security and privacy

• The imported v2rayNG screens, the v2rayng:// URL scheme, the Tasker plug-in and the boot receiver are gone: other apps and web pages can no longer add servers, read the profile, or start and stop the tunnel.
• The app's internal broadcasts are no longer exported.
• Xray's local SOCKS inbound uses a random port and a per-connection account instead of an open 127.0.0.1:10808; Xray's access log is off.
• While connected, the app's own API calls go through the tunnel; colitu.com is certificate-pinned.
• Quick-settings tile, widget, shortcuts and Always-on only start a valid Colitu profile; otherwise they open the app.
• Support diagnostics are opt-in and contain only Colitu log lines with IP addresses masked.
• The colitu.com build checks an ECDSA signature on latest.json before offering an update. Google Play and F-Droid builds contain no self-updater.

Changes

• New home screen, the same as on iPhone.
• No in-app purchases: the Plan page shows your plan and opens your account on app.colitu.com.
• R8 enabled; the APKs are about 30% smaller.

---

Русский: исправлена ошибка «VPN-движок не смог запуститься», другие приложения больше не могут управлять VPN или использовать его, новый главный экран, тариф оформляется в кабинете app.colitu.com. Скачать: https://colitu.com/download

Türkçe: "VPN motoru başlatılamadı" hatası giderildi, diğer uygulamalar artık VPN'i kullanamaz veya yönetemez, yeni ana ekran, paketler app.colitu.com hesabından yönetilir. İndir: https://colitu.com/download

Colitu VPN for Android 2.2.0

The first open-source release of the Colitu VPN client for Android.

Highlights

• Brand-new interface. The whole app has been rebuilt in Jetpack Compose: onboarding, sign-in and registration, e-mail verification, home, locations, plans, account and support now live in one fast, consistent shell.
• Automatic protocol selection. Hysteria2, VLESS Reality, Trojan and Shadowsocks are probed in parallel. The fastest one starts, the tunnel is verified with a real request, and the app falls back to the next candidate if it fails.
• Support inside the app. Open tickets and read replies without leaving Colitu.
• Android TV. A dedicated TV layout with D-pad navigation and a leanback launcher entry.
• Verified in-app updates. For builds installed outside Google Play, an update is installed only if its SHA-256 matches the release manifest.
• Secure token storage. Session tokens are encrypted with AES-GCM using a key held in the Android Keystore.
• Languages: Russian, English and Turkish, switchable instantly inside the app.

Which file should I download?

File	For	SHA-256
Colitu-2.2.0-universal.apk	Any device (recommended if unsure)	64f0a2baa39b2b2dafbeb18434bbb2b012d8b4372efcb495e5187a9ad7237329
Colitu-2.2.0-arm64-v8a.apk	Most phones from 2017 onward	faeac80ae7ef48738856640579c5eeed99e3041442c313868244a5b55001403c
Colitu-2.2.0-armeabi-v7a.apk	Older 32-bit phones	ae94917943a3fed12081c481af1dfcd970a5cc90fd3201fa523b59f1952796e8

Requirements: Android 7.0 or newer. A Colitu account is required to connect; sign up at colitu.com.

Signing certificate SHA-256:
900e364616e5fce83766310f74bd06e4743a6936460a9e108edd096dfb5e82fc

When installing an APK from the browser, Android may ask you to allow installs from this source. Updates signed with a different certificate will be refused by Android, which protects you from tampered builds.

Colitu for Android is a fork of v2rayNG and is licensed under GPL-3.0.