Frequently Asked Questions

Psiphon for Windows is never distributed as an installable package. Each Psiphon for Windows client is a single executable file (".exe") that is digitally signed by Psiphon Inc. Windows automatically checks this signature when you run the client. You can also manually inspect the signature before running the client by invoking the Properties dialog for the file and inspecting the Digital Signatures tab. The SHA1 thumbprint for the Psiphon Inc. certificate public key is displayed in the Certificate dialog Details tab.

For the certificate valid for the period 2014-05-08 to 2017-09-06 the SHA1 thumbprint is:

9b a0 bd 1c e4 ca f6 20 41 0d 46 47 ae 40 b0 7c 83 c7 31 99

For the certificate valid for the period 2012-05-21 to 2014-07-30 the SHA1 thumbprint is:

84 c5 13 5b 13 d1 53 96 7e 88 c9 13 86 0e 83 ee ef 48 8e 91

For the certificate valid for the period 2011-06-16 to 2012-06-21 the SHA1 thumbprint is:

8f b7 ef bd 20 a9 20 3a 38 37 08 a2 1e 0a 1d 2e ad 7b ee 6d

Psiphon for Windows auto-updates itself, and this process automatically verifies that each update is authentic.

Each Psiphon for Android client is shipped as an Android APK file (".apk") that is digitally signed by Psiphon Inc. The Psiphon Inc. certificate public key is as follows:

Owner: CN=Psiphon Inc., OU=Psiphon Inc., O=Psiphon Inc.,
L=Unknown, ST=Unknown, C=CA
Issuer: CN=Psiphon Inc., OU=Psiphon Inc., O=Psiphon Inc.,
L=Unknown, ST=Unknown, C=CA
Serial number: 349480e5
Valid from: Fri Jun 01 12:04:42 EDT 2012 until: Tue Oct 18 12:04:42 EDT 2039
Certificate fingerprints:
MD5:  BB:08:CD:91:22:FC:EB:17:1A:4A:3B:90:65:CE:2E:58
SHA1: 49:2C:3A:49:20:F3:6B:AE:95:90:EB:69:A6:36:E9:88:A7:41:7A:95
SHA256: 76:DB:EF:15:F6:77:26:D4:51:A1:23:59:B8:57:9C:0D:
7A:9F:63:5D:52:6A:A3:74:24:DF:13:16:32:F1:78:10
Signature algorithm name: SHA256withRSA
Version: 3

An APK may be validated by (1) extracting the certificate from the archive and checking that its fingerprints matches the value above and (2) verifying that the APK is signed with the certificate. For example, using Unix and Java command-line tools:

$ unzip -p PsiphonAndroid.apk META-INF/PSIPHON.RSA | keytool -printcert
$ jarsigner -verbose -verify PsiphonAndroid.apk

Psiphon for Android auto-updates itself, and this process automatically verifies that each update is authentic.

All data that goes through Psiphon is encrypted. This means that your ISP cannot see the content of your Internet traffic: web pages your browse, your chat messages, your uploads, etc.

However, please keep in mind that Psiphon is designed to be a censorship circumvention tool, and is not specifically designed for anti-surveillance purposes. Psiphon does not prevent your browsing history and cookies from being stored on your computer. And in some cases your Internet traffic might not be tunneled through Psiphon in SSH or SSH+ mode, for example if your browser's proxy settings are misconfigured, or if you leave your browser open after exiting Psiphon.

There are also advanced techniques which can look at encrypted traffic and determine some things about it, such as what website is being browsed. The primary example of this "traffic fingerprinting".

If you require anonymity over the Internet then you should use Tor instead of Psiphon.

Please see our Privacy Policy to learn about what information we collect.

The platforms we support are those available on the Download page. We are constantly working to expand our platform support, so hopefully we'll support your desired OS in the near future!

In order to install a direct download of Psiphon for Android, you must enable "sideloading". To do so, go into your Android settings, then into the "Security" section, then enable "Unknown sources".

When Psiphon starts, it displays the Client Version on the first line of output.

The automatic update process in Psiphon for Windows renames its old version to "psiphon3.exe.orig". Old files with the ".orig" suffix can safely be deleted.

Android: If you have installed Psiphon for Android through the Google Play Store, it will be automatically updated by the Play Store when an update is available. If you have sideloaded Psiphon for Android, the Psiphon client will download updates as they are available, and a notification will appear asking you to install the update.

Windows: The Psiphon for Windows client will download and install updates as they are available.

Manually updating: If the Psiphon self-updating mechanism isn't working (for example, if it's been blocked), you can find information about getting a fresh copy of Psiphon from the Download page.

Psiphon for Windows does not get installed, and won't appear in Windows’ “Add or Remove Programs” list. The executable file can be run from your “Downloads” directory, or it can be copied to a different directory and run from there. If you want to remove the program, you can simply delete the executable file.

Your Psiphon client will automatically discover new Psiphon servers. When the last server used is currently unavailable, another one can be used instead.

Only in VPN mode. After a successful connection is established in VPN mode, your entire computer’s traffic will pass through the Psiphon network. In SSH modes, only applications that use the local HTTP and SOCKS proxies will be proxied.

SSH+ is SSH mode with the addition of an obfuscation layer on top of the SSH handshake to defend against protocol fingerprinting. A description of the protocol can be found here.

Psiphon uses the L2TP/IPSec VPN protocol. Your network's firewall may not allow the use of VPNs. Your home router may not be configured to pass through this VPN protocol; check your firewall settings to see that IPSec or L2TP pass-through is enabled. Your system’s IPSec Services may be disabled; check your service settings and enable this service to start automatically.

If you see repeated "connection failed" messages, it means that there are no available servers that your client knows about. Try to download a new Psiphon client.

This is most commonly caused by an unreliable or inconsistent Internet connection to your device or computer. On a phone, this can mean losing reception. On a computer, this can mean inconsistent Wi-Fi or an unreliable Internet Service Provider.

If Psiphon is connected while an upgrade is installed, it may not be able to connect afterwards and will show the error “start_tunnel_failed application is not prepared or revoked”. This is due to an Android OS bug. This condition can be fixed by rebooting your device.

Check if you are running a screen filter app or an app that manages your screen's brightness. If you are, try disabling it. Many of these apps (such as Lux Auto Brightness, Twilight, Night Mode) interfere with the user's ability to interact with this prompt.

If you see repeated "connection failed" messages, it means that there are no available servers that your client knows about. Try to download a new Psiphon client.

This is most commonly caused by an unreliable or inconsistent Internet connection to your device or computer. On a phone, this can mean losing reception. On a computer, this can mean inconsistent Wi-Fi or an unreliable Internet Service Provider.

When Psiphon for Windows connects it modifies your computer's proxy settings, and when it disconnects it restores them to their original state. If Psiphon for Windows does not exit properly, it may not properly restore the original proxy settings, and this will result in you being unable to connect to the Internet.

The easiest way to fix this for most people is to connect with Psiphon again, and then cleanly disconnect.

To manually fix your proxy settings, open Internet Explorer, then go to the Tools menu (or gear icon), Internet Options → Connections tab → LAN Settings button. Then remove the checkmark beside “Use a proxy server for your LAN”.

This error will occur on Windows XP if Internet Explorer 6 is installed. Psiphon for Windows requires Internet Explorer 7 or higher to be installed. The best way to install higher versions of Internet Explorer is via Windows Update.

If you can't use Windows Update and want to install Internet Explorer 7 or Internet Explorer 8 directly, you can get them via these links:

• Internet Explorer 8 for Windows XP (64-bit)
• Internet Explorer 7 for Windows XP (64-bit)

Your network's firewall may not allow the use of VPNs. Your home router may not be configured to pass through this VPN protocol; check your firewall settings to see that IPsec or L2TP pass-through is enabled. Your system’s IPsec Services may be disabled; check your service settings and enable these services to start automatically.

Certain networking hardware or Internet connections may cause performance problems for L2TP/IPSec which is the protocol used by Psiphon in VPN mode. Try using SSH modes instead.

Psiphon restricts DNS traffic to white-listed, vetted DNS servers. The Psiphon client automatically configures your VPN DNS server settings. If you're getting errors related to DNS, check that you're not infected by the "DNS Changer" malware, which tries to change your DNS server settings. More info can be found here.

Yes. In SSH modes, check your browser settings and make sure that it is configured to use the system proxy settings.

Outbound connections from the Psiphon for Windows VPN can be made only on the following ports: 53, 80, 443, 554, 1935, 7070, 8000, 8001, 6971-6999. See this discussion for more information. Mail clients cannot establish outbound connections on ports 25 and 587. See this discussion for more information.

This is probably due to Psiphon's port restrictions.

This is due to a limitation in Android's hotspot and tethering implementation. You might find that either the tethered device cannot connect to the internet or the traffic will not go through the VPN.

The first thing to check is that you have an authentic copy of Psiphon. Please follow these instructions to verify that your copy of Psiphon is authentic. If it is not authentic, please send us an email with information about how you obtained the copy and, if possible, with the Psiphon executable attached.

If your copy of Psiphon is authentic, then this is an instance of a false positive report. Although most antivirus/firewall programs have added Psiphon’s digital signature to their whitelist rules, some may still erroneously identify Psiphon’s executable file as a virus or threat. In this case, please send us an email, specifying the AV/firewall program you use, and we will contact the AV/firewall vendor to solve the problem.

Windows 8 introduced an alternative to the desktop app interface called “Metro”, which was later renamed to “Modern UI”. Some, but very few, applications can only run in “Metro mode” and some (like Internet Explorer) can run in either “Metro mode” or “Desktop mode”. This new user interface mode continues to exist in Windows 8.1 and, to a lesser degree, in Windows 10.

Applications in Metro mode cannot use a local proxy without the user modifying system security settings. This means that Metro mode apps cannot use Psiphon, and will not be able to reach the internet when Psiphon is connected. You can use the EnableLoopback Utility to allow Metro mode apps to work with Psiphon.

The following are examples of the error message you might see when Metro mode apps are trying and failing to work through Psiphon.

Psiphon will automatically configure your system to use a local HTTP/HTTPS proxy at 127.0.0.1:8080 and a local SOCKS proxy at 127.0.0.1:1080. Windows applications that use the System Proxy Settings will automatically be proxied. You may manually configure other applications to use these local proxies. Both Psiphon for Windows (SSH modes) and Psiphon for Android run these local proxies.

Click Run, and type regedit to open the Registry Editor. Find and open HKEY_CURRENT_USER\Software\Psiphon3, and on the right side you will see UserSkipProxySettings. Set this value to 1 and Psiphon will not automatically configure the system proxy settings.

Before December 2015 Psiphon for Android had a feature that allowed users with older Android devices (pre-4.0/ICS) to tunnel the whole device if it was rooted. A major update to Psiphon at that time necessitated the removal of that feature.