Installation
- Install it from Google Play, or download the APK with the button below. For the APK, pick the universal package if you do not know your device's processor.
- If Android asks to allow installs from unknown sources, allow it only for the file from colitu.com.
- Open Colitu and sign in.
- Tap Connect and answer OK when Android says Colitu wants to set up a VPN connection.
Automatic protocol
Remembers the last working protocol and moves to the next one in the background if it cannot connect.
Android Keystore
Session tokens are encrypted with AES-256-GCM using an Android Keystore key, with a software key as fallback if the Keystore fails.
Certificate pinning
The API connection only accepts pinned root certificates.
Open source
The full code is on GitHub under GPL-3.0.
Verify the file
- Version
- 3.1.2 · November 11, 2026
- Colitu-3.1.2.apk
- 83 MB · SHA-256 3a9a839dc93ea5bc726d23ab1d3492e46a66a72da9eae72945eb2b00a8841787
- Colitu-3.1.2-arm64-v8a.apk
- 35 MB · SHA-256 15781c5fb0b148b2c4bab89548a6f2b150da154953315d373cf81a190b4e0cd8
- Colitu-3.1.2-armeabi-v7a.apk
- 35 MB · SHA-256 8f8bd7ed8ca982b2875493c9db12b5089351395a5bd9342588b3ece3220f478b
- Signing certificate
- SHA-256 900e364616e5fce83766310f74bd06e4743a6936460a9e108edd096dfb5e82fc
- Source commit
- 139d8de51bdc0ebe00f5e81abd07f308a56fb184
Reproducible builds In this release
This release is reproducible: a file you build yourself from the tagged source on GitHub comes out byte-for-byte identical to the one we publish here. This lets you check for yourself that nothing that is not in the source code was added to the file.
No need to trust the build computer
Even if the source code is clean, if the computer it is built on is compromised, code can be added to the file unnoticed. When everyone can produce the same file from the same code, such an addition shows up immediately.
Don't trust us blindly either
You can prove on your own computer that the file we publish contains nothing beyond the code on GitHub. A different version prepared secretly by an employee or by someone under pressure would be noticed this way too.
Automatic check on every change
The automated build on GitHub rebuilds Colitu's own components from source with every change and compares them byte-for-byte with the files in the repository: on Linux for Android, on Windows for Windows.
How does it work, what does it cover? · Step-by-step guide (GitHub) ↗
Frequently asked questions
Is it on Google Play?
Yes, Colitu is now on Google Play. You can still download the APK from colitu.com; both are signed with the same Colitu key. Google Play keeps the Play version up to date; the APK version finds updates by itself.
Which APK should I choose?
If unsure, download the universal package. Most new phones use arm64-v8a; older 32-bit devices use armeabi-v7a.
The connection drops in the background
Go to Settings → Apps → Colitu → Battery and choose Unrestricted; on Xiaomi also enable Autostart.
Can I install it with Obtainium?
Yes. Obtainium is an open-source Android app that installs apps straight from the developer's GitHub releases and keeps them up to date. Tap “Add to Obtainium” or add github.com/colitu/android in Obtainium. The APKs on GitHub are the same files as on colitu.com, signed with the same Colitu key.
Detailed guide in the Help Centre ↗ · All apps · Windows · Android TV · iPhone and iPad · Linux · Browser extension