OPEN SOURCE

Our Windows, Android, iOS and Linux apps
all open source.

The full code of Colitu's Windows, Android, iOS and Linux apps is public on GitHub. You can read the code yourself to see what the app is written to do on your device. Below we spell out separately what open code proves and what it does not.

Windows Android iOS Linux Chrome · Firefox

Windows

colitu/windows

GPL-3.0

Windows 10 and 11 app: interface, connection management, updater and installer.

git clone https://github.com/colitu/windows.git
cd windows\src
dotnet build ColituVPN.sln -c Release

View the source code on GitHub ↗

Android · Android TV

colitu/android

GPL-3.0

Phone, tablet and TV app: interface, protocol selection, VPN service and updater.

git clone https://github.com/colitu/android.git
cd android/android
./gradlew assemblePlaystoreDebug

View the source code on GitHub ↗

iPhone · iPad

colitu/ios

GPL-3.0

iPhone and iPad app: interface, protocol selection, Network Extension tunnel and account flow.

git clone https://github.com/colitu/ios.git
cd ios
flutter pub get && flutter test

View the source code on GitHub ↗

Linux · Beta

colitu/linux

GPL-3.0

Linux desktop app: interface, connection management, nftables kill switch and .deb/.rpm packages.

git clone https://github.com/colitu/linux.git
cd linux/src
dotnet publish ColituVPN -c Release -r linux-x64

View the source code on GitHub ↗

Chrome · Firefox

colitu/extension

GPL-3.0

Chrome and Firefox extension: interface, session, proxy settings and store packages.

git clone https://github.com/colitu/extension.git
cd extension
npm test && npm run build

View the source code on GitHub ↗

Why are we open source?

Choosing a VPN means trusting a company with your internet traffic. We want to earn that trust with code anyone can inspect, not with words.

A VPN sees a lot

All of your device's traffic flows through a VPN app. You shouldn't have to trust software like that blindly.

Proof on the app side

With open code anyone can see what the app collects and where it sends it. Open app code does not prove a “we keep no logs” promise about the servers, though; we describe what the servers do in the security whitepaper.

More eyes, safer code

Bugs in closed code can go unnoticed for years. Researchers anywhere can study open code, so problems are found and fixed faster.

A freedom that's yours

The GPL-3.0 licence lets you read, build, change and share the code. That right cannot be taken back from you.

What can you verify in the code?

The app has no built-in server list; connection details come from the API, issued for your account.
Session tokens are stored encrypted on the device: with the Android Keystore on Android, in the Keychain on iOS, DPAPI on Windows and a key bound to the machine and user on Linux.
The Windows, Android and Linux apps install an update only if the release manifest's ECDSA P-256 signature verifies and the package's SHA-256 matches the manifest.
The code shows exactly how protocols are tried and how the connection is verified.
Every request and field the app sends to the API is defined in the code. None of the apps (Android, iOS, Windows, Linux) contains analytics, advertising or crash-reporting libraries.

What's open and what isn't?

We want to be clear about open source. Here is what is open and what is not:

Windows appAll on GitHub
Open
Android and Android TV appAll on GitHub
Open
Linux appAll on GitHub; packages are built by GitHub Actions
Open
Browser extensionAll on GitHub
Open
iPhone and iPad appAll on GitHub; TestFlight builds are made on Codemagic
Open
Server infrastructure and account systemKept closed so our protection against abuse and attacks is not weakened.
Closed

Contribute

Bug reports, translation fixes and suggestions are welcome on GitHub. If you publish your own build, please use your own name and logo; the Colitu name and logo are not covered by the GPL.

Windows · Issues ↗Android · Issues ↗iOS · Issues ↗Linux · Issues ↗

Found a vulnerability?

Please don't open a public issue; send the details to security@colitu.com. We reply within 3 working days and share an initial assessment within 10 working days. We do not take legal action against good-faith research.

security@colitu.com Disclosure policy

Open-source projects we use

Colitu apps use solid components the open-source community has built over many years. We thank them.

Open source, verification and audits are different things

What we can prove today, and what we cannot yet:

File checksum (SHA-256)

Yes

The checksums below prove that your download is bit for bit the file we published, so it was not damaged or changed on the way. They do not prove that the file was built from the tagged code. They are read from the release manifest on colitu.com; this page does not verify the manifest's signature itself, so compare them with the value in the GitHub release as well.

Publisher signatures

Partly

Android APKs are signed with Colitu's release key; Android accepts an update only with the same signature. The Windows, Android and Linux apps verify the update manifest's ECDSA P-256 signature. The Windows installer is not Authenticode-signed yet (Windows SmartScreen may show a warning); the Linux .deb and .rpm packages are not GPG-signed. iPhone and iPad builds are signed by Apple.

Reproducible builds

Android, Windows

For the Android and Windows apps, a file you build yourself from the tagged source on GitHub comes out byte-for-byte identical to ours. You can independently prove that the published file was built from that source. iOS and Linux builds are not reproducible yet.

Independent audit

Not yet

Our apps and infrastructure have not had an independent security audit or penetration test; no date is set. “Open source” wording and badges on this site do not mean an audit.

What happens on the servers

Open app code does not prove what our servers do. The server software and the account system are closed source and cannot be verified from outside. What the servers record and do not record, and where and for how long data is kept, is written in the security whitepaper and the privacy policy. Security whitepaper · Privacy policy

Verify the file you downloaded

Every installer on colitu.com is tied to a release tag on GitHub and the commit that tag points to. The checksums below are read from the signed release manifest the apps use when updating.

Windows · Version 3.1.4

Release on GitHub ↗

Tag: v3.1.4
Commit: d094ee5ae707459db12856515bb1885119965338
ColituVPN-Setup-3.1.4-x64.exe: SHA-256 3d58040d33883ea9cc0cc53824700688af02b8eee1e60b9e5f191e70ce7d2a9a

The release manifest is signed with ECDSA P-256; the app installs no update without verifying the signature and the file checksum.

Android · Version 3.1.2

Release on GitHub ↗

Tag: v3.1.2
Commit: 139d8de51bdc0ebe00f5e81abd07f308a56fb184
Colitu-3.1.2.apk: SHA-256 3a9a839dc93ea5bc726d23ab1d3492e46a66a72da9eae72945eb2b00a8841787
Colitu-3.1.2-arm64-v8a.apk: SHA-256 15781c5fb0b148b2c4bab89548a6f2b150da154953315d373cf81a190b4e0cd8
Colitu-3.1.2-armeabi-v7a.apk: SHA-256 8f8bd7ed8ca982b2875493c9db12b5089351395a5bd9342588b3ece3220f478b
Signing certificate: SHA-256 900e364616e5fce83766310f74bd06e4743a6936460a9e108edd096dfb5e82fc

The release manifest is signed with ECDSA P-256. Before installing an update the app verifies the signature, compares the APK checksum with the manifest and checks that the APK's signing certificate is the same as the installed app's; it does not install older versions. The signing certificate hash on this page is not part of the signed manifest; check the certificate in the APK yourself with apksigner.

Linux · Version 1.7.5

Release on GitHub ↗

Tag: v1.7.5
Commit: 0a40ec778ed19ee337e4cd6c809ab02b81e5863e
colitu-vpn_1.7.5_amd64.deb: SHA-256 e33bf133b4cf6c56d00afa0d0aa3e076a90f656b48b5b456f9a6aa8efb95f1a6
colitu-vpn_1.7.5_arm64.deb: SHA-256 0cb175bd76af5f2aa2f384fb5a63da5a1e9872d7bf509abf4e31c8995d591ddf
colitu-vpn-1.7.5-1.x86_64.rpm: SHA-256 44fc743af6cc3695c745ab522f019d32e4aaf2dde056ebf9db8423f565d49cec
colitu-vpn-1.7.5-1.aarch64.rpm: SHA-256 132b74268b9b6e5f9e3b38501529662f0bc2b7ebe87ad596d499b09bda43b0ca
colitu-vpn-1.7.5-linux-x64.tar.gz: SHA-256 eb20314fc6177d8e13345fa8b5669858ebfbfb5f0a7d16df1b852a38ac11a9bd
colitu-vpn-1.7.5-linux-arm64.tar.gz: SHA-256 a388838e24852bca32d96cd33711a34006066761d430741715991a854fc832d1

The release manifest is signed with ECDSA P-256; the app installs no update without verifying the signature and the file checksum.

How to check it yourself

# Windows (PowerShell)
Get-FileHash .\ColituVPN-Setup-*-x64.exe -Algorithm SHA256

# Linux / macOS
sha256sum Colitu-*.apk
sha256sum colitu-vpn_*_amd64.deb

# Android signing certificate
apksigner verify --print-certs Colitu-*.apk

The resulting digest must match the value on this page and in the GitHub release. You can also prove that the Android and Windows files were built from the tagged source with the reproducible build steps below; on iOS and Linux the same digest only proves that the file is the one we published.

iPhone and iPad builds are signed by Apple and installed through TestFlight; the tagged commit of each release is on GitHub.

What is a reproducible build, and what is it for?

Open-source code shows what the app is meant to do. A reproducible build proves that the file you downloaded really came from that code: whoever builds the same code with the same tools gets a byte-for-byte identical file.

Status: the Android and Windows apps are built reproducibly. iOS and Linux builds are not yet.

No need to trust the build computer

Even if the source code is clean, if the computer it is built on is compromised, code can be added to the file unnoticed. When everyone can produce the same file from the same code, such an addition shows up immediately.

Don't trust us blindly either

You can prove on your own computer that the file we publish contains nothing beyond the code on GitHub. A different version prepared secretly by an employee or by someone under pressure would be noticed this way too.

Against supply chain attacks

The app is built with libraries from other projects. Every library version and its digest are pinned in the lock files; prebuilt components are verified with SHA-256. If a piece changes silently, the build stops.

Automatic check on every change

The automated build on GitHub rebuilds Colitu's own components from source with every change and compares them byte-for-byte with the files in the repository: on Linux for Android, on Windows for Windows.

How do we ensure it?

Same tools: Gradle, JDK, Android NDK, .NET SDK, Go and Inno Setup are pinned to exact version numbers.
Same dependencies: every library and a digest of its contents are recorded in lock files; CI runs in locked mode.
The build time and folder do not end up in the file: the commit time is used instead of the date, and relative paths instead of folder paths.
Same source on every computer: line endings on Windows are the same as on Linux; if they differ, the release build stops.
Colitu's own components (the Adaptive Connect engine, the CSL client, the hev-socks5-tunnel tunnel bridge) are built from source at a pinned commit.

What does it not cover?

One file is not in the source code: colitu-build.json. It holds the backup API addresses used against blocking (and, on Windows, the ad-blocking DNS servers). We do not put it on GitHub so that blocking it is harder; it is readable inside the published app. When you verify, you take this file from your own copy; everything else comes out byte-for-byte identical.
The Xray core, sing-box, wintun and the geographic data files are the official releases of their makers. We do not build them; we pin them with their SHA-256 digests.
Google itself repackages and signs the Google Play version for each device. The byte-for-byte comparison is done with the APKs on colitu.com.
iPhone, iPad and Linux builds are not reproducible yet.
A reproducible build proves that the file came from that code, not that the code is safe. It does not replace an independent security audit.

Try it yourself

# Android (JDK 21.0.12)
git clone https://github.com/colitu/android && cd android && git checkout v<version>
unzip -p Colitu_<version>_universal.apk colitu-build.json
cd android && COLITU_MIRRORS='<mirrors>' ./gradlew assembleDirectRelease
apksigcopier compare Colitu_<version>_arm64-v8a.apk \
  --unsigned app/build/outputs/apk/direct/release/Colitu_<version>_arm64-v8a.apk

# Windows (PowerShell 7, .NET SDK from global.json, Inno Setup 6.7.3)
git clone https://github.com/colitu/windows; cd windows; git checkout v<version>
pwsh scripts/fetch-cores.ps1; pwsh scripts/build-sidecars.ps1
$values = "C:\Program Files\Colitu VPN\colitu-build.json"
pwsh scripts/build-installer.ps1 -Version <version> -SkipManifest -BuildValuesPath $values
Get-FileHash artifacts\installer\ColituVPN-Setup-<version>-x64.exe

On Android, every byte except the signature should match; on Windows, the whole installer should match. Details and tool versions are in each repository's guide: Android ↗ · Windows ↗

Read the code, then decide.

Use our open-source apps on the free plan: 1 GB every month.

Download the app About us