An easy to use IKEv2/IPsec-based VPN client.
About this app
Official Android port of the popular strongSwan VPN solution.
# FEATURES AND LIMITATIONS #
• Uses the VpnService API featured by Android 4+. Devices by some manufacturers seem to lack support for this - strongSwan VPN Client won't work on these devices!
• Uses the IKEv2 key exchange protocol
• Uses IPsec for data traffic
• Full support for changed connectivity and mobility through MOBIKE (or reauthentication)
• Supports username/password EAP authentication (namely EAP-MSCHAPv2, EAP-MD5 and EAP-GTC) as well as RSA/ECDSA private key/certificate authentication to authenticate users, EAP-TLS with client certificates is also supported
• Combined RSA/ECDSA and EAP authentication is supported by using two authentication rounds as defined in RFC 4739
• VPN server certificates are verified against the CA certificates pre-installed or installed by the user on the system. The CA or server certificates used to authenticate the server can also be imported directly into the app.
• IKEv2 fragmentation is supported if the VPN server supports it (strongSwan does so since 5.2.1)
• Split-tunneling allows sending only certain traffic through the VPN and/or excluding specific traffic from it
• Per-app VPN allows limiting the VPN connection to specific apps, or exclude them from using it
• The IPsec implementation currently supports the AES-CBC, AES-GCM, ChaCha20/Poly1305 and SHA1/SHA2 algorithms
• Passwords are currently stored as cleartext in the database (only if stored with a profile)
• VPN profiles may be imported from files
• Supports managed configurations via enterprise mobility management (EMM)
Details and a changelog can be found in our documentation: https://docs.strongswan.org/docs/latest/os/androidVpnClient.html
# PERMISSIONS #
• READ_EXTERNAL_STORAGE: Allows importing VPN profiles and CA certificates from external storage on some Android versions
• QUERY_ALL_PACKAGES: Required on Android 11+ to select apps to ex-/include in VPN profiles and the optional EAP-TNC use case
# EXAMPLE SERVER CONFIGURATION #
Example server configurations may be found in our documentation: https://docs.strongswan.org/docs/latest/os/androidVpnClient.html#_server_configuration
Please note that the host name (or IP address) configured with a VPN profile in the app *must be* contained in the server certificate as subjectAltName extension.
# FEEDBACK #
Please post bug reports and feature requests via GitHub: https://github.com/strongswan/strongswan/issues/new/choose If you do so, please include information about your device (manufacturer, model, OS version etc.).
The log file written by the key exchange service can be sent directly from within the application.
Licensed under GPL-2.0-or-later.
What's New in v2.6.2
Imported from the F-Droid repository index.
- # 2.6.2 #
- - Fix edge-to-edge layout issues with settings and app selection
- # 2.6.1 #
- - Update OpenSSL to support ML-KEM (requires explicit configuration in proposals)
- - Fix vulnerability in eap-mschapv2 plugin
- - Fix filename when exporting the log
Version history
Nov 3, 2025 · 15.3 MB · Android API 21–36 · code 96
Imported from the F-Droid repository index.
- # 2.6.2 #
- - Fix edge-to-edge layout issues with settings and app selection
- # 2.6.1 #
- - Update OpenSSL to support ML-KEM (requires explicit configuration in proposals)
- - Fix vulnerability in eap-mschapv2 plugin
- - Fix filename when exporting the log
SHA-256 aa94ba159c74d3e665a9bea0a67ddd8d14a09927407c8d7a47e52d4fdf2d716b
Oct 30, 2025 · 15.3 MB · Android API 21–36 · code 95
Imported from the F-Droid repository index.
SHA-256 f04b974f9f5871a446124b6a59c8694079d8ca21a78f53fd8e8e12212930b17e
Oct 7, 2025 · 12.2 MB · Android API 21–36 · code 94
Imported from the F-Droid repository index.
SHA-256 07ab2e249f67dc5bcb544ef63dd25bcf02dffb3669bb038ae9a537285118eada
Will it run on your device?
92%
- Runs on a broad range of modern Android versions.
- Multiple CPU architectures are covered.
- Aligned with the latest Android target SDK expectations.
Installation Guide
Open Settings on your Android device
Go to Security → Unknown sources (or Install unknown apps)
Enable "Allow from this source" for your browser or file manager
Open the downloaded APK file from your Downloads folder
Tap "Install" and wait for installation to complete
Launch the app from your home screen
Make sure to re-enable Unknown Sources restrictions after installation for security.
How to install this safely
How to verify the file you downloaded
Before you install anything, confirm the file is the one described here. On a computer, run shasum -a 256 your-download.apk (macOS or Linux) or certutil -hashfile your-download.apk SHA256 (Windows), then compare the output character-for-character with the SHA-256 on this page. If a single character differs, the file is not the build we recorded — delete it.
What the signing certificate proves
Every Android app is signed with a private key that only its developer holds. The fingerprint on this page is a hash of the matching public certificate, and it proves continuity rather than identity: it tells you a build came from whoever signed the earlier ones. Android enforces this at install time — if a package claiming to be org.strongswan.android is signed with a different key, the system will refuse to install it over your existing copy. A fingerprint that changes between releases is worth pausing on, because a repackaged app that has been modified by someone else cannot keep the original signature.
How to roll back to an earlier version
If the current release misbehaves, 2.6.1 is the last build before it. Android will not install an older version code over a newer one, so you must uninstall strongSwan VPN Client first — which clears its local data unless you have a backup. Reinstall the older APK only if its signing fingerprint matches the build you already trust, and check the API range: an older release may target an Android version your device has moved past.
Why we list sources instead of hosting everything
The official store channel is almost always the right choice: it updates automatically and carries the publisher's own distribution guarantees. A direct APK is useful when a device has no store access, when a rollout has not reached your region, or when you need a specific version — and only when the publisher has authorized that copy. APKBrowse does not list pirated, cracked, or unauthorized rebuilds of strongSwan VPN Client, and a listing is removed when the evidence for it stops holding up.
Get strongSwan VPN Client
Every source we list for org.strongswan.android is legality-reviewed. Pirated or cracked builds are never offered.
Other sources
F-Droid listing
officialF-Droid builds this app from source and signs it. This is its official listing, with older builds and full release notes.
Source code
verified publisherThe upstream repository this build is compiled from.
We check legality and signature continuity, but device behaviour still varies. Install at your own discretion.
App Information
Security Verification
We record provenance; we do not run malware scans. Verify the hash yourself before installing.
SHA-256 Hash
aa94ba159c74d3e665a9bea0a67ddd8d14a09927407c8d7a47e52d4fdf2d716b
Signing certificate
fbedb4835370c80d553cb48eecb329f5127287d83ab0f5ddbba3b084c5fcde91
Permissions Required
What each permission lets strongSwan VPN Client do. A highlighted one is worth a second look — not necessarily wrong, just worth asking whether this app needs it.
Previous Versions
The signing certificate fingerprint for this release is on record, so a build that does not match it did not come from this publisher.
More Social apps
More from F-Droid
Report a problem with this listing
A listing is only as good as its corrections. If a source is broken, a signature looks wrong, or this app should not be here, tell the moderation team.