Capabilities
What Torna supports
An honest map of every transport and provider Torna handles — and exactly how. We separate what the Torna app dials natively from what you can carry into any compatible client, so nothing here over-promises.
In the Torna app
Protocols the native client can dial on its own — no third-party app needed. WireGuard is the current live native path; the rest stay marked in progress until app-shell wiring and upstream interop are verified.
Fast modern VPN tunnel. Fully implemented and end-to-end tested — the app’s default today.
Stealth WireGuard (junk packets + header obfuscation) that defeats WireGuard fingerprinting. Implemented in core; interop verification pending.
TLS-camouflage that mimics real sites — the moat against DPI. Built on a from-scratch TLS-1.3 client (verified against rustls); xray auth derivation pending.
QUIC, congestion-optimised for lossy links. Implemented incl. real HTTP/3 auth + the proxy data plane; upstream interop pending.
QUIC with UUID auth — low-latency UDP relay. Implemented with TLS-exporter mutual auth; interop pending.
Lightweight stateless proxy (pairs with REALITY). Implemented natively over TLS + WebSocket; interop verification pending.
Encrypted V2Ray proxy. Implemented natively (VMess-AEAD); interop verification pending.
Traffic that looks like plain HTTPS. Implemented natively over TLS; interop verification pending.
Battle-tested AEAD stream proxy. Implemented natively (chacha20-poly1305 / aes-256-gcm); interop verification pending.
Classic TLS VPN. Implemented natively from scratch (no FFI) — handshake + AES-256-GCM data channel; interop pending.
“In progress” means implemented and unit-tested in the client core — wiring into the app shells and a verified handshake against the upstream server (interop CI) are the remaining steps before “Live”. We label it honestly rather than claim a protocol is shipping before it’s verified. WireGuard is fully live today.
Native protocol proof packet
Use this before moving any native protocol claim to Live or advertising it broadly. It forces the owner to name implementation proof, upstream interop, app-shell wiring, and the advertising decision.
- Protocol
- Example: WireGuard / AmneziaWG / VLESS / Reality / Hysteria2 / TUIC / OpenVPN
- Current public label
- Live / In progress / Compatible-client only / Do not advertise
- Launch path
- Native Torna app, compatible-client export, or explicitly excluded from launch copy
- Implementation evidence
- Test, commit, build, or artifact proving implementation in the current codebase
- Upstream interop target
- Canonical server/client and exact version used for interoperability
- Interop CI or command
- CI run, command output, or reproducible smoke reference
- App shell and platform
- Android / iOS / desktop shell and OS/device version tested
- Observed result
- Connected / parsed only / failed interop / not tested, with timestamp and owner
- Advertising decision
- Allowed in ads / keep as in-progress / compatible-client wording only / do not mention
Keep protocol evidence low-risk: Do not paste private keys, server secrets, full subscription URLs, raw customer traffic, exploit payloads, provider credentials, full packet captures with personal IPs, or screenshots containing unrelated personal data.
Transports & obfuscation
Carriers and disguises the protocols above ride inside — to blend with CDN traffic or slip past SNI/host filtering. Composable: any protocol over any transport.
WebSocket carrier — rides CDN edges as ordinary browser WS traffic. Wired under VLESS/Trojan.
gRPC (“gun”) carrier over HTTP/2 — the other common CDN-friendly shape.
simple-obfs (http) — disguises the connection start as an HTTP upgrade. Backs HTTP-injector configs.
Transparent capture (tun2socks) — routes the whole device through any protocol above, no per-app config.
All implemented and tested in the client core; the same not-Live-until-verified rule applies.
Via compatible clients
Torna can mint a signed subscription URL for clients such as Hiddify, Karing, V2Box, NPV, v2rayN, NekoBox and sing-box. This is the practical iOS path today, but it is labelled separately from Torna-native protocol support.
Standard WireGuard config material for compatible clients.
Signed VLESS/REALITY subscription material for clients that already implement the protocol.
Hysteria2 subscription material for clients that implement Hysteria2 themselves.
TUIC v5 subscription material for clients that implement TUIC themselves.
Parsed for inventory only — no sing-box outbound exists, so it can’t be dialed or verified.
Verification still applies before an endpoint can be exported — Torna never hands out an unverified server. Broad advertising still needs a real client/device matrix, so this page does not call third-party client support “native Live”.
iPhone without App Store
The launch path for iOS is web login, top-up and route selection, then import into a compatible client or install an Apple profile when the route actually supports it.
Scan QR, copy, share, or deep-link the signed subscription into common iOS VPN clients.
Apple built-in VPN profile generation exists for routes that carry IKEv2 material.
Apple can install L2TP/IPsec profiles, but Torna treats this as last-resort legacy compatibility.
IKEv2 profiles require real IKEv2 supply. L2TP/IPsec is kept only as a legacy fallback and should not be marketed as the secure flagship path.
iPhone client matrix
Before advertising, each iPhone lane needs a named client, import method, evidence, and a launch gate. The matrix below is deliberately conservative: wired paths still need real-device proof.
| Client | Import path | Current evidence | Launch gate | Status |
|---|---|---|---|---|
| Hiddify | Deep link, QR, copy, share | The consumer page generates a signed session URL and exposes a Hiddify import button. | Real iPhone import and connect test on the current client version. | Wired |
| Karing | Deep link, QR, copy, share | The consumer page generates a signed session URL and exposes a Karing import button. | Real iPhone import and connect test on the current client version. | Wired |
| V2Box | QR, copy, share | The consumer page shows QR, Copy and Share for clients that do not support a stable deep link. | Real iPhone import and connect test on the current client version. | Test needed |
| NPV | QR, copy, share | The consumer page shows QR, Copy and Share for clients that do not support a stable deep link. | Real iPhone import and connect test on the current client version. | Test needed |
| sing-box | Copy URL into subscriptions | The signed subscription is meant for sing-box/v2ray-style subscription clients; parser proof is still external. | Client parses the Torna subscription and connects through at least one verified route. | Test needed |
| Shadowrocket | QR/copy if users have it | Only a market-availability candidate; do not treat it as a default path until target users can access it. | Confirm users in the target market can actually obtain and update the client. | Optional |
| Apple built-in VPN | .mobileconfig install | Gateway profile generation exists only when the selected route carries Apple-native IKEv2 or L2TP material. | Provision real IKEv2/L2TP supply, test profile install, and decide whether CMS signing is required. | Supply needed |
Do not turn a row into a launch claim until its gate is complete. The safe advertising message is web top-up plus compatible clients, with the tested client named explicitly.
Real iPhone proof packet
When a tester proves an iPhone path, copy this packet into the launch evidence. It captures the minimum facts needed for /ops without leaking the signed subscription token.
- Device
- iPhone model used for the real test
- iOS version
- Exact iOS version
- Client and version
- Hiddify/Karing/V2Box/NPV/sing-box/Apple VPN plus version
- Import method
- Deep link, QR, copy/share, manual subscription, or .mobileconfig
- Route/session reference
- Session prefix or route/pool id; do not paste the full signed URL
- Connection result
- Connected / import failed / parsed but route failed, with timestamp and network
- Proof path
- Screenshot/video path, ticket id, or tester note reference
- Advertising decision
- Allowed in ads / do not advertise / retest needed, with owner initials
Keep the proof safe
Do not paste the full signed subscription URL, QR secret, Apple profile payload, login token, OTP, private key, full personal screenshots, or unrelated device data into launch evidence.
Bring your own configs
Already have servers? Paste a share link, a subscription, or drop a config file. Torna parses them as inventory and then requires verification before any user receives them.
Share links & subscriptions
Config files
Imported endpoints are inventory until they pass the verification gate. OpenVPN is parsed for its server details but can’t be dialed — no transport in Torna or sing-box carries it.
Bring your own servers
Bring-your-own server onboarding is the current live supplier path. Managed cloud provisioning drivers are coded, but production still needs live account smoke tests before they are launch claims.
Managed provisioning driver is present; live provider-account smoke is still required.
Managed provisioning driver is present; live provider-account smoke is still required.
Managed provisioning driver is present; live provider-account smoke is still required.
Managed provisioning driver is present; live provider-account smoke is still required.
Managed provisioning path is present; attribution and domestic-ingress risk need operator review before launch.
Any VPS you already operate — register it directly over SSH.
Control-plane protections
Mechanisms Torna uses to keep routes and money movement understandable.
Inventory must pass verification, reachability and selling-state gates before selection. Operators still need real launch drills.
Anonymous credentials exist in the control plane; production must keep real attestation on and avoid staging stubs.
Supplier balances, withdrawals, audit logs and optional treasury webhooks are implemented. Public reserves and custody procedures still need launch ownership.
Gateway and supplier probes feed routing health. Independent/in-country vantage points are a scale requirement, not a current launch claim.
Statuses reflect the current codebase and the launch audit, not a roadmap wish-list. Native protocols move to “Live” only after real upstream interop and app-shell evidence; compatible-client exports stay labelled as exports.