Nexa for Desktop
One click. Everything covered.
Connect your nodes and cover every program on your computer; no leaks when the line drops, and every connection is visible and adjustable.
Connect & Cover
One click. Everything covered.
One click and your browser, command line, system services and dev tools all go through the proxy; disconnect and everything is restored exactly as it was.
Browsers and most desktop software.
Chrome · Edge · WeChatThe command line, and programs started from it.
git · npm · pip · curlWindows services, system updates, and some PowerShell and .NET programs.
System updates · Background servicesWrites the proxy into dev tools' own config files.
Claude Code · Codex · GitA virtual network adapter takes over all traffic at the network layer, so games, voice chat and other proxy-unaware programs go through too.
Games · Voice · Any programConnected means connected
Before showing “Connected”, Nexa probes several addresses in parallel to confirm traffic really flows; if not, it rolls everything back, so you never see “connected” without a working connection. Progress is shown step by step.
Separate channels, each with its job
System, terminal and app proxies plus system-wide TUN each cover one kind of program, and Windows adds a service proxy. Turning on TUN pauses the others, and your choices come back when it's off.
Authorise once, then forget it
TUN and the Windows service proxy ask for admin rights the first time you turn them on; after that, switching never prompts again (on a Mac, at most one password per version; the Linux packages set this up when installed).
Three routing modes
Switch between Rule, Global and Direct anytime. DNS listens only on your computer, with optional privacy-first DNS (browsing domains use encrypted DNS abroad, forced through the proxy exit).
Everything on one screen
Live upload and download with the last minute's trend, split into all, proxied and direct; your current public exit IP and location; one-click speed tests (quick about 20 MB, full about 180 MB).
One-click environment checks
Jump straight to 8 third-party checkers (IP environment, IP quality and leaks, browser fingerprint, anonymity, fraud risk, split-routing exit) to see whether your exit reveals anything real.
Kill Switch
When the line drops, nothing leaks.
When the network has trouble, Nexa would rather pause your programs than let them fall back to a direct connection and expose your real IP.
Block direct traffic on disconnect
On by default. When a connection fails, reconnects, the app quits, crashes or restarts for an update, proxy channels keep pointing at your computer: programs pause instead of going direct. Direct access returns only when you click “Disconnect” yourself. In TUN mode the system proxy stays on as a backstop.
Real path checks
About every 20 seconds a real request confirms the exit is reachable, not just that a process is still running. If the core itself fails, Nexa reconnects every 5 minutes and never gives up; Reconnect now tries again at once.
Node down, LAN still up
On a company network, or any network that blocks the node, the core and every channel keep running: direct rules, company DNS and the LAN all work, and traffic for the node fails instead of going direct. Once the node answers, Nexa is connected again; a dropped SSH exit redials by itself.
Groups never downgrade
When every node in a group fails, or any hop in a chain breaks, traffic never falls back to direct.
Restores even after a crash
Your previous system proxy settings (and on Windows, service proxy settings) are kept in a file and restored automatically on the next launch after an abnormal exit.
Seamless updates
New versions download in the background and the connection usually stays up while updating; if a new version fails to start, it rolls back automatically.
Connected · Los Angeles, US · 168 ms
Path trouble · Rebuilding the connection
Traffic locked · Zero requests bypass the proxy
Restored · Down 6 seconds, real IP never exposed
Nodes
Bring any source, ready in a click.
Provider subscriptions, your own servers and residential proxies all fit in, and you know which is fast, which is steady and which works with ChatGPT before you use it.
Four ways to add
- Subscriptions: Clash / Mihomo YAML, sing-box / Xray JSON, Base64 link lists
- Share links: one per line, paste in bulk
- SSH tunnel: any server you can log in to will do
- SOCKS5 / HTTP proxy: the usual residential IP format; paste “host:port:user:password” directly
All mainstream protocols
VLESS (including REALITY and XHTTP), Trojan, Shadowsocks, VMess, AnyTLS, Hysteria2, TUIC, WireGuard, SSH, SOCKS5, HTTP.
Subscriptions without the fuss
- Shows remaining traffic, next reset and plan expiry, with a reminder before it runs out
- Updates on the interval your provider suggests
- If an update fails, the last good nodes stay and the reason is spelled out plainly
Speed and stability together
- Latency tests with adjustable concurrency
- Bandwidth tests of about 5 MB per node, with the total data use shown before a batch starts
- Stability: each node shows real connection successes and failures from the last 15 minutes; latency tells you speed, success rate tells you stability
Unlock checks
- Checks ChatGPT, Claude, Gemini, YouTube Premium and Netflix on every node and marks the results on each node
- Runs in a temporary test core: no need to connect, and your current connection is untouched
- Filter nodes by “works with a service”, build a group in one click, or send that service through a node in one click
Exit profile
Tells whether an exit is a data centre, residential or mobile network (several lookup services cross-checked, erring on caution); a node's country comes from its name, then its real exit, then its server address.
Free node pool
- Pulls from 10 public sources, removes duplicates, tests them and keeps the fastest (20–200, adjustable), refreshing on a schedule
- Add or remove sources yourself
- A standing reminder in the app: don't send sensitive information through public nodes
Share to your phone
- Share links and QR codes per group, split across several codes when there are many nodes
- Or export a Clash config that includes your current rules
- “LAN link” lets a phone on the same Wi-Fi scan and add it as a subscription; change the address anytime to retire old links
Node Groups
Many nodes, one steady route.
Turn several nodes into one exit that picks automatically, backs itself up or relays hop by hop, the way you need.
When the preferred node fails, a backup takes over at once; when it recovers, traffic moves back.
Fallback
Uses the preferred node first; if it's down, moves down the list in order and switches back once it recovers.
Fastest
Re-tests every two minutes and uses the lowest latency; tiny differences don't trigger a switch, so your IP doesn't keep changing.
Same-site Pinning
Each website always uses the same node, so logins, captchas and payments that dislike IP changes stay put; if a node drops, only the sites it handled move.
Random
Picks one node at random and keeps it until it becomes unavailable.
Chain
- 2–5 hops: the first is the entry, the last is the exit websites see
- Drawn as a path while you edit; once saved, test latency and bandwidth across the whole path
- A hop can be a group (several relays backing each other up), and a chain can itself join a group
- Residential SOCKS5 / HTTP proxies work best as the last hop
Picking nodes made easy
Filter by keyword and by several countries and regions at once, then pick the top N in one click.
Rules
Every connection, accounted for.
What goes direct, what goes through the proxy and what's blocked is clearly laid out; and when a rule doesn't take effect, one test tells you why.
Ready out of the box
- 8 rule sets ship with the installer and work without downloading, updated quietly in the background every day: mainland China direct, overseas proxy, mainland IPs, LAN, ads and trackers and more
- Add any public rule source too (YAML, plain text, MRS)
Four kinds of local rules
- Routing rules: decide direct, proxy, block or a specific exit by domain, IP, client program, or domain and IP categories
- DNS rules: send chosen domains to their own DNS servers, such as intranet domains
- Custom resolution: like the system hosts file
- Virtual IP rules: for LAN devices, games and other domains that need a real IP
Specific exits
A rule can point at a node, a group or a chain, for example Chrome through Japan and OpenAI through the US.
Rule test
Enter a domain, IP or URL (optionally with a program) to see at once which rule matches, which rules it shadows, which DNS is used and whether a virtual IP is assigned.
Conflict detection
- When a new rule conflicts with an existing one, you see it and confirm first
- Rules shadowed by earlier ones, which would never apply, are flagged with a one-click “Move above it”
Easy to manage
- Add in bulk, one per line, each with an optional note; clear them all in one go
- Change targets in bulk, move to top or bottom
- Import and export (Nexa format, or Clash rules for other clients)
Live Connections
See where every connection goes.
Who started every connection on your computer, where it went, which rule it matched and which exit it used: all live, and fixable the moment you see it.
Every connection, in full
Program (with icon), destination, matched rule, exit node, live speed, protocol and duration; double-click for the full policy chain and process path.
Group and filter every way
- Group by program, website, exit or device
- Filter by route (proxy / direct / block), protocol (HTTPS, QUIC, DNS, UDP…) and source (this computer / shared devices)
- Advanced search with and / or / ! / brackets, plus fields such as “client:” and “exit:”
Fix it where you see it
Right-click one or more connections to create rules directly, with an automatic check for rules that would shadow them; disconnect in bulk too. Nexa also suggests rules from your traffic: send a site whose direct connections keep timing out through the proxy, and a site in China that goes through the node direct.
Even Nexa is transparent
Nexa's own requests, such as speed tests, subscription updates, DNS lookups and rule downloads, are labelled separately; shared devices and local virtual machines are told apart.
Failures on record
Timeouts, refusals, unreachable hosts, DNS failures and connections gone in under a second are listed on their own, saying whether the node or the destination failed and what to try; recently closed and blocked connections are here too.
Browser request details
Optional, with Guard: lists each request the browser makes with its status code or error and timing, matched to the connection and exit that carried it. Off by default, kept in memory only and cleared when you turn it off.
Traffic Stats
Thirty days in one clear ledger.
Which programs, websites and exits used your traffic, and how steady your lines were: thirty days of it, all kept on your computer.
Trends and patterns
Traffic trends for today, 7 days and 30 days, hourly patterns and protocol mix, viewed for all, proxied or direct traffic.
Four leaderboards
Top programs, top websites (merged by main domain), destination regions and exit nodes.
Node health report
Probe success rate, latency trend, connection failures and switches for every node you used.
Dropout history
Thirty days of connection status as daily tiles: which days dropped, for how long, and whether the kill switch held.
Block log
Blocked domains, the program that asked and the rule that matched; let a false block through in one click.
Your data stays on your device
Only domains are recorded, never full URLs; kept for 30 days and cleared in one click.
App Proxy
Your dev tools, covered too.
Some tools ignore the system and terminal proxy, so Nexa writes the proxy into their own config files and restores them when you disconnect.
Common dev tools built in
ChatGPT Codex, Claude Code and Git are on by default; npm, pip and Cargo are one click away; only detected programs are written to, and nothing is created for tools you don't have.
Any program you like
Supports KEY=value (.env / .npmrc), INI, JSON and TOML; only the keys you list change, while the rest of the file, its comments and order stay as they were; preview changes before saving.
Respects other changes
If a key was changed by another program or by hand, Nexa marks it “changed elsewhere” and skips it on restore instead of overwriting.
Disconnect restores
Written proxy entries are withdrawn when you disconnect, or cleared all at once.
One-click fix for Store appsWindows
When Microsoft Store apps such as Claude keep old proxy settings and stop using the proxy, reset them in one click with your login and chat history kept.
TUN as the backstop
Programs that ignore every proxy and have no config to write, such as Discord voice and most games, are handled by system-wide TUN.
Privacy
Your system follows your exit.
Keep your computer's time zone and region in line with your proxy exit, and close browser leaks with Guard; every change records the original value and is undone when you disconnect.
Time zone follows exit
After connecting, the system time zone matches your exit region and is restored when you disconnect or quit; pick the city yourself for countries with several time zones.
Region follows exit
The system's country or region setting matches your exit (only a system preference; it never changes your IP or GPS).
Hardened browser policies
Applied as browser policies that other extensions can't override:
- Restrict which networks WebRTC may useWindows
- Stop websites from listing your system fonts
- Optionally turn off the X-Client-Data header
Works with Guard
Turn on the browser bridge in one click and Guard reads your connection status and exit region live. Only status is shared and browsing history is never read; browser request details stay off until you turn them on in Connections.Explore Nexa Guard →
Straight to system permissions
Shows location status and opens the system's location, camera, microphone, diagnostics and other privacy settings in one click.
Does what it says, nothing more
No fake GPS and no undocumented registry edits; original values are saved first and restored first thing on the next launch after an abnormal exit.
More
Thoughtful details, everywhere.
Get started.
One installer sets up the desktop app and Nexa Guard together.