Secure, fast, and private VPN protection for your Windows PC.
Download the latest version or previous releases
Windows 1.0.366 (2026-10-07): Fixed SRSP recovery after direct connection timeouts; direct connections remain first, with a relay retry and the actual selected exit displayed.
64-bit • 45 MB • Windows 10/11
GhostMesh_1.0.366_x64.exe SHA256:
b348a7dc0f09a8cbd72ffe141687a6c11ace128acd145181ced898449be4ac2cGhostMesh_1.0.366_x64.msi SHA256:
ac0d8293075735e8ddcee6bcd988908e1a6b2c06843943e65794f7dbd75105f7After downloading, run in PowerShell or Command Prompt:
GhostMesh_1.0.366_x64.exe
certutil -hashfile GhostMesh_1.0.366_x64.exe SHA256GhostMesh_1.0.366_x64.msi
certutil -hashfile GhostMesh_1.0.366_x64.msi SHA256By downloading, you agree to our Terms of Service and Privacy Policy.
1.0.365 (2026-10-01): Android — Improved tunnel stability when an application stops reading a connection. A stalled connection is reset after a bounded wait; other traffic can continue. Includes the updated SRSP core and selected-route readiness fixes.
1.0.364 (2026-09-30): Android — Fixed a case where one stalled connection could freeze Telegram and other apps in the same tunnel. A connection is now reported ready only once the selected route is warmed up. The app also sends anonymous connection diagnostics (outcome, failing stage, network type; no account, addresses or destinations) to help us find blocked routes.
1.0.363 (2026-09-29): Android — fixed an endless reconnect: while the local proxy restarted, the app's own requests to the GhostMesh server went to the stopped 127.0.0.1:10808 port and failed, leaving Telegram and other apps stuck on "Connecting…". The tunnel to the server is also warmed up in advance now, so apps open their first connection faster after connecting.
1.0.361 (2026-08-26): Android — switched fully to the native SRSP runtime, removed the unused legacy transport and obsolete large ruleset, and added lightweight native traffic telemetry. APK and AAB include arm64-v8a and armeabi-v7a runtimes.
1.0.360 (2026-08-24): Android — the embedded SRSP core now applies traffic shaping in the production mux write path. Padding uses cryptographic randomness and conservative defaults, while bounded backpressure prevents unbounded queue growth under load. The signed APK and Google Play AAB include refreshed arm64-v8a and armeabi-v7a native runtimes.
1.0.359 (2026-08-16): Android — the connection button stays available while connecting, and tapping it again cancels the current attempt. Connections that do not complete within 60 seconds are stopped automatically; the VPN service, TUN and SRSP process are cleaned up without reporting an intentional cancellation as an error.
1.0.358 (2026-08-14): Android — fixed SRSP startup when the server endpoint is supplied as a hostname. GhostMesh now resolves and reuses a numeric IP before starting the native tunnel, avoiding the ‘host must be an IP literal’ failure. Server lists are cached for faster startup and temporary API outages, and connection diagnostics include the app version and selected language without exposing credentials.
1.0.357 (2026-08-13): Android — fixed Telegram losing connectivity after about two minutes while other apps remained online. External health probes are now diagnostic only and cannot restart a working tunnel merely because public check URLs are unavailable. The connection pool no longer retires a carrier with active MTProto/TCP streams, and empty native UDP keepalives cannot create or retain stale server associations. The language used for a delivered sign-in email is saved as the default for account notifications when no preference was set, and diagnostic reports now include the selected app language.
1.0.356 (2026-08-08): Android — connecting is immediate again. A local port the app needs for DNS is often already taken on Android, and when it was, the tunnel engine failed to start and the app waited out a ten-second timeout before switching to its fallback. Every connection paid those ten seconds. The engine now picks a free port instead of giving up. Also fixes a green band across the top of the screen while the app was starting.
1.0.354 (2026-08-07): Android — the tunnel now runs on our own engine. The app hands the system tunnel straight to the GhostMesh core instead of routing it through a third-party component, which removes a whole layer between your traffic and the server. Along the way we fixed a fault that could leave a connection showing as active while carrying nothing: the engine stopped reading the tunnel after a harmless first empty read and never said so.
1.0.353 (2026-08-06): Android — the app starts about a third faster: heavy initialisation moved off the main thread. The server list appears immediately from the saved copy and refreshes in the background. Separately, server chains ("Russia (White List)") were fixed on the servers: the connection was established but carried no traffic, because the relay dropped the marker that signals a connection is ready. That fix is already live and needs no app update.
1.0.352 (2026-08-04): Android — fixed disconnect→reconnect stuck until force-stop (SRSP always torn down; disconnect serialized; sticky auto-start cleared with commit). Reduced overheating: timed wake lock, slower health probes, longer SRSP idle/rekey intervals.
1.0.349 (2026-08-28): Windows • Fixed a startup hang: recreating a leftover VPN network adapter from a previous session could take unusually long with no feedback, and the app would silently wait out the full connection timeout. It now fails fast with a clear reason instead of stalling blind.
1.0.348 (2026-08-26): Windows • Added Shopping Route for selected travel and shopping domains through Colombia, Brazil, and Malaysia relays. • Shopping connections now start only on demand and safely fall back to the primary VPN relay. • Improved CAPTCHA and external image/video CDN compatibility; desktop remains native-SRSP-only.
1.0.347 (2026-08-26): Windows • Improved CAPTCHA compatibility by keeping shared Google and Cloudflare challenge infrastructure on the site's default route. • Desktop now uses only native SRSP; legacy transport assets and fallback paths were removed.
1.0.346 (2026-08-25): Windows • Removed the unnecessary warm-pool wait from the connect path. The real tunnel probe now starts immediately, cutting up to two seconds while keeping DNS, TUN, and security checks intact.
1.0.345 (2026-08-24): Windows • SRSP traffic shaping now runs in the production mux write path. • Padding uses cryptographic randomness and conservative defaults; bounded backpressure prevents unbounded queue growth under load. • MSI packaging now detects failed builds and resolves the installer UI dependency reliably.
1.0.344 (2026-08-14): Windows • Connection failures now include the connection stage, SRSP state, client version, Windows version and selected UI language, helping support diagnose issues faster. • Diagnostics are scrubbed on the device to remove tokens, passwords, UUIDs, email addresses and keys. Failed error reporting never interrupts the connection flow. • Fixed a tray-menu crash when reopening a popup window that had already been closed.
1.0.343 (2026-07-28): Android — adds an optional Full ad & tracker database setting. It stays off by default for fast connections; enabling the 16 MB filter list can add about 10 seconds to connection setup. The standard fast AdBlock mode and existing SRSP recovery safeguards remain available.
1.0.342 (2026-08-03): Windows • Disconnect is now instant even mid-connection — it no longer waits for the connection attempt to finish. • Faster normal disconnect: network settings (DNS, IPv6) are restored in parallel and the adapter settle delay was moved to the next connect. • 7 Days to Die: in-game Discord voice now connects reliably through the tunnel, and the game's analytics domain no longer triggers errors. • Added per-phase connection timing to the logs for diagnostics; rebuilt the embedded SRSP client.
1.0.341 (2026-07-30): Windows • Updated the embedded SRSP core to v42 and synchronized its recovery backup. • Hardened experimental session rekey, replay/epoch validation, and active-probing handling. • Canonical session and Native UDP remain closed opt-in features and are disabled by default. • Refreshed the EXE and MSI installers.
1.0.340 (2026-07-29): Windows • Unified the SRSP core v41 build ID across client, server, and packaged runtime. • Added independent wire verification for the Chrome 150-compatible JA4 fingerprint; JA4 is a camouflage fingerprint, not encryption. • Experimental canonical session and Native UDP remain off by default and require an explicit server opt-in. • Refreshed EXE and MSI installers.
1.0.339 (2026-07-28): Windows • Refreshed SRSP runtime with full-duplex transport, mux lifecycle, and reconnect hardening. • Packaging now detects stale SRSP assets and includes a matching gzip self-heal copy. • TLS and socket failures now include actionable inner-error details in support diagnostics. • Refreshed EXE and MSI installers.
1.0.334 (2026-07-22): Windows — SRSP routing/adblock hashlist support, connection-error reporting fixes, and refreshed SRSP client assets.
1.0.331 (2026-07-07): Android — improved support chat with a messenger-style layout, topic selector, automatic message refresh, unread indicators, fixed support API routing, and better SRSP startup diagnostics.
1.0.330 (2026-07-19): Windows — smarter auto server selection by measured quality (RTT, jitter, loss, load) instead of a single ping; optional Game Boost native UDP packet duplication for lossy last-mile links; refreshed SRSP client in the installer.
1.0.329 (2026-07-12): Windows — Profile settings UI polish: removed redundant Refresh control, capsule-shaped Manage subscription and Log out buttons, and updated SRSP client packaging to ship the x86_64-pc-windows-msvc release build for more reliable tunnel startup.
1.0.328 (2026-06-19): Windows release - fixes the About page update flow so a downloaded update changes the action button to Install update and launches the verified installer instead of checking again. Also improves SRSP startup and reconnect reliability.
1.0.324 (2026-06-13): Windows - restored Proxy mode to route almost all sites through the tunnel by default, keeping only explicit direct exceptions for local/RU services, product domains, and game routes. Fixed pages opening blank or without styles when new sites were not in the smart allowlist. AdBlock and DNS Shield are now opt-in by default, and Google Ads/analytics endpoints are no longer hard-blocked at TCP level to avoid breaking site rendering.
1.0.323 (2026-06-05): Windows - improved connection stability, optimized app performance, fixed GameBoost discovery/routing, and marked GameBoost as a Beta feature while we continue tuning it.
1.0.320 (2026-05-23): Windows — fixed SRSP proxy reconnects so switching restores the working 127.0.0.1:1080 system proxy, with bundled runtime/SRSP assets and improved SRSP fallback handling.
1.0.320 (2026-05-23): Windows — fixed SRSP proxy reconnects so switching restores the working 127.0.0.1:1080 system proxy, with bundled runtime/SRSP assets and improved SRSP fallback handling.
1.0.310 (2026-03-08): Fixed Download/Upload traffic stats; Proxy mode: WhatsApp, Telegram, Discord now work via TUN; Zoom excluded from proxy for stable video calls.
1.0.309 (2026-03-05): Proxy mode improvements: default is now "proxy only for selected domains"; null-safe domain lists; correct matching for bare domains (e.g. example.com and .example.com); PAC and route rules aligned.
1.0.308 (2026-03-03): Fixed TUN mode: no internet when connected. The app now sets DNS 1.1.1.1 (Cloudflare) on the TUN interface so domain resolution works through the tunnel.
Click the "Download Installer" button above.
Run the downloaded GhostMesh_1.0.366_x64.exe file.
Follow the on-screen instructions to complete the installation.
Launch GhostMesh VPN and log in to your account.
Why does SmartScreen appear?
SmartScreen blocks or warns about apps that are not yet well-known to Microsoft: new publishers, low download counts, or installers without an Extended Validation (EV) code signing certificate. GhostMesh is a legitimate app; the warning appears only because it is relatively new and not yet in Microsoft's reputation database.
How to run the installer safely
You can proceed safely by verifying the file and then allowing the run: (1) Check the SHA256 hash of the downloaded file (see "Verify installer integrity" above) to ensure it matches the official build. (2) In the SmartScreen dialog, click "More info" and then "Run anyway." Windows will remember your choice for this file. We recommend always verifying the hash before running any installer.