Why ClashMeta is the best choice for Android in 2026
The original Clash project was archived in late 2023, and the Android ecosystem has reorganized around two actively maintained forks: ClashMeta for Android (also called cmfa) and its upstream core, Mihomo. ClashMeta for Android wraps the Mihomo core inside a polished Android app, giving you a native UI with subscription management, proxy group switching, connection logs, and traffic statistics—without ever touching a terminal.
Compared with basic VPN apps, a ClashMeta-based setup gives you rule-based routing instead of binary on/off. Domestic traffic goes direct, specific domains tunnel through your chosen node, and everything else follows your fallback policy. This matters on Android more than you might expect: streaming apps, payment services, and local delivery apps often break when all traffic is forced through a foreign exit node. ClashMeta's rule engine solves this at the configuration level.
If you are already familiar with Clash on desktop—say, Clash Verge Rev on Windows or macOS—your existing subscription URL works unchanged on Android. The same YAML profile format, the same proxy groups, the same rule sets. There is no need to learn a second system.
Choosing the right Android client
Several APKs circulate under the Clash name. Before downloading, it helps to understand the landscape so you install something that still receives updates.
- ClashMeta for Android (cmfa) — The recommended choice for 2026. Actively maintained, built on the Mihomo core, supports VLESS, REALITY, Hysteria2, and all modern protocols. This is the client this guide focuses on.
- Clash for Android (cfa) — The older companion app for the original Clash Premium core. It still works with legacy profiles but receives no meaningful updates now that the upstream core is archived. Avoid for new setups.
- FlClash — A Flutter-based cross-platform client also built on Mihomo. Suitable if you prefer a more minimal UI; configuration and subscription import work the same way.
For most users, ClashMeta for Android hits the right balance between feature coverage and stability. The APK is available from the project's official GitHub Releases page. Download directly from GitHub rather than third-party mirror sites to avoid tampered builds. The file is typically named cmfa-<version>-meta-arm64-v8a-release.apk for modern 64-bit Android phones, or the armeabi-v7a variant for older 32-bit hardware.
Download and install the APK
Google Play does not distribute ClashMeta for Android, so you need to install via sideloading. Android restricts this by default as a security precaution. The steps differ slightly by Android version, but the pattern is consistent:
- Open Settings → Apps (or Special app access on some skins) and enable Install unknown apps for your browser or file manager.
- Download the APK from the GitHub Releases page. On slower connections, verify the file size matches the release notes before opening it.
- Open the downloaded APK from your notification shade or file manager. Android will prompt you to confirm installation of an app from an unknown source.
- Once installed, open ClashMeta for Android. On first launch it asks for a VPN permission—tap Allow. Without this, the app cannot intercept traffic.
Some Android skins (MIUI, HyperOS, ColorOS) add an extra "security scan" step or block sideloading by default even after the toggle is on. If the installer is immediately blocked, look for a separate Pure Mode or App safety setting in your phone's security center and add a temporary exception. You can re-enable strict mode after installation.
Importing your subscription link
A subscription link—sometimes called an airport URL—is a remote HTTPS endpoint that returns a complete Clash-compatible YAML configuration. Your provider's dashboard typically shows it as a single long URL, often containing a token and a format parameter like ?flag=clash or ?clash=1.
In ClashMeta for Android, adding a subscription works as follows:
- Tap the Profiles tab at the bottom of the main screen.
- Tap the + button in the top right and choose URL.
- Paste your subscription URL into the URL field. Give the profile a recognizable name—for example, the provider name or the region you primarily connect through.
- Set an auto-update interval if you want the app to refresh node lists automatically. A 24-hour interval is a reasonable default for most users.
- Tap Save. The app downloads and parses the remote YAML immediately. If the download fails, check that your mobile data is active and that the URL has not expired—provider tokens often rotate.
After a successful import, tap the profile name to activate it. A checkmark appears next to the active profile. If you maintain multiple subscriptions—say, one for work and one personal—you can store them all in the Profiles list and switch between them with a single tap.
For a deeper look at how subscription URLs become a config.yaml and what the key fields mean, the subscription import guide covers every field in detail. Understanding that structure helps you troubleshoot profiles that fail to parse or contain outdated node formats.
Understanding proxy groups on mobile
Most provider-generated profiles include several proxy groups: a catch-all Proxy group, a Select group for manual node choice, and sometimes dedicated groups for streaming, gaming, or specific regions. The main screen of ClashMeta for Android shows these groups under the Proxies tab.
Each group has a mode selector: Select (manual choice), Auto (lowest-latency auto-selection), or Fallback (ordered failover). For everyday use, putting the top-level group in Auto mode and letting it pick the fastest node strikes a good balance. For scenarios where you need a specific country exit—accessing geo-locked content, for example—switch that group to Select and choose a node manually.
The latency numbers displayed beside each node are measured by the app's built-in health check, which sends test requests to the external controller. Tap Speed Test or the refresh icon to force an immediate round of checks. Nodes showing zero latency are either offline or blocked by the phone's network. Switch away from them to avoid timeouts.
If your profile includes a Reject group or explicit ad-block rules, you will see blocked connections in the Connections log with a red indicator. This is normal and expected behavior—it means the rule engine is working.
How split routing rules work on Android
Split routing is what separates ClashMeta from a plain VPN toggle. Instead of tunneling everything through a remote node, the rule engine evaluates each connection against an ordered list of policies and routes it accordingly. On Android, this matters for three common scenarios:
- Local services — Banking apps, government services, and food-delivery apps need direct connections to work correctly. Rules matching those domains or IP ranges send traffic straight through without any proxy.
- Blocked services — Social platforms, news sites, and developer tools that are restricted in your region get routed through the appropriate proxy group.
- Everything else (FINAL) — The catch-all policy at the bottom of the rule list handles traffic that matched nothing above. Most profiles set this to Proxy or Direct depending on the provider's default stance.
Provider-generated profiles usually ship with pre-built rule sets pulled from community repositories—GeoIP databases, domain-list files, and custom RULE-SET entries. You rarely need to edit rules manually. When a specific app or site behaves unexpectedly, open the Connections log, find that connection, and see which rule matched it. If a domestic service is being proxied, search the log for its domain and add a direct rule above the catch-all. If a foreign site is going direct, check whether its domain is missing from the proxy rule set.
The GeoIP feature deserves a special mention on Android. ClashMeta for Android ships with a bundled Country.mmdb database that maps IP prefixes to country codes. Rules like GEOIP,CN,DIRECT route all Chinese IPs directly regardless of domain—useful because many domestic CDNs serve content from IP ranges not covered by domain-based rules. The database updates automatically with the app; manual refresh is available in the settings.
TUN mode for full-device routing
By default, ClashMeta for Android intercepts connections through Android's VPN API, which covers most traffic from apps that respect system proxy settings. However, some apps—particularly games, peer-to-peer clients, and certain corporate software—bypass system proxies entirely and make direct TCP or UDP connections. For those cases, enabling TUN mode captures all IP-level traffic through a virtual network interface, closing the gap.
To enable TUN mode, go to Settings → Override → Enable TUN. The app will request an additional VPN permission if this is the first time you are enabling it. Once on, you will see a TUN badge on the main screen alongside the regular VPN indicator.
TUN mode has a measurable impact on battery because the kernel routes every packet through userspace. On a mid-range phone doing mostly HTTPS browsing, the additional drain is modest. For gaming sessions or long video calls, consider switching TUN off and relying on the default proxy mode unless you know the app in question needs it.
If TUN mode causes connectivity problems—particularly with IPv6, DNS, or captive portal detection on public Wi-Fi—disable it temporarily and fall back to standard proxy mode. The TUN mode guide has a deeper explanation of the underlying routing mechanics and common pitfalls that apply across platforms.
DNS configuration and fake-IP
ClashMeta for Android includes its own DNS stack that intercepts resolution requests and routes them through the correct upstream based on domain rules. This matters because Android's default DNS resolver can leak domain queries to your ISP even when traffic is proxied—a subtle privacy and reliability issue.
Most provider profiles pre-configure a fake-ip DNS mode, where the app returns synthetic private IP addresses for proxied domains and stores the real hostname for later. The real hostname gets forwarded to the remote node's resolver instead of your local ISP, preventing DNS leaks. You do not need to change anything here for typical use.
If you are on a corporate network that requires specific DNS servers, or if you use split-DNS for a private overlay network, switch the DNS mode to redir-host in the profile's dns section and point the nameservers accordingly. Be aware that redir-host resolves domain names locally before the proxy decision is made, which can cause rule mismatches for CDN hostnames that resolve to different IPs by region.
Battery and performance tips
Running a persistent VPN service consumes slightly more power than no VPN at all, but a well-configured ClashMeta instance is far lighter than many users expect. A few habits keep battery drain in check:
- Leave TUN mode off unless you specifically need it for a non-proxy-aware app. Standard proxy mode through the VPN API is more efficient.
- Set a realistic health-check interval in your profile (
interval: 300seconds or more). Overly frequent latency tests wake up the radio unnecessarily. - Keep the subscription auto-update interval at 12–24 hours rather than every hour. Full profile downloads parse YAML, rebuild rule indices, and are not cheap on weaker processors.
- On Android, grant ClashMeta for Android Unrestricted battery usage in Settings so the OS does not aggressively kill the background service—ironically causing higher overall battery use from repeated reconnections.
If you notice the VPN indicator disappearing and reappearing frequently, the service is being killed by Android's battery optimization. Whitelist the app in your phone's battery settings and the problem typically stops.
Common questions and troubleshooting
Profile import fails or shows zero nodes
Check that the subscription URL is complete and has not been truncated by your clipboard. Some provider dashboards shorten URLs for display—tap the copy icon rather than selecting text manually. If the URL starts with http:// instead of https://, some Android WebView versions block the download for mixed-content reasons; ask your provider for an HTTPS link.
VPN is connected but no internet
Open the Connections log and look for a pattern. If all requests show DIRECT and still fail, your phone's underlying data connection has an issue unrelated to ClashMeta. If requests are being proxied but timed out, the selected node may be down—switch to another group or trigger a speed test to identify a working node. A blank or empty proxy group usually means the profile downloaded but contains no outbound servers in that group, which sometimes happens with trial subscriptions that have expired.
A specific app is not being routed through the proxy
Some apps use certificate pinning or custom DNS-over-HTTPS resolvers that bypass the system DNS stack entirely. Enable TUN mode to capture those connections at the IP level. Alternatively, use ClashMeta's App Filter setting under Override to include or exclude specific package names from the VPN tunnel.
Connection speed is slower than expected
Use the speed test to find the lowest-latency node and compare with your expected service tier. If the winning node still feels slow, the bottleneck may be the provider's server capacity rather than your configuration. Try a node in a geographically closer region. Also check whether your profile routes large file downloads through a low-bandwidth proxy group—some profiles have a dedicated Download or Streaming group with higher-capacity nodes.
Still running into issues after checking these? The general Clash troubleshooting guide covers DNS leaks, port conflicts, and subscription parsing errors that apply regardless of which platform you are on.
A phone-first proxy experience that actually works
Getting Clash running on Android used to involve jumping between half-maintained forks and hoping your subscription URL happened to be compatible. ClashMeta for Android changed that. The Mihomo core it ships with supports every major protocol in use today, and the subscription import flow has been refined to the point where most users are up and running in under ten minutes.
The same subscription URL you use on your desktop works directly on your phone. Split routing rules keep domestic apps fast and foreign services accessible without you manually toggling anything. Once you have set up a profile and confirmed it in the Connections log, you can largely forget ClashMeta is running—which is exactly what a good network tool should feel like.
If you also want a seamless experience on Windows and macOS, the desktop Clash client uses the same Mihomo core and the same configuration format, so your subscription travels across devices without any conversion step. → Download Clash for free and experience the difference