Windscribe VPN

What's new in this version:

Windscribe 2.12.7
Added:
- flags for new and upcoming locations
- link to our website for further information about the Circumvent Censorship feature in preferences
- additional curl logs for failed server API requests in wsnet

Improved:
- UDP/TCP/Stealth/WStunnel protocol performance by using OpenVPN DCO kernel driver as their default driver
- behavior when querying the SSID on W11 24H2 and Location services is off
- description for packet size, clarifying that it doesn't do anything for TCP-based protocols
- error message when update download fails
- the failover algorithm in wsnet to prevent it from 'sticking' to one domain

Fixed:
- docked app does not detect change in taskbar size and adjust position when displayed
- app update may fail to stop and remove OpenVPN/Wireguard daemons
- debug log may fail to send
- double blinking cursors on custom config credentials prompt
- custom config authorization data not deleted when custom config directory cleared
- latency endpoint duplicate requests
- imported JSON values may be incorrect
- additional JSON & GUI input validation errors
- proxy validation to only allow an IP address. Prior proxy configurations using a hostname will no longer function
- proxy gateway sometimes sends invalid headers
- memory leaks in wsnet
- UDP protocol may fail to connect when Circumvent Censorship is enabled
- "Secure Hotspot" feature not being disabled properly when using IKEv2
- installer ignoring username/password command-line arguments
- emergency connect fails to connect due to incompatibility with OpenVPN DCO driver

Updated:
- OpenVPN DCO driver to v1.2.1
- German translations provided by GitHub user Evonos
- Spanish translations provided by GitHub user IceString3
- Russian translations in installer
- c-ares in wsnet to the latest version 1.33.1, increased timeouts for DNS requests


Windscribe 2.11.11
Added:
- support for quantum-safe TLS and OpenVPN
- CLI mechanisms to connect with a specific protocol, and improve help
- port selection to proxy gateway

Improved:
- debug log usefulness by adding routing table
- IPC sockets/lockfiles by consolidation
- installer archive generation and extraction to use built-in macOS utilities
- JSON import validation
- an error message when a custom config fails to connect with incorrect credentials
- dialog verbiage when secure hotspot is enabled without Wi-Fi

Fixed:
- factory reset not executed if app is not installed
- ctrld utility should always be tunneled via the VPN
- WireGuard connection fails or is slow to connect with DoH
- potential for uncaught exceptions thrown by the std::filesystem API to cause the app to crash
- incorrect description for Client-side Keepalive preference
- logged out when downgrading to earlier version
- JSON & ini validation for Split DNS domains
- JSON import not exporting/importing "Auto-Secure" setting
- sorting by latency when some locations have no ping info
- GUI allowing invalid proxy address/port
- potential app crash if the app is connected and the system is restarted
- ICMP pings crash [wsnet]
- handling of 0.0.0.0 response from DNS server for split tunnel hostnames
- proxy gateway port not displaying 'Auto' when edit is cancelled
- a wrong translation in Ukrainian
- packet size not applying to WireGuard connections
- app fails to start on Windows Server 2022
- Program FilesWindscribe folder not cleaned up on uninstall if app is installed to a custom folder
- main window can be dragged beyond the top of the screen
- custom DNS feature fails if Windows DoH is enabled
- scenario where displayed location does not match actual location
- the timeout calculation in wsnet library. Added additional logs for tunnel tests
- the error message when the remember checkbox wasn't ticked on the wrong credentials
- tunnel tests don't work for WireGuard with firewall enabled
- DNS cache not cleared in wsnet when connecting or disconnecting to the VPN
- ctrld not starting even after external DNS service stopped

Updated:
- Chinese (Simplified) translations provided
- French translations provided
- Polish translations provided
- Ukrainian translations provided
- libcurl, libcares, openvpn, and liboqs to the latest versions


Windscribe 2.10.16
- Fixed app may lock up when attempting to disconnect an OpenVPN (UDP/TCP/Stealth/WSTunnel) connection while the connection attempt is in progress


Windscribe 2.10.15
Added:
- security warning in the installer when installing to a custom folder
- support for private key passwords in OpenVPN custom configs
- wsnet library + switched to vcpkg dependency management system
- taskbar notification when the app needs attention
- a limit of 50 hostname split tunnel entries to ensure stability

Improved:
- best location selection to lean towards 10 Gbps servers
- OpenVPN and WireGuard anti-censorship
- internal error handling
- IPC message passing to adhere to best practices
- IPC handling and security between client app and helper
- retry efficiency for requests that are blocked [wsnet]
- custom DNS to not use ctrld if custom DNS is set to an IPv4 address
- conditions for network connectivity detection
- installer robustness in error situations
- firewall behavior when logging out but not restarting
- monitoring of WireGuard service startup status when PC boots after a system crash or hard reset
- failover retry on WireGuard
- UI header transparency and color
- stability of DNS resolution for hostnames when using split tunneling
- UX of the protocol/port line when protocol selection is not available
- the look and translations on the Emergency Connect screen
- handling of custom configs with "dev tap", overriding automatically to "dev tun"
- location search by allowing search by country code
- updating random hashed domains in a timely manner
- logic for enabling the BFE service
- error handling in UI for the secure hotspot feature, in case it fails
- log messages when installer is unable to copy Qt libs
- Polish translations
- custom config credential prompt
- IP display to "---.---.---.---" if unable to get local IP, instead of "N/A"
- emergency connect to always connect with the more secure algorithms
- LZMA dependency management
- exponential back-off algorithm for pings to determine failed nodes
- IKEv2/IPsec proposals to match other platforms

Fixed:
- OpenVPN adapter IP assertion
- privilege escalation vulnerability allowing an attacker to inject a DLL into the client app and task kill any process (Reported by Zeze Lin working with Trend Micro Zero Day Initiative)
- privilege escalation vulnerability allowing an attacker to inject a DLL into the client app and start an arbitrary process as admin (Reported by Zeze Lin working with Trend Micro Zero Day Initiative)
- ICMP pings crash [wsnet]
- default install path not set for new installs
- app crash when IKEv2 RAS callback function is called by the OS after the connection object has been deleted
- installer crash logged in Event Viewer when installer exits (Reported by Haifang Wang working with the Windows App Assure ISV Outreach Team at Microsoft)
- possible delay in executable signature logic when it checks CRLs over the network
- tooltip not displaying when mouse hovers over protocol line for a custom config
- app crash if app exits during startup
- wsnet bug sometimes causing the library to freeze
- potential installer DoS vulnerability when installing the split tunnel driver
- WireGuard service may fail to install when connection attempt initiated immediately after the PC boots
- various compile warnings introduced in 2.10.x
- DNS servers in the wsnet library not updating on the client connection/disconnection events
- protocol selector should not be available in external config mode
- selected location not reset after removing custom config folder
- another display issue and crash in custom config credential prompt
- display issue and crash in custom config credential prompt
- MAC address does not auto-rotate when adapter is disabled then enabled
- localhost range not encompassing entire 127/8 subnet
- 'use ICMP pings' advanced parameter not being used
- potential window scaling size issue
- OpenVPN DCO network adapter number increments on every connection
- Free Data usage in app doesn't update
- some bugs in the wsnet library regarding mutlithreading/deadlocks
- failed assertion in log for EmailItem
- Secure Hotspot password not masked in UI
- serverlist API country_override parameter doesn't enable Circumvent Censorship on first app launch
- ignore country override when connected to a VPN
- right clicking on login screen may show context menu away from the widget
- custom config stays connected if folder is removed
- anti-censorship flag (TLS stuffing) does not work for server API
- install may silently be overridden to default folder instead of custom folder
- wsnet thread synchronization issue that could cause a crash
- installer window position during update
- UDP traffic not being split tunneled correctly

Updated:
- Windows-on-Arm split tunnel driver WHQL signing certificate
- ctrld dependency to 1.3.7
- dependencies, c-ares to 1.25.0 and boost to 1.84.0
- README.md file (build instructions)


Windscribe 2.9.9
Added:
- experimental support for the OpenVPN DCO driver
- feature to export/import preferences to/from JSON file
- password reveal/hide button for main login
- 'status' command to the CLI
- support for installing the app on Windows 10 builds older than our officially supported build (17763)
- feature to disable system-wide DoH configuration on connect in Windows 11
- advanced parameter for specifying specific wireguard server

Improved:
- anti-censorship measures in WireGuard and OpenVPN
- labels and descriptions in preferences to match the mobile app
- app start up time by starting the helper service during install
- IKEv2 profiles by disabling unnecessary features
- debug log feature to include the installer log
- installer to support keyboard shortcuts (ESC/Enter/etc.)
- Secure Hotspot preference to automatically enable the Allow LAN Traffic preference

Fixed:
- transition to 2FA screen when logging in
- importing/exporting preferences closes the app window if docked
- banned/disabled message not showing during login
- update screen may not be clickable after an alert is shown
- reveal password icon may be slightly cut off at certain scaling
- pressing Login from external config mode causes UI to not display
- returning to login screen does not set focus to username field
- user is forcefully logged out on some server errors
- imported split tunneling settings not reflecting in the GUI until after app restart
- right-click also triggering Static IP link
- various minor UX issues on login screen and preferences
- hard-to-read 10 Gbps location icon
- possible crash during app exit
- advanced parameter file location differs between Guinea Pig vs Beta/Release builds
- misdetection of TCP error during OpenVPN connection
- installer log reordering in merge log
- escaping of the OpenVPN password
- incorrect translation of 'Quit' in French translation
- some helper exes did not contain version information
- tray menu items can be activated with right-click
- app can be moved by dragging its shadow
- updating from a build earlier than 2.4.10 does not work
- a local privilege escalation vulnerability in the installer
- DLL injection vulnerability in the installer
- duplicate DLLs bloating installer size
- uninstallation page opens in browser when reinstalling and user is not logged in
- DOH registry disable in forced mode when EnableDohValue property originally does not exist
- MAC address does not auto-rotate when changing networks and the MAC Spoofing Auto-Rotate MAC preference is enabled

- Removed misleading logs indicating errors when it's benign
- Removed unnecessary parameters for server list request API call
- Updated boost, c-ares, and lzma dependencies
- Updated ctrld dependency to 1.3.3


Windscribe 2.8.6
Added:
- machine-generated translations for Chinese (Traditional), Indonesian, Italian, Japanese, Korean, Persian/Farsi, Polish, Portuguese, Turkish, Ukrainian, and Vietnamese
- language localization to the installer
- language localization to the uninstaller
- advanced parameter to control server list (locations) functionality in censored countries

Improved:
- anti-censorship feature. Feature automatically enabled for first-run users in censored countries
- wintun support by replacing custom wintun driver with OEM driver
- the appearance of the sign out button
- error message when the connected DNS utility (ctrld) fails to start
- app and installer main icon
- installer to unify it with the macOS installer
- the connection mode description in preferences
- in-app upgrade message to indicate the update will be downloaded before terminating connections
- error description in 'admin required' error screen
- build instructions in the README

Fixed:
- installer/uninstaller local privilege escalation vulnerability
- some text in preferences not matching with the mobile app
- auto-connect not triggering when reconnecting to the same network
- installer sometimes exiting during updates
- misspelling in installer error message
- "logging in" screen background color not matching with other OSes
- DNS queries for hostname split tunnels sometimes not resolving
- UI issue where search tab may overlay other tabs
- search icon on locations screen may overlap the All icon
- UI screen transition issues when anti-abuse is triggered
- UI connection state may stick at 'connecting' when disconnecting and connecting to a different location rapidly
- bottom information bar on connect screen is not displayed after upgrade screen is dismissed
- firewall does not disable on failed connection to non-existent location
- opening locations drop down when prompted to save preferred protocol causes errant UI behavior or may crash the app
- UI screen transition issues (UI may freeze) when account is expired or anti-abuse is triggered
- 'OK' text in installer is not centered underneath the checkmark button for some languages
- app icon in Windows task manager is blurry
- reconnect not triggered when OpenVPN reports a tunnel connectivity failure
- UI issue when the hotspot feature is enabled and a SSL error occurs
- app may not reconnect after Internet is restored when using OpenVPN
- app gets stuck on the logging in screen after accepting the 'ignore SSL errors' prompt
- installer fails to launch if Windows version is incompatible
- connect state badge icon not displayed on the taskbar icon when the app is closed to tray then restored
- debug log to more clearly indicate that a custom dns is being used
- double-right-clicking on the IP address makes it blurry on the main screen
- top of password dots on login screen are clipped
- UI 'weirdness' on the login screen when secure hotspot or proxy gateway feature is enabled and a SSL-error occurs
- ESC text is misaligned with the close button in preferences
- incorrect padding in 'out of data' screen
- load indicator for bottom-most location is slightly clipped
- clicking the blog link in the About menu doesn't do anything
- IKEv2 connection may not clean up correctly
- initial IKEv2 connection may fail after virgin install
- update fails when app is running and split tunneling is enabled

- Updated app dependencies (cURL/OpenSSL/OpenVPN etc.) to latest available version
- Updated connected DNS utility (ctrld) to v1.3.2
- Removed TAP adapter support. OpenVPN-based connections will always use wintun


Windscribe 2.7.14
Added:
- anti-censorship toggle in preferences
- anti-censorship feature: WireGuard UDP stuffing
- anti-censorship feature: use domain fronting via CDN for API requests
- anti-censorship feature: OpenVPN TCP split-reset, UDP stuffing, Stunnel extra padding
- anti-censorship feature: use extra TLS padding for fallback API requests
- translations for Arabic, Czech, French, German, Hindi, Russian, Simplified Chinese, and Spanish
- an icon on the main screen to indicate anti-censorship mode is enabled
- new in-house Stealth/Wstunnel application
- support for native aarch64 (arm64) Windows build
- split tunneling driver for Windows arm64
- additional logging to diagnose service startup failure
- a small loading spinner to some operations which may take a long time
- feature to remember last locations tab on exit and default to that tab on startup
- support for DNS-over-HTTPS (DoH) and split DNS to the 'Connected DNS' feature
- custom alert screens, replacing the native OS message boxes
- icon on connect screen indicating if connection is auto, manual, or network preferred protocol
- new logout and quit screens
- -username and -password command-line arguments to the installer

Improved:
- latency (ping) algorithm to reduce ping frequency, especially during app startup
- installer icons

Fixed:
- (reduced) tunnel test time when using OpenVPN-based protocols
- helper security vulnerability when app installed to custom folder
- app may open locations screen to a random tab
- "All protocols failed" prompt doesn't show
- LAN-hosted DNS server cannot be accessed when using a custom OpenVPN config
- OpenVPN not using custom DNS
- spinner animation on the ROBERT page continues after the website has already been opened
- Wifi hotpsot feature does not correctly detect "hosted network support"
- Unicode application names not supported for split tunneling apps
- Logout/Quit screen UI bugs
- Manage ROBERT rules link click does nothing
- UI overlap and alignment issues
- loading spinner in Manage Account preference slows down
- access to server IP to be only allowed for Windscribe & system apps
- incorrect error message in the DNS domain screen when a domain name is not valid
- WireGuard may not recover correctly in manual mode
- OpenVPN UDP and TCP may not work with certain commented out Advanced Parameters
- executable signature checking mechanism disabled in the helper and CLI
- possible helper (Windscribe service) hang during app startup
- DNS resolver works with a noticeable delay after connecting
- validation of the domains entered by the user
- some user interface transitions involving the "SSL error" alert
- split tunnel hostname and IP validation errors are unclear
- x86_64 installer to block install on an arm64 PC and notify user they should download the arm64 version of the app
- window shadow incorrectly sized on logout/exit screens
- login screen height may be truncated
- alert screen may overlap other screens (e.g. news feed, protocol change)
- notifications are missing after marking all as read, leaving the notifications screen, and returning to it
- view/send log functionality to truncate the log if it is too large to view/send
- firewall settings updated repeatedly when pinging locations
- installer to force kill the app if it does not respond to the exit request
- height of location entries is too large for some display scale factors
- log files cannot be read when Windows account name contains Unicode characters
- Windscribe service may hang if there are many split tunnel exclusive rules
- protocol badge not immediately updated on network changes
- app to apply split exclude rules even while disconnected, if the firewall is up
- WireGuard service fails to start if Windows account name contains Unicode characters
- Windows network discovery blocked by firewall
- sharing Windscribe connection with Windows Hotspot doesn't work with firewall enabled

- Removed incorrect primary IP check when enabling the Allow LAN Traffic preference
- Removed full directory paths from log to obscure user's PII
- Removed timestamp from news feed items
- Updated app to use server-supplied ping (latency) values
- Updated app warnings and error messages
- Updated to OpenVPN 2.6 and OpenSSL 3


Windscribe 2.6.14
- Fixed free accounts not pinging pro locations.
- Fixed upgrade widget not hidden when returning to login screen.
- Fixed 'out of data' screen isn't vertically centered.
- Fixed MAC address spoofing toggle state isn't saved.


Windscribe 2.5.18
- Fixed potential app crash when the app is failing over to another protocol


Windscribe 2.5.17
Fixed:
- Fixed potential app crash when reading saved WireGuard config data created by the v2.4 app
- Fixed potential app crash caused by a display resolution detection (DPI) issue in the locations tray menu


Windscribe 2.4.10
- Updated 10Gbps badge and location load when best location changes
- Added new flags
- Rasdial error 13868 fixed
- Added WireGuard NT support
- Fixed app crash on emergency connect in some cases
- Fixed crash on bad server locations list
- Various Wireguard NT fixes.
- Dynamic Wireguard Interface Allocation Support
- DPI fixes for the tray icon for Windows.
- Privilege escalation vulnerability fixed
- Fixed cut off long favorites location names in the tray menu
- Fixed static IPs display issue in tray menu
- Updated the version info in all Windows executables to follow standards
- Fixed uninstaller wiping the entire folder it is located in (to whoever installed Windscribe directly into root of Program Files - sorry about that)
- Standardized API interaction timers
- Fixed app main window does not display on Windows 11 preview builds
- Fixed OpenVPN on Windows 7
- Fixed automatic firewall deactivation when account status changes to disabled
- Fixed protocol selection not immediately saved to disk
- Updated app icons in system tray
- Fixed app crash on Emergency Connect.
- Increased service start wait time to 20 seconds.
- Refactored WireGuard connection to avoid blocking engine thread
- Fixed Inclusive split tunneling with WireGuard
- Fixed firewall state when app process is killed and Wireguard is used
- Fetch session when app receives focus
- Fixed firewall silently enabling by itself in rare cases


Windscribe 2.3.16
- Change log not available for this version


Windscribe 2.02.10
- Detection of the authorization error for IKEv2 made to be more specific
- Reduced debug log verbosity
- Emergency connect description updated


Windscribe 1.83
New features:
- WebSocket stealth protocol support
- Location list sorting methods: Geography, alphabet, latency
- A la carte location support (future feature)
- Static IP + port forwarding support
- Custom OpenVPN config support

Put your own OpenVPN configs in the following directory:
- C:UsersUSERNAMEAppDataLocalWindscribeWindscribecustom_configs
- ~/Library/Application Support/Windscribe/Windscribe/custom_configs
- They will now be available in the Windscribe UI. You can take advantage of all Windscribe client features (firewall, proxy gateway, wifi sharing, etc) with your own OpenVPN server. Or use another VPN provider’s servers if you wish

Fixed bugs:
- Stuck on login in China
- App prevents graceful Windows shutdown
- App freezes in “Windscribe is shutting down” state
- Bad IKEv2 connection causes client to lock up

Other Changes:
- Don’t disable server location on ping test failure


Windscribe 1.82
- Change log not available for this version


Windscribe 1.81
New features:
- IKEv2 protocol support (manual and automatic mode)
- Emergency Connect / Secure Login

Fixed bugs:
- Wifi-sharing not working after wakeup
- Forcibly close all TCP sockets after tunnel up
- Don’t forcibly disconnect if currently connected node is missing from the server list
- Language detection defaults to English instead of Arabic
- Reinstall/enable WAN miniport adapters if missing/disabled
- Adjusted DPI to work with multiple scale factors

Other Changes:
- Added “Disconnecting” state
- Eliminated redundant API calls
- Reduced the server ping frequency
- Updated OpenVPN binaries to latest version
- Don't auto-enable the firewall (in Automatic mode) on computer start up if auto-connect is false
- Simplified installer flow + additional “custom install” options
- Async DNS resolver
- Adjusted node selection algorithm to favor lower latency nodes
- Forcibly expand certain locations when the country name is clicked
- Detect if LAN range is RFC-1918 complaint

To-do list for next version:
- CLI interface
- Favorite locations
- Dedicated IP support
- IKEv2 connectivity test
- SOCKS5 server UDP associate support
- Fix startup error on multi-user computers
- Mystery feature 1
- Mystery feature 2


Windscribe 1.80
New features:
- LAN proxy gateway
- Secure Hotspot (Experimental)
- Variable location drawer height
- Auto login after signup
- Ability to choose NDIS5 TAP driver
- Upgrade to OpenVPN 2.4.x with 2.3.x fallback
- Service notifications
- Show Pro data-centers to free users
- Location latency tool-tips added to signal bars

Fixed bugs:
- Always on firewall not working on OS boot on some machines
- Application crashes after connection attempts are exceeded with “minimize to tray” option checked
- Application freeze with firewall ON requires reboot
- API calls not made if app starts with no Internet connectivity
- Custom installation now allows for non-standard install path
- Auto-enable disabled TAP adapter
- 100% CPU when app starts with no Internet connectivity
- Don’t try UDP protocol if system proxy is configured
- Constant application window size on variable DPI screens
- Login form DPI bug
- On multi-screen computers, tool-tips show on primary monitor

Other Changes:
- Leave firewall ON if ran out of free bandwidth to prevent IP leak
- Increase reconnect timeout from 5 min to 1 hour
- Server list source changed
- Moved server location update process to separate thread
- Only do ping tests while disconnected
- Update available UI change
- Output installed anti-virus software into debug log for troubleshooting
- Open survey on application uninstall
- Installer command line arg support
- Black and white top bar icon on MacOS
- Ping nodes in batches instead of all at the same time
- Allow for verbose OpenVPN logging via Advanced Parameters screen
- When beta channel is selected, check for updates right away

To-do list for next version:
- IKEv2 protocol support
- Emergency Connect
- Firewall whitelisting overhaul
- Command line interface
- Wakeup from hibernation fix
- Add disconnecting state
- Async DNS resolver


Windscribe 1.70
- Added city level location selection
- Added Automatic Connection mode
- Added support for 22 languages
- Added custom TAP adapter
- Added “Ignore SSL Errors” option
- Added notifications when firewall is ON and application not connected
- Added “Advanced Parameters” screen
- Added EULA to the installer
- Added IPv6 connectivity disable button, to prevent WebRTC leaks over IPv6 in some situations
- Added Touch support
- Added Beta channel
- Fixed auto-start bug on some systems
- Fixed Internet connectivity check
- Fixed persistent session storage
- Fixed API connectivity on restrictive networks
- Fixed unquoted service path
- Fixed disappearing Best Location
- Fixed WSD port connectivity while firewall is ON
- Fixed PlayStation UPNP connectivity while firewall is ON
- Fixed reconnection bug on computer wake up on some systems
- Changed the Preferences screens
- Changed the connecting spinner animation


Windscribe 1.61
- Added ability to select connection port
- Added LAN proxy support
- Added speed ratings
- Added ability to add openvpn params externally
- Added using custom DNS while disconnected to prevent DNS poisoning
- Added custom API resolution field to combat advanced DNS poisoning
- Added “Best Location” to the location list
- Added connection testing after tunnel initiation
- Added tooltip for “no p2p” icon
- Fixed crashing in macOS Sierra
- Fixed LAN traffic bypass to work with UPnP devices
- Fixed debug log sender
- Fixed backup API usage logic
- Fixed CPU and energy usage
- Fixed multiple accounts info message
- Fixed multi-monitor menu placement in macOS
- Fixed Windows taskbar icon in collapsed mode
- Enable Base Filtering Engine if its disabled in Windows 7
- Changed openvpn config location to a permanent one
- Changed server list scrollbar to be more visible
- Changed XPC to sockets in macOS
- Changed TAP adapter metric on Windows 10
- Various stability fixes