Paste or drop a vless://, vmess://, trojan://, ss://, hy2://, or tuic:// URI. We run the real protocol handshake from distributed check nodes and show you exactly what we see.
Your URI is routed to the nearest check node. The node parses it, opens the real network connection your VPN client would, performs the full protocol handshake (TLS, REALITY, VMess AEAD auth, Shadowsocks cipher exchange, Hysteria2 QUIC auth, etc.), and reports the result.
Typical round-trips: VLESS+REALITY 150–400ms, Trojan 200–500ms, Hysteria2 150–350ms depending on region. Longer than 5s usually means UDP blocking, wrong SNI, or a dead server.
URI protocols (VLESS / VMess / Trojan / Shadowsocks / Hysteria2 / TUIC) run from the paste box directly. WireGuard and AmneziaWG configs run self-contained. OpenVPN prompts for credentials when detected. OpenConnect and IKEv2 need a host + credentials (click the chip to start).
Configs and credentials submitted here are used for a single handshake then discarded. No persistent storage. We do not log config contents, usernames, passwords, or private keys. We only log the protocol, the resolved host, and the result for rate-limit accounting. Loopback and cloud-metadata IPs (127.0.0.0/8, 169.254.0.0/16, ::1) are blocked at the edge. Each IP gets 5 tests per 24 hours; sign up for unlimited.
TunnelHQ runs this exact check every 1 to 10 minutes against your whole fleet. When a handshake fails, Slack / email / Telegram / Discord / webhook alerts fire within a second, before users notice.
Start free. 5 monitors, no credit card