Loading…
CompareOpen in App Store
★★★★★
Average rating on the App Store. Apple doesn't publish how many ratings each star has.
This app isn't in any of our charts yet.
NEW • Proxy chaining: any policy except Tailscale can dial through another — set an upstream per policy, one for a whole group, or a Front Proxy in Advanced covering every node that has no upstream of its own; the connection detail names every hop • New Relay and Random group types • VMess and VLESS carry UDP; Shadowsocks gains UDP over TCP (UoT), so it keeps working through an upstream without UDP • The editor gained rows for dedicated DNS pools, tun-included-routes, MitM HTTP/2 and QUIC blocking, the REJECT policies, inline rule sets and rule notifications — and no longer drops or rewrites what it cannot display • QUIC can be routed by domain, so DOMAIN rules cover HTTP/3 connections made to a bare address; icmp-auto-reply answers pings inside the tunnel • mihomo GEOSITE and category GEOIP rules, SUB-RULE, and sing-box detour / mihomo dialer-proxy import as working rules and chains • Rule sets use far less memory: providers download one after another instead of failing after the 35th FIXES • Fixed Hysteria2 dropping datagrams too large for one QUIC frame (which broke HTTP/3), a restarted tunnel reusing its previous port and TCP sequence numbers (which WireGuard peers answered with resets), and XHTTP stalling after the app's first write • Fixed PROTOCOL rules not matching, RULE-SET / DOMAIN-SET inside AND / OR / NOT always evaluating false, and PROCESS-NAME rules matching browser traffic on iOS — they work only on macOS • Fixed the subscription auto-refresh blocking the main thread for 30 seconds and getting the app killed by the watchdog, and a chute:// link doing nothing when Chute was not already running
Chute turns your iPhone and iPad into a complete network workstation: a rule-based proxy client, an HTTPS debugging proxy, and a full DNS stack — all running on a network engine written from scratch for Apple platforms. Switch it on and the whole device is behind the proxy. Every connection your apps make can be inspected, routed, rewritten, or blocked by your rules. SYSTEM-WIDE PROXY • Chute VIF — a transparent virtual interface on a custom TCP/IP stack, no per-app setup • Local HTTP and SOCKS5 servers for other devices on your network • Proxy chaining — reach a node through another node, send a group through one upstream, or set a Front Proxy for every node • Hot reload — edit rules, DNS, and scripts without dropping a connection; on-demand activation and persistence across reboots 17 PROXY PROTOCOLS HTTP, HTTPS, SOCKS5, SOCKS5 over TLS, Shadowsocks (AEAD, AEGIS, and 2022), ShadowsocksR, VMess, VLESS, Trojan, TUIC v5, Hysteria2, WireGuard, AmneziaWG, AnyTLS, ShadowTLS, MASQUE, and SSH tunneling — plus a built-in Tailscale client. Transport and TLS: XTLS Vision, REALITY, XHTTP, uTLS fingerprints, ECH, X25519MLKEM768 post-quantum exchange, UDP for VMess, VLESS, and Shadowsocks. 27 RULE TYPES • DOMAIN, DOMAIN-SUFFIX, DOMAIN-KEYWORD, DOMAIN-WILDCARD, DOMAIN-REGEX • IP-CIDR / IP-CIDR6, GEOIP, IP-ASN, SUBNET — by Wi-Fi SSID, BSSID, or router • SRC-IP, SRC-PORT, DEST-PORT, IN-PORT, IN-TYPE, IN-USER, IN-NAME, with port ranges • USER-AGENT, URL-REGEX, PROTOCOL, HOSTNAME-TYPE, AND / OR / NOT • RULE-SET, DOMAIN-SET, and inline rule sets, with remote subscriptions • SCRIPT, and FINAL as the catch-all POLICY GROUPS • URL-Test — always ride the lowest-latency node • Fallback — automatic failover when a node degrades • Load Balance — round-robin, consistent hash, or sticky sessions • Relay — chain the members in order, traffic leaving from the last one • Random — a different member per connection • SSID — switch policy automatically per Wi-Fi network • Select — take the wheel whenever you want it MODERN DNS • DoH, DoH3, DoQ, DoT, and plain DNS — a different resolver per domain if you want • Dedicated pools: one for DIRECT traffic, one for your servers' names, one as fallback • Fake IP, EDNS Client Subnet, negative caching, custom hosts, and query logs TRAFFIC INSPECTION • Capture HTTP, HTTPS, and DNS live, headers and bodies included • HTTPS decryption scoped to the hosts and paths you choose, with HTTP/2 and QUIC blocking • URL rewrite, header rewrite, and JSONPath or jq body rewrite • Local mock responses for offline work and edge cases • Real-time throughput charts, per-connection detail, and accounting SCRIPTING • A JavaScript engine for requests, responses, DNS resolution, and scheduled tasks • A persistent store, an HTTP client, and notification APIs; Modules package rules, rewrites, and scripts into one file BRING YOUR EXISTING SETUP • Import Clash and sing-box profiles from a subscription URL, a file, or Wi-Fi • mihomo GEOSITE and GEOIP rules, SUB-RULE, and detour / dialer-proxy import as working rules and chains • Pair with Chute Dashboard, a free Mac app, to inspect iPhone traffic over Wi-Fi or USB BUILT FOR DAILY USE • Home Screen widget, Control Center control, and a Notification Center toggle • Face ID / Touch ID lock • Picture in Picture traffic monitor FREE AND PAID The proxy engine, the rule engine, the DNS stack, the web console, the HTTP API, and the dashboard are free with one configuration. A one-time purchase — no subscription — adds multiple switchable configurations, iCloud sync, HTTPS decryption, traffic recording for Chute Dashboard, local server control, Picture in Picture, and Always On. One purchase covers up to 3 iPhone or iPad devices and 3 Apple TV devices. Chute does not operate proxy servers and provides no network access on its own — bring your own server or a service you already use. Traffic and logs stay on your device. Chute collects no browsing data and sells nothing to anyone.