sing-box · client config generator

Paste a link.
Get a config that runs.

Drop in one or more vless://, vmess://, trojan://, ss://, hysteria2:// or tuic:// share links — or import an existing sing-box config to pick up where it left off. This builds a sing-box 1.13+ client config — SOCKS, HTTP, and/or TUN inbounds — entirely in your browser. Nothing is uploaded anywhere.

live route trace— hops · — bypass domains

01 Import existing config

Already have a sing-box config.json? Load it here to pull in its proxies and settings, tweak anything below, then re-export. Replaces whatever's currently parsed.

02 Proxy links

One link per line. Each becomes an outbound in the generated config.

03 Inbounds

How local apps or the OS reach sing-box.

SOCKS proxy
Point individual apps at it manually
Listen address
Listen port
Auth (optional)
HTTP proxy
For tools that only take an HTTP(S)_PROXY env var
Listen address
Listen port
Auth (optional)
TUN device
System-wide, routes the whole OS
Interface name
IPv4 address
IPv6 addressBlank ≠ blocked — IPv6 traffic then bypasses the tunnel entirely unless you disable IPv6 in the OS
MTU1500 is safe for most networks; try 1400–1420 over mobile/PPPoE/nested VPNs
Stack
strict_routeOff = DNS can leak around the tunnel (confirmed: Windows' multihomed resolution ignores TUN without this). On = closes that, but has its own confirmed bugs (Windows can't reach 127.0.0.1; interface mis-detection on complex networks)
auto_redirectLinux nftables, skip if unsure
Network interface overrideLeave blank normally. Fill in ONLY if the core starts but there's zero internet — sing-box's auto-detection of your real network adapter can fail on some networks/platforms with no fallback (confirmed: SagerNet/sing-box#1502). Find your adapter name via `ip addr` (Linux), `ifconfig` (macOS), your network adapter settings (Windows), or similar — e.g. eth0, en0, Wi-Fi.

04 Outbound routing

How traffic picks which proxy — and what skips the proxy.

Group type
urltest auto-picks the fastest node
Health-check URL
Re-test interval
Bypass LAN / private IPs
RFC1918 etc. go direct
Bypass domains
One per line — the domain and its subdomains go direct, skipping the proxy (and FakeIP, if on)
Sniff + hijack DNS
Needed for domain-based routing under TUN
Remote DNS
Resolves domains through the proxy — always encrypted (DoH/DoT), plaintext isn't offered
FakeIP
TUN only — smoother domain routing

05 Security

Checked live against what you've parsed and configured above.

Enforce certificate validation
Strip any insecure flag a link tries to set — refuses to trust an unverified TLS certificate
Block ads, malware & phishing (DNS)
Rejects lookups matching SagerNet's official geosite-category-ads-all list — fetched from GitHub at runtime
Fail closed
If every proxy is unreachable, connections fail — never silently falls back to direct
always on

06 Generated config

Targets sing-box 1.13+ syntax (rule-action based sniff / DNS hijack). 
// Parse at least one link above to generate a config.

Troubleshooting something? Turn on debug logging above, reproduce the problem, then check your sing-box client's log output — a "not working" symptom and an actual error message are very different things to diagnose from. A quick way to tell if it's DNS specifically: try reaching a raw IP address directly (no domain) while the tunnel is active — if that works but domains don't, it's DNS; if neither works, it's the tunnel/routing itself.