Apple public APIs only
Clash Core runs inside NetworkExtension and moves packets through the public NEPacketTunnelFlow API—without private APIs or file-descriptor tricks.
Clash Core · Built on mihomo
Speed, measured.Trust, open source.
Clash Core is the proxy core that powers Clash. Built on proven mihomo and retuned for Apple NetworkExtension constraints, it handles traffic on your device—with performance measured on real hardware and its complete source code open for anyone to inspect.
The heart of Clash
Trust belongs
where your traffic flows.
Clash makes the network feel simple. Clash Core is the part that actually handles connections, DNS, and rules. It does not ask you to trust a promise: its runtime boundaries are built into a fully open-source implementation anyone can inspect.
Control stays on-device
Status, traffic, connections, and logs travel over an app-private local channel, with no extra network-accessible controller.
Profiles stay with the client
Clash Core never downloads or stores profile URLs or credentials. The client prepares the runtime configuration; Clash Core applies its rules.
Measured on an iPad Pro (M2)
No “should be fast.”
See how fast it ran.
545 Mbps up · 5 ms latency
Lightweight under high throughput
0 disconnects · 0 packet loss · 0 crashes
Within a 50 MiB test budget
Speed tests cannot exceed the available bandwidth of the test network. These figures come from a controlled run on the stated device, network, and build; actual performance varies with device, route, and configuration.
Open source · independently reviewable
Performance can be measured.
Security should be inspectable.
Clash Core builds on stable mihomo releases and is adapted for Apple NetworkExtension. SDK versions are separate from the Clash App Store app version. The core uses the GPL-3.0 license; source code, build details, and future SDK releases share a home at ProjectClash/Clash.
Built for all five Apple slices
Find SDK releases and build artifacts on GitHub
iOS device and simulator, macOS, tvOS device and simulator
A proven data plane
The Clash capabilities you know,
inside Apple’s system boundaries.
Connect to the routes you use
Shadowsocks, VMess, VLESS, Trojan, Snell, Hysteria2, TUIC, WireGuard, AnyTLS, SSH, and more.
Resolution follows the rules too
DoH, DoT, DoQ, fake-IP, traffic sniffing, and per-domain resolver policies.
Direct when it should be direct
domain, IP-CIDR, GEOIP, GEOSITE, RULE-SET, sub-rules, and logical rules.
Select, test, and fail over
select, url-test, fallback, load-balance, health checks, and remote providers.
Runtime state stays visible
Status, traffic, connections, proxies, logs, latency tests, and connection control remain available to the app locally.
macOS adds process rules
macOS can match process names, executable paths, and UIDs; signing-ID and team-ID matching remain unavailable. In Packet Tunnel mode, iPhone, iPad, and Apple TV do not expose per-app or per-process identity.
Do not take our word for it
Want the code? Read it.
Inspect the implementation, follow SDK releases, or review the repository’s security information. Verifying Clash Core requires no one’s permission.