Windscribe for Mac

What's new in this version:

Windscribe 2.12.7
Added:
- flags for new and upcoming locations
- link to our website for further information about the Circumvent Censorship feature in preferences
- additional curl logs for failed server API requests in wsnet

Improved:
- UDP/TCP/Stealth/WStunnel protocol performance by using OpenVPN DCO kernel driver as their default driver
- behavior when querying the SSID on W11 24H2 and Location services is off
- description for packet size, clarifying that it doesn't do anything for TCP-based protocols
- error message when update download fails
- the failover algorithm in wsnet to prevent it from 'sticking' to one domain

Fixed:
- docked app does not detect change in taskbar size and adjust position when displayed
- app update may fail to stop and remove OpenVPN/Wireguard daemons
- debug log may fail to send
- double blinking cursors on custom config credentials prompt
- custom config authorization data not deleted when custom config directory cleared
- latency endpoint duplicate requests
- imported JSON values may be incorrect
- additional JSON & GUI input validation errors
- proxy validation to only allow an IP address. Prior proxy configurations using a hostname will no longer function
- proxy gateway sometimes sends invalid headers
- memory leaks in wsnet
- UDP protocol may fail to connect when Circumvent Censorship is enabled
- "Secure Hotspot" feature not being disabled properly when using IKEv2
- installer ignoring username/password command-line arguments
- emergency connect fails to connect due to incompatibility with OpenVPN DCO driver

Updated:
- OpenVPN DCO driver to v1.2.1
- German translations provided by GitHub user Evonos
- Spanish translations provided by GitHub user IceString3
- Russian translations in installer
- c-ares in wsnet to the latest version 1.33.1, increased timeouts for DNS requests


Windscribe 2.11.11
Added:
- support for quantum-safe TLS and OpenVPN
- CLI mechanisms to connect with a specific protocol, and improve help
- port selection to proxy gateway

Improved:
- debug log usefulness by adding routing table
- IPC sockets/lockfiles by consolidation
- installer archive generation and extraction to use built-in macOS utilities
- JSON import validation
- an error message when a custom config fails to connect with incorrect credentials
- dialog verbiage when secure hotspot is enabled without Wi-Fi

Fixed:
- displayed IP not changing for split inclusive tunnels
- potential application hang in system 'log' call when initiating an IKEv2 connection
- disabling/restoring IPv6 may do so on non-existent interface
- potential for uncaught exceptions thrown by the std::filesystem API to cause the app to crash
- incorrect description for Client-side Keepalive preference
- logged out when downgrading to earlier version
- JSON & ini validation for Split DNS domains
- JSON import not exporting/importing "Auto-Secure" setting
- sorting by latency when some locations have no ping info
- GUI allowing invalid proxy address/port
- potential app crash if the app is connected and the system is restarted
- installer may not exit after attempting to launch app
- SSID detection not working in macOS 15
- moving app window is not smooth
- firewall-on-boot may not function until the app starts
- app not showing an error when ctrld fails to execute
- app is very sluggish with many split tunnel hostnames
- split tunneling may not function correctly on macOS 15
- app crash when cancelling 'install helper' dialog
- handling of 0.0.0.0 response from DNS server for split tunnel hostnames
- proxy gateway port not displaying 'Auto' when edit is cancelled
- a wrong translation in Ukrainian
- firewall-on-boot may not function until the app starts
- app may be quarantined by macOS
- displayed IP not changing for split inclusive tunnels
- split tunnel include rules should not keep state
- helper checks for URLs for custom DNS are too strict
- windscribe-cli not working on macOS 11
- windscribe group may not be added in some cases
- scenario where displayed location does not match actual location
- the timeout calculation in wsnet library. Added additional logs for tunnel tests
- the error message when the remember checkbox wasn't ticked on the wrong credentials
- DNS cache not cleared in wsnet when connecting or disconnecting to the VPN
- macOS auto-update process fails to mount installer
- spammy log when getting SSID

Updated:
- Chinese (Simplified) translations provided
- French translations provided
- Polish translations provided
- Ukrainian translations provided
- libcurl, libcares, openvpn, and liboqs to the latest versions


Windscribe 2.10.15
Added:
- support for private key passwords in OpenVPN custom configs
- wsnet library + switched to vcpkg dependency management system
- taskbar notification when the app needs attention
- a limit of 50 hostname split tunnel entries to ensure stability

Improved:
- best location selection to lean towards 10 Gbps servers
- OpenVPN and WireGuard anti-censorship
- internal error handling
- IPC message passing to adhere to best practices
- helper upgrade flow
- retry efficiency for requests that are blocked [wsnet]
- custom DNS to not use ctrld if custom DNS is set to an IPv4 address
- conditions for network connectivity detection
- installer robustness in error situations
- failover retry on WireGuard
- UI header transparency and color
- stability of DNS resolution for hostnames when using split tunneling
- UX of the protocol/port line when protocol selection is not available
- the look and translations on the Emergency Connect screen
- handling of custom configs with "dev tap", overriding automatically to "dev tun"
- location search by allowing search by country code
- updating random hashed domains in a timely manner
- operation in Lockdown Mode by removing IKEv2 where applicable, or displaying a meaningful error
- Polish translations
- custom config credential prompt
- IP display to "---.---.---.---" if unable to get local IP, instead of "N/A"
- emergency connect to always connect with the more secure algorithms
- LZMA dependency management
- exponential back-off algorithm for pings to determine failed nodes

Fixed:
- tooltip not displaying when mouse hovers over protocol line for a custom config
- app crash if app exits during startup
- MacOS 11 bug, unable to open app after installing
- WireGuard takes too long to connect and tunnel tests are randomly slow
- not adding the windscribe group in the helper
- Mac pid checking vulnerability
- crash when using custom configs
- a scenario where IKEv2 would be attempted in Lockdown Mode
- Free Data usage in app doesn't update
- failed assertion in log for EmailItem
- Secure Hotspot password not masked in UI
- serverlist API country_override parameter doesn't enable Circumvent Censorship on first app launch
- ignore country override when connected to a VPN
- right clicking on login screen may show context menu away from the widget
- custom config stays connected if folder is removed
- getting SSID from MacOS 14.4 since it no longer reports it via scutil
- various compile warnings introduced in 2.10.x
- DNS servers in the wsnet library not updating on the client connection/disconnection events
- protocol selector should not be available in external config mode
- selected location not reset after removing custom config folder
- another display issue and crash in custom config credential prompt
- display issue and crash in custom config credential prompt
- anti-censorship flag (TLS stuffing) does not work for server API

Updated:
- Removed MAC spoofing feature if using MacOS 14.4 or later
- Updated ctrld dependency to 1.3.7
- Updated README.md to indicate usage of Xcode 14.2
- Updated dependencies, c-ares to 1.25.0 and boost to 1.84.0
- Updated README.md file (build instructions)


Windscribe 2.9.9
Added:
- feature to export/import preferences to/from JSON file
- password reveal/hide button for main login
- 'status' command to the CLI
- advanced parameter for specifying specific wireguard server

Improved:
- anti-censorship measures in WireGuard and OpenVPN
- labels and descriptions in preferences to match the mobile app
- debug log feature to include the installer log
- installer to support keyboard shortcuts (ESC/Enter/etc.)

Fixed:
- WireGuard anti-censorship
- app may become unresponsive when using tray locations menu
- transition to 2FA screen when logging in
- importing/exporting preferences closes the app window if docked
- banned/disabled message not showing during login
- update screen may not be clickable after an alert is shown
- reveal password icon may be slightly cut off at certain scaling
- pressing Login from external config mode causes UI to not display
- returning to login screen does not set focus to username field
- user is forcefully logged out on some server errors
- imported split tunneling settings not reflecting in the GUI until after app restart
- right-click also triggering Static IP link
- various minor UX issues on login screen and preferences
- hard-to-read 10 Gbps location icon
- possible crash during app exit
- advanced parameter file location differs between Guinea Pig vs Beta/Release builds
- misdetection of TCP error during OpenVPN connection
- installer log reordering in merge log
- escaping of the OpenVPN password
- incorrect translation of 'Quit' in French translation
- in-app update to 2.9.2 by reverting change for deduplicating libraries in installer
- ARM installer error that is a regression after LZMA migration
- path reference with wrong case which breaks with case-sensitive APFS

- Removed unnecessary threads running on helper service
- Removed misleading logs indicating errors when it's benign
- Removed unnecessary parameters for server list request API call
- Updated boost, c-ares, and lzma dependencies
- Updated ctrld dependency to 1.3.3


Windscribe 2.8.6
Added:
- machine-generated translations for Chinese (Traditional), Indonesian, Italian, Japanese, Korean, Persian/Farsi, Polish, Portuguese, Turkish, Ukrainian, and Vietnamese
- language localization to the installer
- minimize and close-to-tray feature
- advanced parameter to control server list (locations) functionality in censored countries

Improved:
- anti-censorship feature. Feature automatically enabled for first-run users in censored countries
- the appearance of the sign out button
- error message when the connected DNS utility (ctrld) fails to start
- uninstall. Helper and CLI symlink are removed on OS reboot if the app has been uninstalled
- app and installer main icon
- installer to unify it with the Windows installer
- the connection mode description in preferences
- in-app upgrade message to indicate the update will be downloaded before terminating connections
- firewall functionality while using split tunneling
- build instructions in the README

Fixed:
- IP does not change on GUI when using inclusive split tunnel
- (potentially) Air Drop, Handoff, Airplay and other local Mac sharing features are partially functional or blocked with Allow LAN turned on
- MAC spoofing to ensure we do not undo spoofs that did not originate from us
- symlink for windscribe-cli isn't created
- debug log to more clearly indicate that a custom dns is being used
- double-right-clicking on the IP address makes it blurry on the main screen
- top of password dots on login screen are clipped
- UI 'weirdness' on the login screen when secure hotspot or proxy gateway feature is enabled and a SSL-error occurs
- ESC text is misaligned with the close button in preferences
- incorrect padding in 'out of data' screen
- load indicator for bottom-most location is slightly clipped
- clicking the blog link in the About menu doesn't do anything
- pressing Cmd+Q results in the exit prompt showing, but the app exiting immediately anyway
- drop-down menus can be resized or moved
- installer main window can be resized
- misleading error message displayed during first time use of MAC Spoofing feature
- special user account for helper is displayed
- reconnect not triggered when OpenVPN reports a tunnel connectivity failure
- search icon on locations screen may overlap the All icon
- UI issue when the hotspot feature is enabled and a SSL error occurs
- app may not reconnect after Internet is restored when using OpenVPN
- app gets stuck on the logging in screen after accepting the 'ignore SSL errors' prompt
- split tunneling rules not reapplied if firewall state is toggled
- in-app update fails when updating from 2.7
- using the dock menu and clicking "Quit" causes the app to crash
- split tunneling description suggests app supports per-app split tunneling
- some text in preferences not matching with the mobile app
- auto-connect not triggering when reconnecting to the same network
- using the dock menu and clicking "Quit" causes the app to crash
- UI issue where search tab may overlay other tabs
- UI screen transition issues when anti-abuse is triggered
- UI connection state may stick at 'connecting' when disconnecting and connecting to a different location rapidly
- bottom information bar on connect screen is not displayed after upgrade screen is dismissed
- firewall does not disable on failed connection to non-existent location
- opening locations drop down when prompted to save preferred protocol causes errant UI behavior or may crash the app
- UI screen transition issues (UI may freeze) when account is expired or anti-abuse is triggered
- firewall not blocking traffic while disconnected in split inclusive mode
- 'OK' text in installer is not centered underneath the checkmark button for some languages
- wireguard binary contains debug symbols

Updated:
- app dependencies (cURL/OpenSSL/OpenVPN etc.) to latest available version
- connected DNS utility (ctrld) to v1.3.2


Windscribe 2.7.14
Added:
- anti-censorship toggle in preferences
- anti-censorship feature: WireGuard UDP stuffing
- anti-censorship feature: use domain fronting via CDN for API requests
- anti-censorship feature: OpenVPN TCP split-reset, UDP stuffing, Stunnel extra padding
- anti-censorship feature: use extra TLS padding for fallback API requests
- translations for Arabic, Czech, French, German, Hindi, Russian, Simplified Chinese, and Spanish
- an icon on the main screen to indicate anti-censorship mode is enabled
- new in-house Stealth/Wstunnel application
- a small loading spinner to some operations which may take a long time
- feature to remember last locations tab on exit and default to that tab on startup
- support for DNS-over-HTTPS (DoH) and split DNS to the 'Connected DNS' feature
- custom alert screens, replacing the native OS message boxes
- icon on connect screen indicating if connection is auto, manual, or network preferred protocol
- new logout and quit screens

- Improved latency (ping) algorithm to reduce ping frequency, especially during app startup
- Improved installer icons

Fixed:
- DNS failures with firewall enabled on macOS 14 Sonoma
- Stealth/Wstunnel sometimes can't connect
- app may open locations screen to a random tab
- "All protocols failed" prompt doesn't show
- LAN-hosted DNS server cannot be accessed when using a custom OpenVPN config
- OpenVPN not using custom DNS
- spinner animation on the ROBERT page continues after the website has already been opened
- Logout/Quit screen UI bugs
- Manage ROBERT rules link click does nothing
- UI overlap and alignment issues
- loading spinner in Manage Account preference slows down
- access to server IP to be only allowed for Windscribe & system apps
- incorrect error message in the DNS domain screen when a domain name is not valid
- WireGuard may not recover correctly in manual mode
- OpenVPN UDP and TCP may not work with certain commented out Advanced Parameters
- executable signature checking mechanism disabled in the helper and CLI
- app may become non-responsive and eventually crash
- app to appear on the active virtual desktop when user clicks either the menubar icon or dock icon
- firewall disabled on computer startup when firewall mode set to Always On
- validation of the domains entered by the user
- some user interface transitions involving the "SSL error" alert
- split tunnel hostname and IP validation errors are unclear
- firewall's enabled state not restored if it was enabled when the Windscribe firewall was turned on
- window shadow incorrectly sized on logout/exit screens
- login screen height may be truncated
- alert screen may overlap other screens (e.g. news feed, protocol change)
- notifications are missing after marking all as read, leaving the notifications screen, and returning to it
- view/send log functionality to truncate the log if it is too large to view/send
- firewall settings updated repeatedly when pinging locations
- installer built on Apple Silicon crashes on launch
- app update takes a long time if done while connected
- protocol badge not immediately updated on network changes
- app removes user's static IPv6 configuration and does not restore it
- Air Drop, Handoff, Airplay and other local Mac sharing features are partially functional or blocked with Allow LAN turned on
- helper holds installer executable hostage after installing app
- always-on firewall bug causing app to hang on startup

- Removed redundant signature verification method
- Removed incorrect primary IP check when enabling the Allow LAN Traffic preference
- Removed full directory paths from log to obscure user's PII
- Removed timestamp from news feed items
- Updated app to use server-supplied ping (latency) values
- Updated app warnings and error messages
- Updated to OpenVPN 2.6 and OpenSSL 3


Windscribe 2.6.14
Fixed:
- free accounts not pinging pro locations
- upgrade widget not hidden when returning to login screen
- 'out of data' screen isn't vertically centered
- MAC address spoofing toggle state isn't saved
- crash when reconnecting to different servers


Windscribe 2.4.11
- Update 10Gbps badge and location load when best location changes
- Added new flags
- UDP fails to connect on Mac fixed
- Fixed crash on bad server locations list
- Fixed OpenVPN infinite reconnection loop in some cases
- Dynamic Wireguard Interface Allocation Support
- Privilege escalation vulnerability fixed
- Fixed cut off long favorites location names in the tray menu
- Fixed static IPs display issue in tray menu
- Standardized API interaction timers
- Fixed automatic firewall deactivation when account status changes to disabled
- Fixed protocol selection not immediately saved to disk
- Updated app icons in menu bar
- Fixed app crash on Emergency Connect.
- Increased service start wait time to 20 seconds.
- Refactored wireguard connection to avoid blocking engine thread
- Fetch session when app receives focus
- Fixed firewall silently enabling by itself in rare cases
- Misc bug fixes


Windscribe 1.83 build 22
New Features:
- Show Static IP device ID in the UI
- Ability to select DNS server used by the app while disconnected

Bug Fixes:
- Build-a-Plan locations sometimes not showing correctly
- Prevent WindscribeService crash if DNS settings change
- Custom configs can now be connected to while expired
- Bypass anti-abuse check if Build-a-Plan is activated
- Fixed SSL CA bundle issue


Windscribe 1.83 build 18
New Features:
- WebSocket stealth protocol support
- Location list sorting methods: Geography, alphabet, latency
- Build-a-Plan support (future feature)
- Static IP + port forwarding support (future feature)
- Custom OpenVPN config support

Bug Fixes:
- Stuck on login in China
- App prevents graceful Windows shutdown
- App freezes in “Windscribe is shutting down” state
- Bad IKEv2 connection causes client to lock up
- Don’t disable server location on ping test failure