This advanced network utility allows developers to intercept, process, and forward network traffic. It offers deep control over connections, including URL redirection, local file mapping, and HTTPS decryption. Ideal for debugging and network analysis.
5.21.1
August 11, 2026
What's New Surge as MTProto Server - Surge now can operate as an incoming MTProto proxy server for Telegram. Please read manual for more information: https://manual.nssurge.com/ Tailscale - Added interactive Tailscale sign-in on iOS and macOS. Resolve the issue where some enterprise users are unable to obtain the auth key. - Added automatic Tailscale routing. Surge can discover the tailnet’s MagicDNS suffix and peer IPv4/IPv6 addresses, then automatically route matching domains and peer IP traffic through the corresponding Tailscale policy. - Automatic Tailscale routing is enabled by default and can be disabled with `auto-add-magic-dns-rule = false`. - Improved Tailscale session warm-up and recovery. Sessions now retry MagicDNS discovery after startup failures and network changes without requiring matching traffic to arrive first. - Tailscale sessions now stay active by default. An omitted `idle-keepalive`, `0`, or `-1` keeps the session always active; set a positive value to enable idle teardown. - Tailscale can now begin handling traffic as soon as a valid network map is received, without waiting for the home DERP connection to be established. - Improved recovery after network changes and control-server reconnections by preserving the last known home DERP region and retrying peer handshakes at the appropriate time. - Aligned DERP measurement and selection behavior with official Tailscale client, improving compatibility with custom DERP maps, STUN-only nodes, fallback probes, and temporarily unavailable control connections. - Sensitive values such as authentication keys and authorization URLs are now redacted from verbose Tailscale control logs. TLS - Added `server-cert-verify-name` to independently specify the hostname used for proxy server certificate verification without changing SNI. This parameter applies to all TLS- and QUIC-based proxy protocols. ECN - Reworked ECN configuration and packet handling across QUIC, WireGuard, Tailscale, Ponte, and nested UDP tunnels. - Correctly preserves ECN and DSCP/TOS metadata across IPv4 and IPv6 encapsulation and decapsulation. - For QUIC-based proxy protocols, when ECN is enabled, anomalies will be automatically detected and fallback to non-ECN handling. - ECN is now enabled by default for QUIC-based proxy protocols on supported systems. WireGuard and Tailscale remain disabled by default. Use `ecn=false` or `ecn=true` to override the default explicitly. - Surge Ponte now also has ECN enabled by default, and the `client-use-ecn` parameter has been removed. DNS - Optimized TCP connection establishment for `prefer-v4` and `prefer-v6`. In earlier versions, these two parameters indicated which record to use when a domain name had both A and AAAA records. Now, during the TCP handshake, A or AAAA records are used preferentially; if the handshake cannot be completed within 3 seconds, other records will start to be tried. - Added DNS-over-TCP support. DNS server settings now accept `tcp://hostname[:port]`. iOS - Raised the minimum system requirement to iOS 17. - Reworked Shortcuts and App Intent support and improved the reliability of App Intent operations. - Added manual Suspend and Bypass Suspension controls. The Ponte management page, scripts, and local proxy services remain available while Surge is suspended. - Snell Server can now be configured and used on iOS and tvOS. Codebase Refactoring After more than a decade of development, the Surge codebase has grown into a large and complex project. To further improve reliability, we have introduced AI-assisted code review across the entire codebase. Every code change is independently reviewed by Fable 5, GPT-5.6 Sol, and a human developer before being merged, helping us identify potential security issues, rare crash scenarios, and subtle correctness problems. Due to the large number of updates, please refer to the Mac version release notes for details: https://nssurge.com/support/mac/release-notes
MoreUnlock all new features
$49.99
Surge Pro
Surge Pro features
Surge 5 is an advanced network utility designed for developers. It allows you to take over device network connections, process and modify network requests and responses, forward traffic to other proxy servers, and intercept specific data. It's a powerful tool for network analysis and debugging.
Key features include taking over HTTP/HTTPS/TCP traffic, modifying requests/responses with JavaScript, forwarding traffic with flexible rules, intercepting and decrypting HTTPS traffic, ad blocking, local DNS mapping, and detailed traffic measurement. It also supports various proxy protocols and advanced DNS features.
The application is available for free with in-app purchases. While the core functionality is accessible, certain advanced features or expanded capabilities may require purchasing through in-app transactions.
Surge 5 is specifically designed for developers and individuals with professional knowledge of networking and web development. Its advanced features require a technical understanding to utilize effectively for tasks like debugging and network analysis.
Common use cases include debugging network issues in applications, analyzing API requests and responses, testing network configurations, blocking ads on a device level, and switching between development and production environments without code changes using local DNS mapping.
