QuickQ documentation

1. Before you install

You need an email address you can receive mail on, a working internet connection, and a rough idea of which services you access most. That last point decides which nodes you should favour.

Three decisions worth making early

• Primary use: live matches care about jitter, video cares about bandwidth, remote development cares about long-lived sessions. Picking one as the priority avoids most dead ends.
• Target region: choose a node in or near the region of the service you reach. Detours are the most common cause of disappointing speeds.
• Device scope: one or two devices can be installed individually; four or more, or anything involving a TV box, is usually easier with the router approach.

2. Windows setup

Supports Windows 10 1809 or later and Windows 11 on 64-bit systems. Setup creates a virtual network adapter, which is required for acceleration to work.

Installation

1. Download QuickQ-Setup-3.8.1-x64.exe from the download page;
2. Run certutil -hashfile QuickQ-Setup-3.8.1-x64.exe SHA256 to verify it;
3. Run the installer and allow the virtual adapter driver when prompted;
4. Launch the client and register with an email address — you are signed in immediately afterwards.

Settings worth adjusting

• Protocol: Nova by default; switch to IKEv2 on networks that restrict UDP.
• Disconnect protection: leave it on so traffic never continues unencrypted after a tunnel drop.
• Launch at start-up: useful on machines you use every day.
• Floating panel: shows the live link score, and prompts you when it falls below 70.

3. macOS setup

The universal package runs natively on Apple Silicon and Intel, takes over traffic through a system network extension and coexists with iCloud Private Relay.

Installation

1. Download QuickQ-3.8.1-universal.dmg and verify its SHA-256;
2. Open the disk image and drag QuickQ into Applications;
3. On first launch, allow the network extension under System Settings → Privacy & Security;
4. Sign in and connect from the menu bar, where nodes can be switched directly.

4. Mobile setup

Mobile clients build the tunnel through a system extension. The priorities are surviving network changes and keeping background battery use low.

iOS / iPadOS (15.0 and later)

1. Search for QuickQ on the App Store, or use the link on the download page;
2. Allow the VPN configuration when first connecting;
3. Enable Background App Refresh for QuickQ so it recovers after a network change;
4. Turn on low-power mode if you want to reduce battery impact further.

Android (10.0 and later)

1. Install from Google Play, or download the APK from this site;
2. Allow installation from that source if you use the APK;
3. Authorise the VPN service on first connect;
4. Set QuickQ to Unrestricted under Settings → Battery so the system does not reclaim it.

5. Routers and command line

Covering TVs, consoles and smart home devices is easiest at the router: configure once and the whole network benefits.

Linux command line

OpenWrt router

1. Confirm the firmware is OpenWrt 21.02 or later;
2. Install quickq-core and luci-app-quickq from System → Software;
3. Open the QuickQ menu in LuCI and enter the device key from the account centre;
4. Under policy routing, choose the devices or subnets that should use the accelerated route.

6. Scene strategies and routing

QuickQ classifies traffic by process and matches a scene strategy automatically, and you can override it. Understanding this avoids the classic problem of local services breaking as soon as acceleration is on.

Three built-in strategies

Building a direct list

Apps on the direct list bypass the tunnel entirely, which suits local device management, printers and banking clients that never need a cross-border route.

• Windows and macOS: Settings → Routing → add app rules by process name or install path;
• Android: Settings → Per-app routing, tick the apps that should use the tunnel;
• iOS: system limits mean only global and per-domain modes are available.

Custom DNS

Encrypted DNS inside the tunnel is used by default, which prevents responses being altered in transit. If you run your own resolver, set it under Settings → Advanced → DNS and the client will validate answers to prevent leaks.

7. Security model

Encryption and keys

Mobile devices use ChaCha20-Poly1305 by default because it is easier on mobile silicon; desktops can switch to AES-256-GCM. Both complete key exchange with X25519 for forward secrecy, and session keys rotate hourly.

Three layers of leak protection

• DNS leak protection: every lookup is forced through the encrypted resolver inside the tunnel;
• IPv6 leak protection: stops traffic escaping the tunnel on dual-stack networks;
• Disconnect protection: freezes network access if the tunnel drops, so your real address stays hidden.

What we retain

We do not store destination domains, transferred content or DNS queries. The account system holds your email, subscription state and device count; nodes keep aggregated traffic counters that cannot be traced to an individual. The latest third-party assessment is summarised on the product updates page.

8. Troubleshooting

Follow the order below. Reinstalling the client first is a mistake — it usually destroys the evidence you need.

Step 1: confirm the local network

With acceleration off, can you load ordinary websites? If not, the problem is local and unrelated to the client.

Step 2: read the link score

Check the score on the client home screen. If it is below 70, switch to the next recommended node rather than debugging the current route.

Step 3: change protocol and port

Try Nova, WireGuard and IKEv2 in turn. If none of them connect, the network likely blocks UDP — change the connection port to 443 and retry.

Step 4: rule out conflicts

Close other proxy extensions, the traffic filtering modules of enterprise security suites, and anything else that modifies the system routing table. Several proxies active at once is a common cause of connection faults.

Step 5: export a diagnostic report

If nothing above helps, use Settings → Export diagnostic report and send the file to the support page with your OS version, client version, selected node and the time the problem started. The report contains no access records and you can read it first.

9. Terminology

Link score

A 0 to 100 figure combining latency, jitter and packet loss, used to judge whether the current route is worth keeping.

Multipath

Maintaining several candidate routes at once and moving traffic to a better one when the primary degrades.

Path pre-warming

Preparing the standby route's session state ahead of time so a switch is effectively invisible.

Per-app routing

Deciding by process or domain which traffic uses the tunnel and which uses the local exit.

Disconnect protection

Freezing network access when the tunnel drops unexpectedly, to avoid exposing your real address.

Forward secrecy

A key agreement property where later compromise of a long-term key cannot decrypt earlier sessions.