Verify what you install. Report what you find.
Where official XDLogin builds come from, how to check one against its SHA-256, what the app sends and to whom, and how to report a vulnerability.
Official sources
Official downloads come only from xdlogin.com and github.com/ftwsourav/xdlogin-releases. Anything else, including ‘cracked’ builds, is not ours. We can’t tell you what a file from anywhere else does.
The Android app isn’t on Google Play. Its APK comes from the same two places.
Check a download against its hash
Every build has a published SHA-256 hash: under “Verify SHA-256 checksums” for each platform on the download page, and on the GitHub release. The hash of the file you downloaded has to match it exactly.
-
Open a terminal where the file is
PowerShell on Windows, Terminal on macOS or a shell on Linux, in the folder you saved the download to.
-
Hash the file
Run the line for your system. The
*matches the version in the file name.Windows, in PowerShell:
Get-FileHash .\XDLogin-*.exe -Algorithm SHA256macOS, in Terminal:
shasum -a 256 XDLogin-*.dmgLinux:
sha256sum XDLogin-*.AppImageFor the .deb, run
sha256sum xdlogin_*_amd64.deb. For the Android APK, hash the .apk on a computer before you copy it to your phone. -
Compare every character
PowerShell prints the hash in capital letters; it is the same hash. If one character differs, don’t run the file. Download it again from the download page, and if it still doesn’t match, write to security@xdlogin.com.
The builds aren’t code-signed yet
The Windows and Linux builds and the macOS beta carry no code-signing certificate, so your system can’t vouch for them. The published hash is the check that a file is the one we built.
Windows
The first time you run the installer, SmartScreen shows “Windows protected your PC”. Check the hash first, then click More info and Run anyway.
macOS (beta)
The build is unsigned. After copying it to Applications, clear the quarantine flag once in Terminal:
xattr -dr com.apple.quarantine /Applications/XDLogin.appLinux
The AppImage and the .deb carry no signature either. Compare the hash before you run chmod +x or apt install.
Android (beta)
Android warns about installing from an unknown source. Every release is signed with the same key, so a new version installs over the old one and keeps your profiles.
The Windows installer, the AppImage and the .deb update themselves from our GitHub releases; the .deb asks for your password first. The portable .exe, the macOS builds and the Android app don’t, so download new versions of those from the download page.
What the app sends, and to whom
A summary. The privacy policy is the full list.
| Sent to | What | When |
|---|---|---|
| api.xdlogin.com, our server, hosted on Vercel | Your email and password (we store the password only as a bcrypt hash), a device ID, and the app’s name and version. On desktop 3.5.8 and later the device ID is a random ID made once per install; before that, and on Android, a one-way hash | When you sign up or sign in |
| api.xdlogin.com | A request for your plan and, on desktop, how many profiles each device holds: one number, with no names, settings or content. Desktop 3.5.8 also sends the device ID older versions used, until the server has received it once | To apply your plan’s profile limit |
| api.xdlogin.com | Your profiles, encrypted on your device before they leave it. We store the ciphertext, a random ID for each device and timestamps | Only with encrypted sync on (Pro and above) |
| api.xdlogin.com | The team’s name, its members and their roles | Only if you create or join a team |
| GitHub | Requests for new releases | When the desktop app checks for updates |
| ipinfo.io (desktop) or ipapi.co (Android) | A lookup of the proxy’s address and location, made through that proxy | When you test a proxy, and from desktop 3.5.8 when a profile whose timezone matches its proxy launches |
Without sync, a profile’s cookies, site storage, cache, fingerprint settings and proxy credentials stay on the device, and we never see what you browse. Payments, email and how this website counts visits are in the privacy policy.
Encryption, and what it doesn’t cover
Encrypted sync (Pro and above)
Off until you turn it on. Each profile is sealed with AES-256-GCM on your device before upload, with a key made from your sync passphrase. The passphrase never leaves your machines, and the server stores only ciphertext. We can’t read it or reset the passphrase: lose it and the cloud copy becomes unreadable, while your local profiles are unaffected.
Profile folders on your disk
XDLogin doesn’t encrypt profile folders itself, so they are as safe as the device they are on. Use a password on your user account and full-disk encryption.
The local API and MCP server
Both listen only on this computer, at 127.0.0.1, and both are off until you turn them on. With no API key set, any program on your machine can use them, so set a key in Settings. From 3.5.8 both refuse requests from web pages, key or not. In 3.5.7 and earlier, with no key set, a website open in your browser could send them commands; Linux and macOS are still on those versions, so set a key there.
Proxy passwords on 3.5.5
Desktop 3.5.5 could send a proxy’s username and password to a website that asked for a login; 3.5.6 sends them only to the proxy. If you ran 3.5.5 with password-protected proxies, update and change those passwords. The macOS beta is still on 3.5.5, so on a Mac use proxies that allow your IP instead of a password until its 3.5.6 build is out. Details.
What to include
- What is affected: the app, its version and your operating system, or the web address.
- Steps to reproduce it from a clean start.
- What someone could do with it.
- A proof of concept, if you have one.
- Whether anyone else knows about it yet.
While you test
- Use your own account and your own profiles.
- Don’t read, change or delete anyone else’s data.
- Don’t slow the service down for others: no load tests, no spam.
- Give us a chance to fix it before you publish.
Already public: the signals a profile can’t change yet are on the test results page, and the leaks we have found are in the changelog. The same contact details, for tools that read them, are in /.well-known/security.txt.
Download it from the source.
Every build has a published SHA-256. Check it before you run anything.