Question 1

What is k2cc?

Accepted Answer

k2cc is 开途 Kaitu's in-house congestion control algorithm, designed to counter high-loss carrier networks. Its QoS awareness distinguishes "packets deliberately dropped by carrier traffic-management equipment" from "ordinary congestion loss", keeping throughput steady even on high-loss carrier networks (26% packet loss). In 开途 Kaitu's benchmarks, k2cc's throughput beats BBR and Brutal in most high-loss scenarios. k2cc needs zero configuration — no manual bandwidth cap.

Question 2

What is the k2 protocol?

Accepted Answer

k2 is 开途 Kaitu's composite stealth tunnel protocol, built from three parts: (1) ECH-encrypted Client Hello, making the TLS handshake fully undetectable; (2) QUIC/H3 as the preferred transport, with automatic TCP-WebSocket fallback; (3) the k2cc QoS-aware congestion control algorithm. QUIC and TCP-WS share the same port and are told apart by protocol detection — a single port that resists both UDP interference and deep packet inspection (DPI).

Question 3

What is ECH, and why does it get past network middlebox inspection?

Accepted Answer

ECH (Encrypted Client Hello) is a TLS 1.3 extension standard that encrypts the SNI field in the ClientHello before sending it. In a traditional TLS handshake, the SNI exposes the destination domain in plaintext, and DPI equipment uses it to identify and block connections. With ECH enabled, DPI can't see the real SNI or tell where the connection is going. The 开途 Kaitu server also forges its ECH configuration so it's indistinguishable from real Cloudflare ECH traffic, for even better stealth.

Question 4

How fast is 开途 Kaitu on heavily throttled networks?

Accepted Answer

In its own benchmarks, 开途 Kaitu simulated high-loss carrier networks (26% packet loss) and typical Chinese ISP conditions (5-15% packet loss). The results show k2cc's throughput beats BBR and Brutal in most high-loss scenarios; in low-loss scenarios, Brutal is sometimes faster. Real-world speed depends on your local network quality, whether your broadband carrier throttles international traffic, and the server you choose.

Question 5

Which devices does 开途 Kaitu support?

Accepted Answer

开途 Kaitu runs on every platform: Windows 10/11, macOS 12+ (universal binary for Intel + Apple Silicon), Linux (Ubuntu/Debian and other major distros), iOS (iPhone/iPad, downloadable directly from the China App Store), Android. One account allows up to 5 devices online at once. We also offer the k2s server for self-hosting on any VPS.

Question 6

Can I host my own 开途 Kaitu server?

Accepted Answer

Yes. 开途 Kaitu provides the k2s server binary, which you can self-host on any VPS — AWS, Aliyun, Tencent Cloud, Bandwagon and more. Deployment takes one command: curl -fsSL https://kaitu.io/i/k2s | sudo sh, then run k2s run to generate a k2:// connection URI automatically and paste it into the client. k2s supports zero-config automatic deployment, and also offers the k2s setup interactive wizard and k2s user add for managing multiple users' credentials.

Question 7

Does 开途 Kaitu work in mainland China?

Accepted Answer

Yes — that's exactly what 开途 Kaitu is designed for. Technically, the k2 protocol combines ECH-encrypted SNI, QUIC/TCP-WS dual stack and k2cc QoS-aware congestion control to stay connected even on high-loss networks. Entry-point resolution uses a Happy Eyeballs strategy to probe 6 CDN mirror entry points in parallel, avoiding the 10-second timeout problem in China. The iOS app can be downloaded directly from the China App Store.

Question 8

Can I download 开途 Kaitu directly from the China App Store?

Accepted Answer

Yes. The 开途 Kaitu iOS app is listed normally on the China App Store. Just search for "开途" to download and install it — no need to switch to an overseas Apple ID or get around any restrictions.

Question 9

How much does 开途 Kaitu cost?

Accepted Answer

开途 Kaitu is priced in US dollars, with four subscription plans: 1, 2, 3 and 5 years — the longer the term, the lower the monthly price. Every plan is full-featured Pro, with 5 devices online at once and unlimited data. We accept Alipay, WeChat Pay, UnionPay, credit cards and cryptocurrency, and your plan takes effect immediately after purchase. Details at kaitu.io/purchase

Question 10

Is there a free trial?

Accepted Answer

Not at the moment. If you're not satisfied after purchasing, you can request a refund within 7 days of your first purchase (with no more than 1 GB of data used). Refunds go to your account wallet balance, which you can use to renew or withdraw.

Question 11

Can I get a refund?

Accepted Answer

For a first purchase, you can request a refund within 7 days if you've used no more than 1 GB of data. The refund goes to your account wallet balance, which you can use to renew or withdraw to a crypto wallet.

Question 12

Why was my device signed out?

Accepted Answer

Each account can be signed in on up to 5 devices at the same time. When you sign in on a 6th device, the system automatically removes the device that signed in earliest. If you're sure you haven't exceeded 5 devices but still get signed out, please submit a feedback ticket and we'll check your account's device records.

Question 13

Does 开途 Kaitu log my browsing activity?

Accepted Answer

No. 开途 Kaitu enforces a strict no-logs policy: we don't record the websites you visit, your DNS queries, your downloads or any other network activity. We keep only connection timestamps from the last 7 days for service optimization and troubleshooting, and they're deleted automatically after that. All transport is encrypted with TLS 1.3, and the VPN tunnel uses AES-256-GCM encryption.

Question 14

Why does 开途 Kaitu use self-signed certificates instead of Let's Encrypt?

Accepted Answer

The 开途 Kaitu server uses self-signed certificates with certificate pinning in the client, so there is zero CT (Certificate Transparency) log exposure. Every certificate issued by a public CA is required to be written to CT logs, and attackers can scan CT logs to find every cross-border access server. 开途 Kaitu's self-signed + pinning strategy keeps server domains out of every public log, hiding servers far more thoroughly.

Question 15

What does port sharing mean in 开途 Kaitu?

Accepted Answer

Using protocol detection, the k2 server handles QUIC, TCP-WebSocket and real HTTPS requests on the same port (usually 443). Non-k2 traffic is forwarded by the built-in reverse proxy to a real website, so active probes get a legitimate HTTPS response. The result: from the outside, a 开途 Kaitu server behaves exactly like a normal Cloudflare-hosted HTTPS website and can't be identified by port fingerprinting or response characteristics.

Question 16

Will it reconnect automatically when I switch between Wi-Fi and 4G/5G?

Accepted Answer

Yes. 开途 Kaitu has a built-in netCoordinator that combines system network-interface signals with internal probing to distinguish "network down", "network restored" and "interface switched", and reconnects automatically when the network comes back or the interface changes. Automatic reconnection takes a few seconds to a dozen or so seconds; to recover immediately, disconnect and reconnect manually.

Question 17

What if my Android phone warns that 开途 Kaitu is unsafe during install?

Accepted Answer

Chinese Android skins (MIUI, ColorOS, HyperOS, EMUI and others) run security checks on APKs installed from outside an app store — this doesn't mean anything is wrong with the app. You can allow the install manually when prompted, or use USB-assisted install from a computer to get around all restrictions. Detailed steps at kaitu.io/install

Others drop. You stay at full speed.

Why does 开途 Kaitu stay stable when others drop?

Steady speed even on bad networks

Your connection can't be identified

Automatic route switching that heals itself

No tech skills needed — buy it and use it

Traffic patterns fully concealed

Never appears in any public record

Get started in three steps

What our users say

FAQ

Download the app