Is the APK on this site the same as the one on Google Play?

It is the same application but it is not the same signed file. Google Play re-signs the app with its own key under Play App Signing, and this APK is signed with the developer's key. Android refuses to replace an app with a build carrying a different signature, so pick one source and stay with it. To switch you must uninstall first, which erases the device key and the session history stored on the phone.

How do I verify the APK I downloaded?

Compare its SHA-256 with the one published on this page: 222c8044b3774223271d8c84e36e0ac42fde02d6083fe294b462d4c38559a824. On Windows run certutil -hashfile OshiFreeDomVPN.apk SHA256, on macOS or Linux run shasum -a 256 OshiFreeDomVPN.apk.

Download for Android

Name: Oshi Free-Dom VPN
Author: Hugo Moriceau

Oshi Free-Dom VPN (app.diopta.vpn) · version 1.0 (build 7) · published 11 September 2026

This page publishes the Android application as a file you can download and install yourself, the same way the OSHI messenger is offered here. It is the honest option for people who would rather not go through a store, and it carries one real consequence that is set out below rather than buried.

Oshi Free-Dom VPN — Android

13.8 MB · Android 8.0 (API 26) or later · arm64-v8a, armeabi-v7a, x86, x86_64

Download the APK

SHA-256 of the file:

222c8044b3774223271d8c84e36e0ac42fde02d6083fe294b462d4c38559a824

Verify it before you install it

You are about to give an application the right to carry all of your traffic. Check that the file you received is the file that was published — it takes one command, and a VPN that asks you to skip this step is not one to trust.

Windows: certutil -hashfile OshiFreeDomVPN.apk SHA256
macOS or Linux: shasum -a 256 OshiFreeDomVPN.apk
On the phone: most file managers will show a file's hash; so will a hash-checking app from the store.

The digest must match the one printed above, character for character. If it does not, delete the file and do not install it.

The package is signed with the developer's key, CN=Oshi Free-Dom VPN, O=Oshi, whose certificate digest is
46:65:59:24:C1:8B:C0:99:C3:EB:E7:DD:63:1D:62:01:7B:4E:D7:E6:31:9A:46:B4:FA:5B:BD:EC:A0:40:67:1B.

Read this before choosing where to install from. This APK and the Google Play version are the same application, but they are not the same signed file. Play re-signs the app with Google's own key under Play App Signing; this file carries the developer's key. Android refuses to replace an installed app with a build whose signature differs, so you cannot switch between the two by updating — you would have to uninstall first, and uninstalling erases the device key and the session history held on the phone. Pick one source and stay with it. If you have no reason to prefer this file, Google Play is the easier path, because updates arrive on their own.

Installing it

Download the file above on the phone, or transfer it there.
Open it. Android will say the file came from an unknown source and offer a settings screen; grant the permission to whichever app you opened it with — usually your browser or file manager.
Install, then open the app. The first screen is a disclosure of what a VPN can and cannot do for you. Read it; it is short and it is not marketing.
Android will then ask, in its own system dialog, whether this app may set up a VPN. That consent is yours to give and yours to revoke at any time in Android's settings.

Turn the unknown-sources permission back off afterwards if you would rather not leave it on. Nothing in this app depends on it after installation.

What you get without paying

5 GB each month, and three of the six locations — New York, Portsmouth and Gland. The limit is applied by the server, not by a switch in the app.
The DNS filter, which declines the domains in StevenBlack's unified hosts file — 230,717 entries at the 27 August 2026 refresh — for every app on the phone, not just a browser.
Post-quantum key wrapping. Every session wraps its WireGuard pre-shared key with ML-KEM-768 (FIPS 203). On Android there is no classical fallback: a location that cannot negotiate it is refused rather than quietly downgraded.
No account. Nothing to sign up for, no email, no phone number.

Oshi Plus opens the other three locations and removes the monthly limit. It is sold through Google Play. A copy installed from this page can still buy it, because the purchase belongs to the Google account rather than to the installed file.

What this is not

A VPN is not anonymity. It moves trust from your network provider to whoever runs the exit — here, the developer. A site you sign in to still knows who you are. The app says this before you connect, and the reference page says it at length, including the countries where logging is legally mandatory, which is not a comfortable section and is published anyway.

It is also not open source, and no third-party security audit has been published. Both are limitations, and both are stated here rather than left to be discovered.

iPhone, iPad and Mac

Not yet, and nothing on this page will install on them. The Apple app is built and connects to the same nodes today, but it is not on the App Store and is targeted for March 2027. There is no TestFlight and no public beta before then. Android is where this ships now.

Where to go next

The full reference page — how a connection is made, the cryptography, the node fleet, multi-hop, and the jurisdiction section.
The privacy policy — what is held, why, and for how long.
contact@oshi-messenger.com — for anything this page did not answer.