You sell sub-accounts; your customers connect through any v2ray client; you manage it from one panel. The Telegram billing flow ships built-in. Marzban migration keeps every existing sub URL working — no client reconfiguration.
27 features across five tabs. Click through to see what's actually in each one.
Three-tier roles — owner, admin, reseller. Quota enforcement, traffic caps, full data separation per admin.
Add nodes across countries. Dashboard generates a one-liner with cert baked in — paste on the node host, done. Grid view, reconnect, disconnect, uptime monitoring.
Protocols: VLESS, VMess, Trojan, Shadowsocks, Hysteria 2.
Transports & obfuscation: XHTTP, Reality, ECH, TLS fragments, Finalmask. All configured from the UI.
curl | bash installer. Auto Docker, SSL via Let's Encrypt, auto-renewal cron. PWA for mobile management.
Heartbeat checks every 6 hours. New versions pulled and restarted automatically. Zero manual maintenance.
Existing Marzban sub URLs keep working after migration — no end-user reconfiguration needed. Makes switching off Marzban commercially viable.
Traffic over time (6h–30d), user growth, protocol & status donuts, top consumers, per-node bandwidth load. Auto-refresh every 30s.
Every sub URL fetch logs device fingerprint, client (Happ / V2Ray / Clash), OS, IP, geo, last seen. Detect shared accounts, enforce device limits, answer "is my customer online?" in one click.
Immutable, paginated log of every admin action — who changed what and when. Searchable by actor, target, and action type. Essential for multi-admin teams.
Enforced via Xray access log parsing — not just UI checkboxes. Over-cap users auto-flipped to limited. Per-user IP history.
Segment users into groups with scoped inbound access, subscription template overrides, and custom host rows. Hide premium nodes from free-tier users.
Bundle inbounds into named sets and assign them to user groups. Grant a reseller access to exactly their tier of nodes — nothing more.
Select hundreds of users — enable, disable, reset, delete in one click. CSV import/export. Protocol sync.
Assign emails per user, then bulk-notify all of them of their new subscription URL in one click when you rotate domains. SMTP (Brevo, SendGrid, Postmark) from env.
TOTP 2FA with QR codes (panel + license-server admin), built-in captcha, rate limiting, account lockout, security headers, Cython-compiled binaries.
Real RSA-4096 encrypted subscriptions via Happ crypt4 deeplinks. Hide your sub URLs from end users.
HMAC-signed license cache bound to your machine. Heartbeat every 6h — tampering locks the panel.
Signed HMAC-SHA256 event deliveries for user create, update, delete, status change, and data reset. Wire into your billing system or CRM without polling.
nexus on the panel, nexus-node on each node. up / down / restart / logs / update / edit-env / backup / core-update.
Settings → Env. Edit SMTP, tokens, feature flags inline with live secret masking, then Save & Restart — the panel self-restarts and the page auto-reloads.
Pay with USDT, BTC, ETH, LTC, TRX and 200+ coins via NOWPayments. Coupon codes and multi-month discounts supported.
Fully responsive dashboard. Bottom-bar nav with overflow drawer. PWA installable on iOS and Android.
Every screen translated to English and Russian. Switch languages from the header — no restart needed.
Subscription links auto-sort by subscriber country — closest node first. Detected via CDN headers or MaxMind. Zero config.
Run a NAT relay host to route traffic through an unblocked IP. Auto-generates iptables rules from panel DB state. Swap the relay host in minutes.
Automated bot lets subscribers check their status, remaining traffic, and expiry — without contacting you. Configurable from env, no code needed.
Start free. Upgrade when you need more. All plans include the full dashboard, all protocols, and automatic updates.
Our public dev plans. Updated from the admin panel — no separate changelog to maintain.
Keep all your users, admins, proxies, and hosts. JWT compat means existing sub URLs work on day one — no end-user reconfiguration.
One-command installer. Sets up Docker + SSL. Doesn't touch your running Marzban.
nexus cli migrate9-stage atomic resumable state machine. Imports users, admins, proxies, hosts, Xray config, templates, Telegram bot, all NOTIFY_* flags. Dry-run first; plan-before-action; rollback until finalize.
JWT compatibility means every existing Marzban sub URL keeps working — your users never re-import anything. Stop Marzban, change DNS, done.
Both are excellent free, open-source panels with bigger communities. Here's exactly where NexusPanel differs — and where it doesn't.
| NexusPanel | Marzban | Remnawave | |
|---|---|---|---|
| License | Closed, paid | AGPL, free | AGPL, free |
| Source code | Private | Open on GitHub | Open on GitHub |
| Self-host or managed | You host | You host | You host |
| Community size | Small (new) | Very large | Growing |
| Marzban migration | JWT-compat, one command | n/a | partial |
| Telegram buyer flow | Built-in | — | — |
| Crypto billing (NOWPayments) | Built-in | — | — |
| Multi-tenant admin isolation | Yes | Partial | Yes |
| Mobile-installable PWA | Yes | — | — |
| Auto-updates | Every 6 hours | Manual | Manual |
| Self-support burden | Ours — we patch & ship | Yours | Yours |
If you self-host already and like reading source code, pick Marzban or Remnawave. If you'd rather buy a panel with the billing flow already wired up and a Marzban migration that just works, that's the trade we're offering.
No card. No signup form. /start in the bot, paste the install one-liner on a fresh VPS, log in.
Important: NexusPanel is a management panel only. Server configurations, Xray core configs, and VPN client setups are not included. You must provide your own VPS and node infrastructure. Need help with server setup, custom configs, or full deployment? Contact the developer.