Multi-tenant panel with real per-user IP & device limits, encrypted subscriptions, email-your-users-their-new-sub-URL on demand, mobile dashboard, Grafana-style analytics, a proper operator CLI, and self-updating Docker images. Built for operators who scale.
Five domains of tooling. Every feature is production-tested on live VPN infrastructure at scale.
Three-tier roles — owner, admin, reseller. Quota enforcement, traffic caps, full data separation per admin.
Add nodes across countries. Dashboard generates a one-liner with cert baked in — paste on the node host, done. Grid view, reconnect, disconnect, uptime monitoring.
VLESS, VMess, Trojan, Shadowsocks, Hysteria 2. ECH, TLS fragments, XHTTP, Finalmask — all from the UI.
curl | bash installer. Auto Docker, SSL via Let's Encrypt, auto-renewal cron. PWA for mobile management.
Heartbeat checks every 6 hours. New versions pulled and restarted automatically. Zero manual maintenance.
Existing Marzban sub URLs keep working after migration — no end-user reconfiguration needed. Makes switching off Marzban commercially viable.
Traffic over time (6h–30d), user growth, protocol & status donuts, top consumers, per-node bandwidth load. Auto-refresh every 30s.
Every sub URL fetch logs device fingerprint, client (Happ / V2Ray / Clash), OS, IP, geo, last seen. Detect shared accounts, enforce device limits, answer "is my customer online?" in one click.
Immutable, paginated log of every admin action — who changed what and when. Searchable by actor, target, and action type. Essential for multi-admin teams.
Enforced via Xray access log parsing — not just UI checkboxes. Over-cap users auto-flipped to limited. Per-user IP history.
Segment users into groups with scoped inbound access, subscription template overrides, and custom host rows. Hide premium nodes from free-tier users.
Bundle inbounds into named sets and assign them to user groups. Grant a reseller access to exactly their tier of nodes — nothing more.
Select hundreds of users — enable, disable, reset, delete in one click. CSV import/export. Protocol sync.
Assign emails per user, then bulk-notify all of them of their new subscription URL in one click when you rotate domains. SMTP (Brevo, SendGrid, Postmark) from env.
TOTP 2FA with QR codes (panel + license-server admin), built-in captcha, rate limiting, account lockout, security headers, Cython-compiled binaries.
Real RSA-4096 encrypted subscriptions via Happ crypt4 deeplinks. Hide your sub URLs from end users.
HMAC-signed license cache bound to your machine. Heartbeat every 6h — tampering locks the panel.
Signed HMAC-SHA256 event deliveries for user create, update, delete, status change, and data reset. Wire into your billing system or CRM without polling.
nexus on the panel, nexus-node on each node. up / down / restart / logs / update / edit-env / backup / core-update.
Settings → Env. Edit SMTP, tokens, feature flags inline with live secret masking, then Save & Restart — the panel self-restarts and the page auto-reloads.
Pay with USDT, BTC, ETH, LTC, TRX and 200+ coins via NOWPayments. Coupon codes and multi-month discounts supported.
Fully responsive dashboard. Bottom-bar nav with overflow drawer. PWA installable on iOS and Android.
Every screen translated to English and Russian. Switch languages from the header — no restart needed.
Subscription links auto-sort by subscriber country — closest node first. Detected via CDN headers or MaxMind. Zero config.
Run a NAT relay host to route traffic through an unblocked IP. Auto-generates iptables rules from panel DB state. Swap the relay host in minutes.
Automated bot lets subscribers check their status, remaining traffic, and expiry — without contacting you. Configurable from env, no code needed.
Start free. Upgrade when you need more. All plans include the full dashboard, all protocols, and automatic updates.
Our public dev plans. Updated from the admin panel — no separate changelog to maintain.
Keep all your users, admins, proxies, and hosts. JWT compat means existing sub URLs work on day one — no end-user reconfiguration.
One-command installer. Sets up Docker + SSL. Doesn't touch your running Marzban.
nexus cli migrate9-stage atomic resumable state machine. Imports users, admins, proxies, hosts, Xray config, templates, Telegram bot, all NOTIFY_* flags. Dry-run first; plan-before-action; rollback until finalize.
JWT compatibility means every existing Marzban sub URL keeps working — your users never re-import anything. Stop Marzban, change DNS, done.
Trusted by operators worldwide
Free trial. No credit card. Deploy in 5 minutes.
Important: NexusPanel is a management panel only. Server configurations, Xray core configs, and VPN client setups are not included. You must provide your own VPS and node infrastructure. Need help with server setup, custom configs, or full deployment? Contact the developer.