Multi-tenant panel with real per-user IP & device limits, encrypted subscriptions, email-your-users-their-new-sub-URL on demand, mobile dashboard, Grafana-style analytics, a proper operator CLI, and self-updating Docker images. Built for operators who scale.
From user management to protocol configuration, every feature is designed for operators running real VPN infrastructure at scale.
Three-tier roles — owner, admin, reseller. Quota enforcement, traffic caps, full data separation per admin.
Enforced via Xray access log parsing — not just UI checkboxes. Over-cap users auto-flipped to limited. Per-user IP history.
Traffic over time (6h–30d), user growth, protocol & status donuts, top consumers, per-node bandwidth load. Auto-refresh every 30s.
VLESS, VMess, Trojan, Shadowsocks, Hysteria 2. ECH, TLS fragments, XHTTP, Finalmask — all from the UI.
TOTP 2FA with QR codes (panel + license-server admin), built-in captcha, rate limiting, account lockout, security headers, Cython-compiled binaries.
Select hundreds of users — enable, disable, reset, delete in one click. CSV import/export. Protocol sync.
curl | bash installer. Auto Docker, SSL via Let's Encrypt, auto-renewal cron. PWA for mobile management.
Add nodes across countries. Dashboard generates a one-liner with cert baked in — paste on the node host, done. Grid view, reconnect, disconnect, uptime monitoring.
Heartbeat checks every 6 hours. New versions pulled and restarted automatically. Zero manual maintenance.
Real RSA-4096 encrypted subscriptions via Happ crypt4 deeplinks. Hide your sub URLs from end users.
Fully responsive dashboard. Bottom-bar nav with overflow drawer. PWA installable on iOS and Android.
Every screen translated to English and Russian. Switch languages from the header — no restart needed.
Subscription links auto-sort by subscriber country — closest node first. Detected via CDN headers or MaxMind. Zero config, zero latency for your users.
HMAC-signed license cache bound to your machine. Heartbeat every 6h — tampering locks the panel.
Pay with USDT, BTC, ETH, LTC, TRX and 200+ coins via NOWPayments. Coupon codes supported.
Assign emails per user, then bulk-notify all of them of their new subscription URL in one click when you rotate domains. SMTP (Brevo, SendGrid, Postmark) from env.
nexus on the panel, nexus-node on each node. up / down / restart / logs / update / edit-env / backup / core-update — no more remembering docker compose flags.
Settings → Env. Edit SMTP, tokens, feature flags inline with live secret masking, then Save & Restart — the panel self-restarts and the page auto-reloads when it's back.
Existing Marzban sub URLs keep working after migration — no end-user reconfiguration needed. Makes switching off Marzban commercially viable.
Every sub URL fetch logs device fingerprint, client (Happ / V2Ray / Clash), OS, IP, geo, last seen. Detect shared accounts, enforce device limits, answer "is my customer online?" in one click.
Run a NAT relay host to route traffic through an unblocked IP. Auto-generates iptables rules from panel DB state. Swap the relay host in minutes without touching node configs.
Segment users into groups with scoped inbound access, subscription template overrides, and custom host rows. Hide premium nodes from free-tier users.
Bundle inbounds into named sets and assign them to user groups. Grant a reseller access to exactly their tier of nodes — nothing more.
Signed HMAC-SHA256 event deliveries for user create, update, delete, status change, and data reset. Wire into your billing system or CRM without polling.
Immutable, paginated log of every admin action — who changed what and when. Searchable by actor, target, and action type. Essential for multi-admin teams.
Automated bot lets subscribers check their status, remaining traffic, and expiry — without contacting you. Configurable from env, no code needed.
Start free. Upgrade when you need more. All plans include the full dashboard, all protocols, and automatic updates.
Keep all your users, admins, proxies, and hosts. JWT compat means existing sub URLs work on day one — no end-user reconfiguration.
One-command installer. Sets up Docker + SSL. Doesn't touch your running Marzban.
nexus cli migrate9-stage atomic resumable state machine. Imports users, admins, proxies, hosts, Xray config, templates, Telegram bot, all NOTIFY_* flags. Dry-run first; plan-before-action; rollback until finalize.
JWT compatibility means every existing Marzban sub URL keeps working — your users never re-import anything. Stop Marzban, change DNS, done.
Trusted by operators worldwide
Free trial. No credit card. Deploy in 5 minutes.
Important: NexusPanel is a management panel only. Server configurations, Xray core configs, and VPN client setups are not included. You must provide your own VPS and node infrastructure. Need help with server setup, custom configs, or full deployment? Contact the developer.