Android

Cloak Proxy can set up an Android emulator or a USB-connected Android device for you through adb, the Android Debug Bridge. It forwards the device’s proxy port to your Mac, sets the device’s proxy, and copies the certificate to it. Because Android apps ignore user-installed certificates by default, your app also needs a small network security config in its debug build.

12345

The Android tab when adb is installed.

1. Forwards the port and sets the device's proxy
2. Removes the proxy and the port forward
3. Copies the certificate to the device's Downloads folder
4. Lists the devices adb can see
5. Network security config for your app's debug build

×

Install adb

The one-click buttons need adb. Cloak Proxy looks for it in these places, in order:

Location	Installed by
/opt/homebrew/bin/adb	Homebrew on Apple silicon
/usr/local/bin/adb	Homebrew on Intel, or a manual install
/usr/bin/adb	A manual install
~/Library/Android/sdk/platform-tools/adb	Android Studio’s SDK Manager

If it finds none, the Android tab shows adb wasn’t found. Install Android platform tools (brew install android-platform-tools) for one-click setup. in place of the buttons.

Terminal

brew install android-platform-tools

After installing, switch to another tab and back, or reopen the window, so Cloak Proxy finds adb.

Connect an emulator or USB device

The Emulator or USB-connected device (adb) section uses adb reverse, so the device reaches Cloak Proxy over USB or the emulator bridge. You don’t need to change Wi-Fi settings on the device or let other devices connect to the Mac.

1. Start the emulator, or connect the device with a USB cable and turn on USB debugging in its Developer options. Accept the prompt on the device to allow your Mac.

2. Open Device & Runtime Setup (click Devices in the toolbar) and choose the Android tab.

3. Click Show Connected Devices to confirm adb sees exactly one device.

4. Click Connect Proxy.

   The output area shows Proxy set to 127.0.0.1:9090 on the device. If either command fails, it shows adb’s error instead.

5. Click Push Certificate, then install it on the device. See Install the certificate.

One device at a time

The buttons run adb without choosing a device. With more than one emulator or device attached, adb refuses and the output area shows its error. Disconnect the others first.

What each button does

The buttons use the port Cloak Proxy is listening on (9090 by default).

Button	Commands it runs	Result message
Connect Proxy	adb reverse tcp:9090 tcp:9090, then adb shell settings put global http_proxy 127.0.0.1:9090	Proxy set to 127.0.0.1:9090 on the device.
Disconnect Proxy	adb shell settings put global http_proxy :0, then adb reverse --remove tcp:9090	Proxy removed from the device.
Push Certificate	adb push <certificate> /sdcard/Download/cloak-proxy-ca.crt	Copied to Downloads. On the device: Settings → Security → Encryption & credentials → Install a certificate → CA certificate.
Show Connected Devices	adb devices -l	The list of devices, with their model names.

adb reverse makes port 9090 on the device lead to port 9090 on your Mac, so the device’s proxy can be 127.0.0.1:9090. The global http_proxy setting is Android’s device-wide proxy, which apps that use the system proxy follow for both HTTP and HTTPS.

Install the certificate

Push Certificate copies the Cloak Proxy root certificate to the device’s Download folder as cloak-proxy-ca.crt. Android then needs you to install it.

1. On the device, open Settings › Security › Encryption & credentials. On some devices it’s under Settings › Security & privacy › More security settings or a similar path; search Settings for “certificate” if you can’t find it.

2. Tap Install a certificate, then CA certificate.

3. Android warns that a CA lets others see your data. Tap Install anyway.

4. Choose cloak-proxy-ca.crt from the Download folder and confirm with the screen lock if asked.

The certificate is now a user certificate. Android’s browser and apps that opt in trust it. Most apps don’t trust it yet: see the next section.

You can also get the certificate without adb: once the device’s proxy points at Cloak Proxy, open http://cloak.proxy in the device’s browser and tap Download certificate (DER, Android / Windows). See Other devices and access control.

Make your app trust user certificates

Apps targeting Android 7 (API level 24) or later ignore user-installed CAs unless their network security config allows it. The Your app must trust user certificates section gives you the config to add to debug builds.

1. Create res/xml/network_security_config.xml in your app module:

   res/xml/network_security_config.xml

   <!-- res/xml/network_security_config.xml -->
   <network-security-config>
     <debug-overrides>
       <trust-anchors>
         <certificates src="user" />
       </trust-anchors>
     </debug-overrides>
   </network-security-config>

2. Reference it from the <application> element in AndroidManifest.xml:

   AndroidManifest.xml

   <application
       android:networkSecurityConfig="@xml/network_security_config"
       ...>

3. Build and install a debug build, then use the app.

Everything inside <debug-overrides> applies only when the app is debuggable, so release builds keep trusting only the system CAs. You can’t add this to apps you don’t build, so most third-party apps on Android 7 and later can’t be decrypted.

Caution

Don’t move <certificates src="user" /> out of <debug-overrides>. In a release build it would let any user-installed CA read your users’ traffic.

Then add your API’s host to SSL Proxying so Cloak Proxy decrypts it.

Use Wi-Fi instead of adb

For a device you can’t connect over USB, use the Wi-Fi proxy, the same way as an iPhone.

1. In Cloak Proxy, turn on Allow other devices to connect (phones, other computers) in Settings › General and click Apply & Restart Proxy. The setting shows This Mac’s address, for example 192.168.1.20:9090.

2. On the device, open the Wi-Fi network’s settings, find Proxy (often under Advanced options), and choose Manual.

3. Enter your Mac’s address as the proxy hostname and 9090 as the port, then save.

4. Open http://cloak.proxy in the device’s browser, tap Download certificate (DER, Android / Windows), and install it as a CA certificate.

The exact Wi-Fi settings path differs between Android versions and manufacturers. Traffic from a Wi-Fi device appears in the sidebar under its IP address.

Undo the setup

1. Click Disconnect Proxy. It clears the device’s proxy and removes the port forward. Do this before you unplug the device or quit Cloak Proxy: a device whose proxy is 127.0.0.1:9090 without the forward can’t reach the internet.

   Without Cloak Proxy, run the same commands yourself:

   Terminal

   adb shell settings put global http_proxy :0
   adb reverse --remove tcp:9090

2. Remove the certificate on the device: open Settings › Security › Encryption & credentials › User credentials (or Trusted credentials › User), select the Cloak Proxy CA, and remove it. Delete cloak-proxy-ca.crt from Download too.

3. If you used Wi-Fi, set the network’s proxy back to None, and turn off Allow other devices to connect on the Mac.

If you regenerate the root certificate in Settings › Certificate, push and install the new one.

Related

Other devices and access controlLet Wi-Fi devices connect safely, and the certificate page.

SSL ProxyingChoose which hosts are decrypted.

Java, Firefox, Docker, Flutter and ElectronFlutter apps need their own proxy setting.

Debug a mobile appA full walkthrough from setup to fix.