To use AnyTLS on an iPhone or iPad, you need a client app that speaks the protocol, an anytls:// link or the server’s password and TLS settings, and a few minutes. This guide walks through the whole setup with Potatso, a free proxy client for iOS, including the AnyTLS-specific settings: server name, certificate pinning, fingerprints and UDP.
New to the protocol? Read What is AnyTLS? first.
What you need
- An iPhone or iPad with iOS 17 or later.
- An AnyTLS server, from a provider or your own anytls-go, sing-box or mihomo server. You’ll get one of these:
- an
anytls://link, such asanytls://secret@anytls.example.com:443/?sni=anytls.example.com#Tokyo, - a QR code of that link,
- a Clash / Mihomo subscription URL, or a Surge configuration, that includes AnyTLS servers, or
- the raw settings: address, port, password, and the TLS server name.
- an
sing-box configuration? Potatso doesn’t import AnyTLS servers from a sing-box configuration yet. Ask for, or generate, the server’s
anytls://link instead.
Step 1: Install Potatso
Download Potatso from the App Store and open it. Tap Get Started, then type a name for your profile, such as “Personal”, and tap Continue. A profile holds your servers, rules and DNS settings.
Step 2: Add your AnyTLS server
The Add your servers step offers four ways in. Pick the one that matches what you have.
From an anytls:// link or subscription URL
- Copy the
anytls://link or the subscription URL. - In Potatso, tap Paste a link, then Paste.
Potatso reads the password, address and port, plus any of these parameters in the link:
| Parameter | What it sets |
|---|---|
sni |
The TLS server name. Without it, Potatso uses the server address. |
insecure=1 |
Turns off certificate verification. |
hpkp |
Pins the server’s certificate by its SHA-256. |
fp |
The browser fingerprint, such as chrome. |
alpn |
The ALPN list, such as h2,http/1.1. |
A subscription keeps updating after you import it. For the full flow, see how to import a Clash subscription on iPhone.
From a QR code
Tap Scan a QR code and point the camera at it. If the QR code is a screenshot in your photos, tap the photo button in the corner of the scanner and pick the picture.
By hand
- Tap Enter a server manually.
- Enter a Name, and choose AnyTLS as the Protocol.
- Fill in Address and Port (usually 443).
- Enter the Password exactly as the server has it.
- Tap TLS Settings and fill in what your server needs:
- Server Name: the domain on the server’s certificate. Leave it empty if you connect by that domain anyway.
- Certificate Pin (SHA-256): the certificate’s SHA-256, for a self-signed certificate.
- Client Fingerprint: a browser to imitate, such as
chrome. - ALPN: only if your server asks for one.
- Skip Certificate Verification: leave it off unless you’re testing.
- For a sing-box server with REALITY, fill in Reality Public Key and Reality Short ID, set Server Name to the website the server borrows from, and choose a fingerprint.
- Turn on UDP Relay if your server relays UDP.
- Tap Save (the checkmark).
Once the server is in, the step changes to Servers added. Tap Continue.
Pin, don’t skip. Many self-hosted AnyTLS servers use a self-signed certificate. Skipping verification lets anyone in the middle read your traffic. A certificate pin trusts only that one certificate.
Step 3: Choose a route
Potatso tests the latency of every server while you choose:
- Global sends all traffic through the server you pick. It’s the simplest choice with a single server.
- Rule lets your configuration’s rules decide what goes through the proxy and what connects directly. It’s offered when your import came with rules, as most Clash subscriptions do.
Pick your AnyTLS server and tap the button at the bottom, such as Use Tokyo. A server that shows no latency here is worth checking before you go on: see If it doesn’t connect.
Step 4: Allow the VPN and connect
Potatso sends your traffic through the proxy with a VPN configuration on your device, which iOS asks you to approve once.
- Tap Add VPN Configuration, then Allow when iOS asks.
- On Home, turn on the switch on the status card.
The status changes to Connecting…, then Connected, and a VPN icon appears in the status bar. Open a website to check that it loads.
If it doesn’t connect
AnyTLS problems almost always come from the password or the TLS settings.
Wrong password
AnyTLS has no error message for a bad password. The server just closes the connection. In Potatso, that looks like a server with no latency, or a site that never loads. Copy the password again, character for character. In an anytls:// link, special characters in the password must be percent-encoded, so a link edited by hand can break it.
Certificate errors
- The server name doesn’t match. If you connect by IP address, or by a domain that isn’t on the certificate, set Server Name (
sni) to the domain the certificate is for. - Self-signed certificate. Verification fails unless you pin the certificate. Ask your provider for the SHA-256, or set
hpkpin the link. - Wrong pin. After a server renews its certificate, an old pin stops matching. Update the pin.
- Client certificates. Potatso doesn’t support TLS client certificates or a custom CA for AnyTLS, so it doesn’t import a server that needs them.
REALITY doesn’t connect
Check the public key and short ID against the server, and make sure the server name is the borrowed website, not your server’s address. REALITY needs a browser fingerprint such as chrome.
UDP doesn’t work
Voice calls, some games, and QUIC need UDP. UDP Relay is off by default for AnyTLS servers, as it is in Clash, so Potatso doesn’t send UDP through the server. Turn it on in the server’s settings if the server relays UDP. A Clash subscription turns it on with udp: true.
Imported from Surge with a warning
A Surge reuse=false setting doesn’t apply. Potatso always reuses connections, as the AnyTLS specification does, and shows a warning on import. The server still works.
If none of this helps, run the guided check in Settings → Troubleshooting, described in The VPN won’t connect. Every supported setting is listed in the AnyTLS reference.
Next steps
- Want to know when AnyTLS is the right choice? Compare it with Trojan, VLESS, Hysteria 2 and Shadowsocks in Proxy protocols compared.
- Have a Trojan server too? See how to use Trojan on iPhone.
- Got many servers from one provider? Group them and let Potatso pick the fastest: Proxy groups and speed tests.
Frequently asked questions
- Can I use AnyTLS on iPhone?
- Yes, with a client app that supports the protocol. Potatso is a free proxy client for iPhone and iPad that connects to AnyTLS servers from an anytls:// link, a Clash or Mihomo subscription, a Surge configuration or settings you enter by hand.
- Why does my AnyTLS server never connect?
- The most common cause is a wrong password: the server simply closes the connection, so it looks like a timeout or a failed latency test. Next, check the server name (SNI) and the certificate settings, which must match the server's TLS certificate.
- Should I turn on insecure mode for a self-signed certificate?
- Avoid it. Skipping certificate verification lets anyone between you and the server read your traffic. Pin the server's certificate instead by entering its SHA-256 as the certificate pin, the hpkp parameter in an anytls:// link.
- Why don't voice calls work through my AnyTLS server?
- Calls and many games use UDP, and UDP Relay is off by default for AnyTLS servers in Potatso, as in Clash. Turn on UDP Relay in the server's settings if your server relays UDP.