Shadowsocks, VLESS, Trojan and Hysteria 2 all send your traffic through a remote server, but they hide it differently. Shadowsocks encrypts everything into bytes with no recognizable pattern, Trojan and VLESS + REALITY wrap it in TLS so it looks like HTTPS, and Hysteria 2 runs over QUIC, the UDP-based protocol behind HTTP/3. Which one is best depends on your network, your server and what your provider offers.
This hub compares the seven protocol families you’re most likely to meet, in one table, then gives short “choose this if…” advice and links to a full explainer and iPhone guide for each.
Proxy protocols compared at a glance
| Protocol | Transport | Encryption | Looks like | UDP | Typical use |
|---|---|---|---|---|---|
| Shadowsocks | TCP, UDP | Own cipher (AEAD or 2022) | Random bytes, no handshake | Yes, native | Simple self-hosted servers, wide support |
| VMess | TCP, or WebSocket / gRPC, optional TLS | Own cipher (AES-GCM, ChaCha20) | Random bytes, or HTTPS with TLS | Yes | Older V2Ray setups, behind a CDN |
| VLESS (+ REALITY) | TCP, or WebSocket / gRPC / XHTTP | TLS or REALITY (none of its own) | HTTPS to a real website | Yes | Modern Xray servers, no domain needed with REALITY |
| Trojan | TCP + TLS, optional WebSocket / gRPC | TLS | HTTPS | Yes, over TLS | A server with its own domain and certificate |
| Hysteria 2 | QUIC over UDP | TLS 1.3 inside QUIC | HTTP/3, or scrambled with obfuscation | Yes, QUIC datagrams | Long-distance or lossy links |
| AnyTLS | TCP + TLS | TLS, plus padding | HTTPS | Yes, UDP over TCP | TLS proxy that hides TLS-in-TLS sizes |
| SOCKS5 / HTTP | TCP (SOCKS5 also UDP) | None, unless over TLS | A plain proxy | SOCKS5 yes, HTTP no | Trusted networks, LAN, corporate proxies |
A few terms used above:
- Transport is what the protocol runs on. TCP-based protocols resend lost packets in order; QUIC handles loss per connection and recovers faster on poor links.
- Looks like is what an observer on the network roughly sees. Looking like HTTPS makes traffic harder to fingerprint. It doesn’t make it invisible.
- UDP matters for voice and video calls, many games and QUIC. Some clients, including Potatso, leave UDP off by default for some protocols until you turn it on.
Shadowsocks vs VLESS vs Trojan vs Hysteria 2, one by one
Shadowsocks
Shadowsocks encrypts each connection with a shared password and a cipher, and sends it straight over TCP or UDP. There’s no handshake to recognize, which is its strength and also how it can be spotted: traffic that looks like nothing in particular. Modern servers use AEAD or 2022 ciphers. Optional plugins add disguises such as obfuscation or ShadowTLS.
Read What is Shadowsocks? and how to use Shadowsocks on iPhone.
VMess and VLESS
Both come from the V2Ray family. VMess has its own encryption and authentication based on a UUID. VLESS is its lighter successor: it drops VMess’s encryption and relies on TLS or REALITY instead. REALITY lets a server borrow the TLS certificate of a real website, so you don’t need a domain, and the Vision flow hides the TLS-in-TLS pattern of proxied HTTPS.
Read VMess vs VLESS, What is VLESS + REALITY? and how to use VLESS REALITY on iPhone.
Trojan
Trojan runs inside a standard TLS connection with a password, so it looks like an HTTPS visit to your server’s domain. It’s simple and widely supported, but it needs a domain and a valid certificate, or REALITY. Optional WebSocket or gRPC transports let it run behind a CDN.
Read What is a Trojan proxy? and how to use Trojan on iPhone.
Hysteria 2
Hysteria 2 runs over QUIC, so it keeps its speed on networks that lose packets, and many connections share one QUIC connection. Its weak spot is UDP itself: some networks slow down or block UDP, which is what port hopping and Salamander or Gecko obfuscation are for.
Read What is Hysteria 2? and how to use Hysteria 2 on iPhone.
AnyTLS
AnyTLS is a newer TLS-based protocol, supported by anytls-go, sing-box and mihomo. Like Trojan, it uses a password inside TLS. It adds padding to hide the packet sizes of TLS inside TLS, and it reuses idle TLS connections to save handshakes. It’s less widely offered than the others so far.
Read What is AnyTLS? and how to use AnyTLS on iPhone.
SOCKS5 and HTTP
These are general-purpose proxy protocols, not designed to hide anything. They don’t encrypt the connection to the proxy unless you use SOCKS5 over TLS or an HTTPS proxy. HTTPS sites you visit stay encrypted end to end either way. HTTP proxies only carry TCP; SOCKS5 can relay UDP.
Read SOCKS5 vs HTTP proxy and how to use a SOCKS5 proxy on iPhone.
Which proxy protocol is best in 2026?
There’s no winner for everyone. Start from what your server or provider supports, then use this as a guide.
Choose Shadowsocks if… you want the simplest setup, you run your own server with a one-line script, or you need something almost every app supports. Use a 2022 or AEAD cipher.
Choose VLESS with REALITY if… you want traffic that looks like HTTPS but don’t have a domain, or your provider recommends it. It’s the most common choice on modern Xray servers.
Choose Trojan if… you have a domain with a certificate and want a simple, well-understood TLS proxy, or you need a CDN in front of your server with WebSocket.
Choose Hysteria 2 if… your connection to the server is long-distance or loses packets, and UDP works well on your network.
Choose AnyTLS if… you want a TLS proxy with a password, your server runs sing-box, mihomo or anytls-go, and you care about hiding the size patterns of TLS inside TLS.
Choose VMess if… your provider only offers it. For new servers, VLESS is the more current option.
Choose SOCKS5 or HTTP if… you’re on a network you trust, such as a home lab or office, or you need to reach a corporate proxy. Prefer the TLS versions elsewhere.
Have more than one? You don’t have to pick just one. With a subscription, put servers of different protocols in a Fallback or Fastest group, and the app uses whichever works best right now.
Things that matter more than the protocol
- The route to your server. A nearby, uncongested server on a well-connected network usually beats a “faster” protocol on a poor route.
- Your settings. A wrong cipher, server name or certificate pin breaks any protocol. Certificate verification left off weakens every TLS-based one.
- Server software. Some features only work with certain servers. For example, REALITY with AnyTLS is a sing-box feature.
Using these protocols on iPhone
Potatso, a free Mihomo/Clash-compatible proxy client for iPhone and iPad, supports all of the protocols above, plus ShadowsocksR and Snell. You can add servers from share links, QR codes, Clash or Mihomo subscriptions or by hand.
If your provider gave you a subscription with many servers, start with What is a proxy subscription? and how to import a Clash subscription on iPhone. For every setting each protocol supports, see the protocol reference in the docs, such as the pages for VLESS, Trojan and Hysteria 2.
Frequently asked questions
- What is the best proxy protocol in 2026?
- There's no single best one. VLESS with REALITY, Trojan and AnyTLS are good choices when you want traffic that looks like ordinary HTTPS, Hysteria 2 is strong on long-distance or lossy links, and Shadowsocks is the simplest and most widely supported. The right choice depends on your network and what your server or provider offers.
- Is VLESS faster than Shadowsocks?
- Not inherently. VLESS has no encryption of its own and relies on TLS or REALITY, while Shadowsocks encrypts with its own cipher, and both are light on modern devices. In practice, the route to the server and your network matter far more than the protocol.
- Which proxy protocol is the hardest to detect?
- Protocols that run inside TLS, such as VLESS with REALITY, Trojan and AnyTLS, look like ordinary HTTPS and are harder to fingerprint than protocols with no recognizable handshake. No protocol is undetectable, and how well each holds up depends on the network.
- Is SOCKS5 encrypted?
- No. Plain SOCKS5 and HTTP proxies don't encrypt your traffic to the proxy, although HTTPS sites stay encrypted end to end. Use SOCKS5 over TLS or an HTTPS proxy, or an encrypted protocol, on networks you don't trust.
- Which protocols support UDP?
- Shadowsocks, VMess, VLESS, Trojan, Hysteria 2, AnyTLS and SOCKS5 can all carry UDP, which calls and games need. HTTP proxies carry TCP only. Hysteria 2 is the only one of these that runs over UDP itself.