AnyTLS is a proxy protocol that runs inside TLS and pads the start of every connection, so proxied traffic doesn’t show the size patterns that usually give away “TLS inside TLS”. You log in with a password, the server checks it, and your connections travel through an ordinary-looking TLS session. AnyTLS also reuses its TLS connections, which saves a handshake for most new connections.

This article explains what AnyTLS is, how it works, where it fits next to Trojan and VLESS, and what an anytls:// link looks like.

What is AnyTLS?

AnyTLS is a relatively young protocol. It appeared in 2025 with anytls-go, its reference client and server, which also hosts the protocol specification. Two widely used proxy engines added it soon after: sing-box and mihomo (the engine behind most current Clash apps).

Its goal is narrow. Protocols like Trojan already hide inside TLS, so an observer only sees an encrypted session to some server. But when you open an HTTPS site through such a proxy, your browser’s own TLS handshake travels inside the proxy’s TLS session. The first few messages of that inner handshake have typical sizes and timing. Those patterns can leak through the outer encryption, because encryption hides content but not length. This is often called the “TLS-in-TLS” problem.

AnyTLS tries to blur those patterns. It pads the first packets of every connection to sizes taken from a padding scheme, so they no longer match a typical TLS handshake.

Harder, not impossible. Padding makes proxy traffic harder to fingerprint. It doesn’t make it undetectable, and it adds some bytes to every new connection.

How AnyTLS works

Here is what happens when an app on your phone opens a connection through an AnyTLS server:

  1. TLS first. Your client opens a normal TLS connection to the server, with a server name (SNI) and, optionally, a browser-like fingerprint. To the network, this looks like any HTTPS visit.
  2. Password check. Inside TLS, the client sends a hash of the password and a block of padding. A server that doesn’t recognize the password closes the connection.
  3. Padding. The first packets in each direction are split and padded to the lengths the padding scheme describes. The server can send its own padding scheme, which the client uses from its next TLS connection on.
  4. Your connection. The client asks the server to open a connection to the destination, for example example.com:443, and relays the bytes in both directions.
  5. Reuse. When that connection ends, the TLS session isn’t closed. It waits as an idle session, and the next connection uses it instead of opening a new one. Each session carries one connection at a time, so several connections at once open several sessions, which are reused later.

UDP, such as voice calls or QUIC, is carried inside the same TLS connection. This is called UDP over TCP.

Padding schemes

A padding scheme is a short list of rules: how many packets to pad and how long each one should be, often as a random range. The defaults come from anytls-go. A server operator can change them, and the client picks up the new scheme automatically. There’s nothing to set on your device.

REALITY

A normal AnyTLS server needs a TLS certificate for its domain. sing-box servers can instead run AnyTLS with REALITY, which borrows the TLS certificate of another, real website. With REALITY, you set the server’s public key and short ID, use the borrowed website’s name as the server name, and pick a browser fingerprint such as chrome. If REALITY is new to you, see What is VLESS + REALITY?.

Strengths and weaknesses

Strengths

  • Looks like HTTPS. The outer layer is plain TLS with a real server name, so it blends in with ordinary web traffic.
  • Hides TLS-in-TLS sizes. Padding targets the specific pattern that makes TLS proxies easier to spot.
  • Fewer handshakes. Reusing idle sessions means most new connections skip the TLS handshake, which helps on high-latency links.
  • Simple to set up. A password and normal TLS settings are all a client needs.
  • Works with REALITY on sing-box, so you don’t need a certificate of your own.

Weaknesses

  • Young and less widely supported. Fewer server panels, providers and apps offer AnyTLS than Trojan, Shadowsocks or VLESS.
  • Padding costs bandwidth. The overhead is small, but every new session sends extra bytes.
  • UDP rides on TCP. UDP over TCP works, but when packets are lost, everything inside the TLS connection waits. A QUIC-based protocol such as Hysteria 2 handles loss better.
  • No transports. AnyTLS runs straight over TLS. It doesn’t offer WebSocket or gRPC, so it can’t sit behind a CDN the way Trojan or VLESS over WebSocket can.

AnyTLS compared with its neighbors

AnyTLS Trojan VLESS + REALITY Hysteria 2
Runs over TLS over TCP TLS over TCP REALITY (TLS) over TCP QUIC over UDP
Login Password Password User ID (UUID) Password
Hides TLS-in-TLS Padding No With the Vision flow —
Reuses connections Yes No No Yes, one QUIC connection
Needs a certificate Yes, or REALITY Yes, or REALITY No Yes (self-signed is common)
UDP UDP over TCP Over TLS Over the same connection QUIC datagrams

For a wider view, including Shadowsocks, VMess and SOCKS5, see Proxy protocols compared. For more on its closest relative, read What is a Trojan proxy?.

Providers usually hand out AnyTLS servers as anytls:// links, in the anytls-go URI format:

anytls://password@host:port/?parameters#name

The password is percent-encoded, and the name after # is just a label. When the port is missing, clients use 443. A basic server with the password secret:

anytls://secret@anytls.example.com:443/?sni=anytls.example.com#Basic

The common parameters are:

Parameter Meaning
sni The TLS server name.
insecure 1 turns off certificate verification.
alpn The ALPN list, comma-separated and percent-encoded.
fp A browser fingerprint, such as chrome.
hpkp The SHA-256 of the server’s certificate, to pin it.

A server with a self-signed certificate, pinned instead of left unverified:

anytls://secret@anytls.example.com:443/?sni=anytls.example.com&fp=chrome&hpkp=abababababababababababababababababababababababababababababababab#Pinned

In a Clash or Mihomo subscription, the same server is an entry with type: anytls, a password, sni, and options such as udp: true or client-fingerprint. Clash entries can also tune session reuse with idle-session-check-interval, idle-session-timeout and min-idle-session.

Avoid insecure mode. insecure=1 lets anyone between you and the server read your traffic. If the server uses a self-signed certificate, pin it with hpkp instead.

Use AnyTLS on iPhone

Potatso, a free proxy client for iPhone and iPad, supports AnyTLS with padding schemes, connection reuse, UDP over TCP, REALITY, ECH, certificate pinning and browser fingerprints. You can add a server from an anytls:// link, a Clash or Mihomo subscription, a Surge configuration or by hand.

Follow the step-by-step guide in How to use AnyTLS on iPhone, or check every supported setting in the AnyTLS reference.

Frequently asked questions

What is AnyTLS used for?
AnyTLS is a proxy protocol that carries your connections inside an ordinary TLS connection and pads them, so the traffic is harder to identify as a proxy. People use it as an alternative to Trojan or VLESS when they want a TLS proxy that also hides the size patterns of TLS inside TLS.
Is AnyTLS better than Trojan?
Neither is better in every case. Both run inside TLS and authenticate with a password. AnyTLS adds padding and connection reuse to make proxied HTTPS harder to fingerprint, while Trojan is older, simpler and supported by more servers and apps.
Which servers and apps support AnyTLS?
The reference server is anytls-go. sing-box and mihomo also support AnyTLS, and sing-box can combine it with REALITY. On iPhone and iPad, Potatso connects to AnyTLS servers from an anytls:// link, a Clash or Mihomo subscription, a Surge configuration or settings you enter by hand.
Does AnyTLS support UDP?
Yes. AnyTLS carries UDP inside its TLS connection, which is called UDP over TCP. In Potatso, UDP Relay is off by default for AnyTLS servers, so turn it on if your server relays UDP.

Also available in: 简体中文 · 繁體中文 · 日本語 · Русский