Hysteria 2 is a proxy protocol that runs over QUIC, the UDP-based transport behind HTTP/3. It’s built for speed on networks that lose packets: instead of slowing down whenever a packet is lost, it can send at a bandwidth you set. To anyone who doesn’t know the password, a Hysteria 2 server can look like an ordinary HTTP/3 website.
This guide explains how it works, what its options do, and where it falls short.
A short history
The original Hysteria is an open-source project from the Apernet developers, aimed at fast proxying over poor, long-distance links. Hysteria 2, released in 2023, is a redesign rather than an update: it authenticates over HTTP/3, so a server can pass as a web server, and it isn’t compatible with the original protocol.
Besides the official server and client, sing-box, Mihomo and Xray support Hysteria 2.
How Hysteria 2 works
Most proxy protocols, such as Trojan and VLESS, run over TCP. Hysteria 2 runs over QUIC, which runs over UDP and has TLS 1.3 built in.
A connection goes like this:
- Your client opens a QUIC connection to the server’s UDP port. The TLS handshake uses the
h3(HTTP/3) protocol name, like a browser would. - The client sends an HTTP/3 request with your password.
- If the password is right, the server accepts the client. If it isn’t, the server behaves as an ordinary web server: its masquerade.
- Each TCP connection from your device becomes a QUIC stream inside that one connection.
- UDP packets travel as QUIC datagrams in the same connection.
Because many connections share one QUIC connection, opening a new one costs no new handshake.
Brutal: sending at a set rate
TCP and most QUIC stacks treat a lost packet as a sign of congestion and slow down. On a long, noisy link, that can keep speeds far below what the line can carry.
Hysteria’s Brutal congestion control works differently. The client tells the server how fast it can receive, and the server sends at that rate even when packets are lost, resending what’s missing. This is why Hysteria 2 can hold its speed where TCP-based protocols struggle.
The catch: the rate must be close to your real bandwidth. Set it too high and you lose more packets than you gain, so the connection gets slower. Brutal also doesn’t back off for other traffic on your network. When no bandwidth is set, Hysteria 2 falls back to BBR, a standard congestion control that adapts its own rate.
Salamander: obfuscation
Plain Hysteria 2 traffic is QUIC, and QUIC is easy to recognize. Salamander scrambles every packet with a shared password so the connection no longer looks like QUIC. Some servers offer Gecko, which also splits and pads the first packets so their sizes don’t give it away.
There’s a trade-off: with obfuscation on, the server no longer speaks plain QUIC, so it can’t also pass as an ordinary HTTP/3 website. You choose one disguise or the other.
Port hopping
Some networks slow down or block a single UDP port after a while. With port hopping, the server listens on a range of UDP ports, such as 20000-30000, and the client moves to a different port every so often, by default every 30 seconds.
Masquerade
A server that doesn’t recognize a client can serve a website, proxy one, or return a simple page. Probing it then looks like visiting a normal site. The masquerade is a server setting; nothing changes on your device.
Certificates and pinning
Hysteria 2 always uses TLS, so the server needs a certificate. Many servers use a self-signed one instead of a domain with a public certificate. Your client then has two options:
- Pin the certificate (
pinSHA256): trust exactly that certificate and no other. This is the safe choice. - Skip certificate verification (
insecure=1): trust any certificate. Anyone between you and the server could then read your traffic. Avoid it.
Strengths and weaknesses
Strengths:
- Holds speed on lossy links, thanks to Brutal and QUIC.
- Fast to connect. Many connections share one QUIC connection.
- Carries UDP natively, in QUIC datagrams.
- Flexible disguise. Masquerade, Salamander or Gecko obfuscation, and port hopping.
- Works with self-signed certificates, safely, through pinning.
Weaknesses:
- Depends on UDP. Some networks, such as office Wi-Fi or some mobile carriers, block or throttle UDP. Then Hysteria 2 is slow or doesn’t connect at all.
- Brutal needs a good number. A wrong bandwidth makes things worse, and Brutal isn’t fair to other traffic.
- No CDN. You connect to the server directly.
- Harder to detect, not undetectable. QUIC on unusual ports, or traffic that doesn’t look like any known protocol, can still stand out.
How Hysteria 2 compares
| Hysteria 2 | VLESS + REALITY | Trojan | Shadowsocks | |
|---|---|---|---|---|
| Runs over | UDP (QUIC) | TCP | TCP | TCP and UDP |
| Encryption | TLS 1.3 in QUIC | REALITY (TLS 1.3) | TLS | Its own cipher |
| Good on lossy links | Yes | Average | Average | Average |
| Works where UDP is blocked | No | Yes | Yes | TCP only |
| Needs a certificate | Yes, self-signed is fine | No | Yes | No |
| Answer to probes | Masquerade site, if set up | The borrowed site | Fallback site, if set up | Drops the connection |
For all the protocols side by side, see Proxy protocols compared. If you’re new to Shadowsocks, read What is Shadowsocks?
What a Hysteria 2 link looks like
Servers are usually shared as hysteria2:// links, or hy2://, the same link with a shorter name:
hysteria2://secret@hy2.example.com:443/?sni=hy2.example.com#Basicsecretis the password.hy2.example.com:443is the server and UDP port.sniis the TLS server name.#Basicis the server’s name in your app.
Options are added as parameters. Salamander obfuscation with the password hidden:
hysteria2://secret@hy2.example.com:443/?obfs=salamander&obfs-password=hidden#SalamanderPort hopping between 20000 and 30000, listed in the port:
hysteria2://secret@hy2.example.com:443,20000-30000/?sni=hy2.example.com#HoppingA self-signed certificate, pinned by its SHA-256:
hysteria2://secret@203.0.113.7:443/?sni=hy2.example.com&pinSHA256=abababababababababababababababababababababababababababababababab#PinnedEvery parameter is listed in the Hysteria 2 reference.
Use Hysteria 2 on iPhone
Potatso is a free proxy client for iPhone and iPad that supports Hysteria 2 with Salamander and Gecko obfuscation, port hopping, download bandwidth and certificate pinning, tested against the official server, sing-box, Mihomo and Xray. Follow How to use Hysteria 2 on iPhone to import your link and connect.
Frequently asked questions
- What is Hysteria 2 used for?
- Hysteria 2 is a proxy protocol for getting good speed over networks that lose packets, such as long international routes or busy mobile networks. It runs over QUIC, the UDP-based protocol behind HTTP/3, and carries both TCP and UDP traffic.
- Is Hysteria 2 faster than VLESS or Trojan?
- It can be on lossy or long-distance links, because it keeps sending at a set rate when packets are lost. On a clean network the difference is often small, and on networks that throttle or block UDP it can be slower or not work at all.
- What is Salamander in Hysteria 2?
- Salamander is Hysteria 2's optional obfuscation. It scrambles every packet with a shared password so the connection no longer looks like QUIC. The client and server must use the same obfuscation password.
- Does Hysteria 2 need a domain and certificate?
- It needs a TLS certificate, but it can be self-signed. With a self-signed certificate, pin it on the client with its SHA-256 instead of turning off certificate verification.
- Is Hysteria 2 the same as Hysteria?
- No. Hysteria 2 is a redesign of the original Hysteria protocol and isn't compatible with it. A Hysteria 2 client needs a Hysteria 2 server.