Proxy protocols compared: Shadowsocks, VMess, VLESS, Trojan, Hysteria2, TUIC

A provider sells proxy lines by giving you a subscription link; a node is an individual server within that subscription; a protocol is the convention governing encryption and camouflage between that node and your device; and a client is the application running on your device that imports the subscription, such as the Clash family (Clash Meta, Clash Verge, FlClash, Stash), Shadowrocket, v2rayN, v2rayNG, sing-box, or Hiddify.

Different nodes from the same provider can run different protocols, and a single client can hold multiple protocol nodes side by side. Evaluating a setup involves three separate questions: the quality of the provider's transit lines, whether a node's protocol suits your current network, and whether your client supports it. This guide focuses on the protocol in the middle.

For the difference between proxy subscriptions, full VPN services, and game accelerators, see VPN vs Proxy Line Providers vs Accelerators. Standard VPN protocols such as OpenVPN, WireGuard, and AnyConnect are covered in VPN Protocols Compared.

• Shadowsocks (SS): runs over TCP; the lightest and most battery-friendly; supported by almost all clients; traffic relies on looking entirely random rather than mimicking legitimate services.
• ShadowsocksR (SSR): an early fork of SS with obfuscation plugins; abandoned for years, with modern clients dropping support; fewer providers still offer it.
• VMess: the original V2Ray protocol, featuring built-in encryption and timestamp validation; fails if device time drifts; usually wrapped in WebSocket + TLS.
• VLESS: a streamlined replacement for VMess that drops internal encryption in favour of outer TLS; paired with XTLS Vision or Reality, it is the mainstream TCP choice today.
• Trojan: puts proxy traffic inside an authentic TLS connection so that probing looks like visiting a standard HTTPS website; straightforward configuration over TCP port 443.
• Hysteria2: built on QUIC over UDP; manages transmission rates aggressively, dramatically outperforming TCP-based protocols on lossy links.
• TUIC: also built on QUIC over UDP; similar architecture to Hysteria2 but employs standard congestion control algorithms; slightly narrower client support.
• NaiveProxy: reuses Chrome's native network stack over HTTP/2, closely mimicking real browser fingerprints; moderate speeds with limited client support.
• WireGuard: strictly a VPN protocol, but used by some providers or Cloudflare WARP as node exits; fast UDP transport, but carries distinct, uncamouflaged signatures.

Shadowsocks was the first widely adopted circumvention protocol, designed with one goal: encrypt traffic into an indistinguishable stream of bytes. Without complex handshake emulation, it imposes minimal overhead, conserves mobile battery, and runs smoothly on underpowered routers. Modern nodes typically use AEAD ciphers (aes-128-gcm, chacha20-ietf-poly1305) or Shadowsocks 2022 specs; legacy ciphers like rc4-md5 or aes-256-cfb should be avoided.

SSR added protocol and obfuscation plugins to SS, but development ceased years ago. Modern cores like Clash Meta (Mihomo) and sing-box offer limited or deprecated support. A provider primarily advertising SSR usually signals outdated backend infrastructure.

The vulnerability of SS lies in its lack of camouflage: because it resembles nothing familiar, completely unrecognisable streams can draw scrutiny on strictly monitored networks. Providers often place SS nodes behind dedicated relay lines so the cross-border hop is not exposed directly—a benefit of the route, not the protocol.

V2Ray (and its modern successor Xray) is a modular proxy platform offering VMess and VLESS. Its architecture layers the proxy protocol over various transport mechanisms such as raw TCP, WebSocket, gRPC, and HTTP/2, wrapped in TLS. Node listings frequently display strings like “VMess + WS + TLS” or “VLESS + gRPC”.

VMess includes proprietary encryption and validates system timestamps: if a phone or laptop's clock differs from standard time by more than a couple of minutes, the node will refuse connection—a frequent reason VMess nodes suddenly show timeout errors. VLESS discards this redundant layer, relying entirely on outer TLS for security; running VLESS without TLS is insecure.

XTLS Vision and Reality are enhancements developed by the Xray project for VLESS. Vision eliminates the tell-tale double-TLS signature when proxying TLS traffic inside TLS; Reality removes the need for personal domains or certificates by borrowing TLS handshake fingerprints from legitimate high-traffic websites during the handshake. “VLESS + Reality + Vision” is currently a premier setup for direct-connect TCP nodes.

Nodes using WebSocket can hide behind CDNs, protecting their real origin IPs at the cost of higher latency and lower throughput from routing detours.

Trojan establishes a genuine TLS connection to the node identical to browsing an HTTPS website, with proxy data packaged inside. Unauthorised probes reaching the port simply see a valid web page.

With minimal configuration options, Trojan leaves little room for misconfiguration and enjoys broad client support. It behaves similarly to “VLESS + TLS” over TCP 443, though nodes require their own registered domains and TLS certificates.

All TCP-based protocols share a common limitation: when packet loss occurs, TCP's congestion window throttles throughput drastically. During peak hours on congested cross-border cables, streaming video often stutters—the precise issue that QUIC-based protocols solve.

Both Hysteria2 and TUIC are built on QUIC over UDP. Because QUIC serves as the underlying transport for HTTP/3, their traffic resembles regular HTTP/3 connections to outside observers.

Hysteria2 features a customised congestion control mechanism: instead of throttling speeds when packets drop like TCP does, it maintains transmission based on configured bandwidth rates. On lossy cross-border transit, it frequently achieves multiple times the throughput of TCP protocols, though on pristine connections the gap is negligible.

TUIC shares similar principles but adheres to standard congestion control models, yielding a gentler throughput curve that shares bandwidth more courteously with co-existing traffic.

The vulnerability of this family is UDP itself: certain enterprise, school, and hotel networks throttle or block UDP entirely. In those environments, Hysteria2 and TUIC will fail or stall, necessitating a switch back to TCP options like Trojan or VLESS. Continuous high-speed transfers on mobile can also consume slightly more battery than SS.

• NaiveProxy: uses Chromium's actual network stack to initiate HTTP/2 connections, producing genuine browser fingerprints. Supported by sing-box and select desktop clients, but rare among commercial providers.
• WireGuard / WARP: WireGuard is fundamentally a VPN protocol with fixed packet headers and no obfuscation. Some providers use Cloudflare WARP at node egress points to unblock geo-restricted streaming or AI services, which relates to egress IP reputation rather than your connection protocol.
• Snell: a proprietary protocol by the author of Surge; lightweight, but practically confined to Surge and Stash clients.
• ShadowTLS: wraps Shadowsocks traffic with an authentic TLS handshake to appear as web traffic, requiring coordinated client and server configurations.
• HTTP / HTTPS / SOCKS5: basic proxy standards. Unencrypted HTTP and SOCKS5 are suitable only for localhost or private networks; cross-border transit requires HTTPS with TLS.

• Check the link prefix: ss:// indicates Shadowsocks, ssr:// is SSR, vmess:// is VMess, vless:// is VLESS, trojan:// is Trojan, hysteria2:// or hy2:// is Hysteria2, and tuic:// is TUIC.
• Inspect client listings: Clash variants and Shadowrocket display the protocol type alongside each node name (Shadowsocks, Vmess, Vless, Trojan, Hysteria2, TUIC).
• Review Clash configuration files: each proxy node includes a type key specifying the protocol, with auxiliary keys (network, tls, reality-opts) detailing transport wrappers.
• Providers supply subscriptions formatted for Clash, sing-box, or universal base64-encoded share links. All deliver the same servers in different syntaxes; never paste subscription links containing credentials into third-party conversion websites.

• Clash Meta (Mihomo) core clients—Clash Verge, FlClash, Mihomo Party, Clash Nyanpasu, ClashX Meta, OpenClash: support SS, VMess, VLESS (including Reality), Trojan, Hysteria2, TUIC, and WireGuard.
• Legacy Clash and Clash for Windows: abandoned cores that recognise only older SS, VMess, and Trojan protocols, lacking VLESS, Hysteria2, and TUIC. Users should migrate to modern Mihomo-based apps.
• sing-box core clients—sing-box official apps, Hiddify, Karing, NekoBox: offer the most exhaustive support for modern protocols including Hysteria2, TUIC, NaiveProxy, and ShadowTLS.
• Shadowrocket (iOS, paid): supports virtually all mainstream protocols, importing both individual share links and Clash subscriptions.
• v2rayN (Windows) and v2rayNG (Android): rooted in the Xray core with prime support for VMess, VLESS, Trojan, and SS, with newer releases adding Hysteria2.
• Stash (iOS / macOS): accepts Clash subscriptions and supports Hysteria2, TUIC, and Snell.
• Surge, Quantumult X, and Loon: each uses tailored syntax with supported protocols detailed in respective release notes; providers typically supply dedicated formats.

• Home broadband without UDP filtering and buffering evening video: choose Hysteria2 first, then TUIC.
• Workplace, campus, or hotel networks where UDP is restricted or Hysteria2 fails: switch to Trojan or VLESS (Reality / TLS) running over TCP 443.
• Mobile cellular data, conserving battery, or light web browsing: lightweight SS or VLESS is ideal.
• When all nodes time out: check that your device clock is synchronised (crucial for VMess), refresh your subscription, and test nodes using an alternative protocol.
• Sluggish speeds are rarely just protocol issues: the underlying transit route (direct, relay, or dedicated lines) influences speed far more than protocol differences. Switch nodes or regions before switching protocols.
• To avoid manual tuning: choose a comprehensive VPN service where client configurations and routing are handled for you.

LeoTun is a full-featured VPN service sharing a single account across six connection methods rather than a standalone proxy provider, but our Traffic Camouflage method provides subscription links using the Hysteria2 protocol. After logging in, tap any region flag on the Traffic Camouflage page to view subscriptions formatted for sing-box (Hiddify, sing-box, Karing), Clash (Clash Meta, Clash Verge, FlClash, Stash), or hysteria2 share links (NekoBox, Shadowrocket, v2rayN). Import instructions are in How to Import Subscription Links.

When visiting networks that block UDP where Hysteria2 cannot connect, switch your account to Cisco AnyConnect over TLS or use the browser-only Web Proxy. Dedicated routes use OpenVPN, and the Private Network runs on WireGuard. Protocol details are compared in VPN Protocols Compared, with selection advice in Which Connection Method Fits Your Needs.