Home/Blog/Proxy Protocols Compared
Protocol 101Which Proxy Protocol Should You Use? Shadowsocks vs. VMess vs. Trojan vs. Hysteria2
Node names are often followed by a protocol name, but plenty of people never actually figure out which protocol their subscription is using, or what the differences even are. This article breaks the comparison down across three dimensions — encryption, censorship resistance, and speed — to help you understand why the same provider often offers nodes running several different protocols at once.
Why Are There So Many Protocols?
At their core, every proxy protocol is solving the same problem: encrypt and disguise your network traffic, send it to a server to be forwarded onward, and try not to get flagged as "proxy traffic" along the way.
Network censorship technology keeps improving too, and older protocols' encryption signatures gradually get recognized, which is why the community keeps designing new protocols to fight traffic fingerprinting — that's the evolutionary path from Shadowsocks all the way to Hysteria2. Once you understand this "arms race" backdrop, it becomes clear why no single protocol is "the best" forever.
Shadowsocks (SS): The Veteran Lightweight Protocol
The earliest encrypted proxy protocol to become widely popular, designed to be simple, fast, and cheap to implement — nearly every client and platform supports it natively.
Pros
- Extremely lightweight, with minimal encryption/decryption overhead — fast
- The most mature ecosystem, with the most server/client implementations
- Simple to configure: just
password + cipher + port
Cons
- Relatively fixed traffic signature, which can be flagged under stricter censorship regimes
- No traffic disguise built in by default (though it can be paired with an
obfsplugin for obfuscation)
If censorship pressure on your network isn't heavy and you care mainly about speed and stability, Shadowsocks is still a very solid, cost-effective choice.
VMess: The Core Protocol of the V2Ray Ecosystem
Proposed by the V2Ray project, VMess builds on Shadowsocks by adding identity verification (a UUID) and more flexible transport-layer wrapping — it can be layered over WebSocket, gRPC, and other transports, then stacked with TLS encryption to further disguise itself as ordinary HTTPS website traffic.
VMess itself is an "inner protocol" — its actual censorship resistance depends heavily on which outer transport you pair it with. The same VMess, run bare over TCP versus wrapped in WebSocket + TLS, behaves very differently.
The downside is a relatively larger set of configuration options (transport type, path, TLS domain, etc. all have to line up correctly), which means more room for mistakes — it fits people willing to spend time getting the config right in exchange for stronger resistance to detection.
Trojan: Disguised as HTTPS
Trojan takes a more "aggressive" design approach: it disguises itself directly as a standard HTTPS service — the TLS handshake and certificate are both genuinely valid — so its traffic signature is almost indistinguishable from visiting a normal website, making it hard for censorship systems to flag based on traffic pattern alone.
- Requires a real domain and a valid certificate (a free Let's Encrypt certificate works fine)
- Simple protocol design, with lower performance overhead than VMess's more complex transport wrapping
- Because it "just looks like a website," it tends to perform well against censorship in many scenarios
For end users, configuring a Trojan node is usually simpler than VMess too — most of the complexity lives on the server setup side, while the client only needs an address, password, and domain.
Hysteria2: A New Generation Built on QUIC
The protocols above are mostly TCP-based, while Hysteria2 is a new-generation protocol built on QUIC (UDP), focused on solving two problems: resilience on poor/high-packet-loss networks, and the speed gains from a more aggressive congestion-control approach.
| Trait | Traditional TCP-based Protocols | Hysteria2 |
|---|---|---|
| Transport layer | TCP | QUIC (UDP) |
| Behavior on poor networks | Costly retransmits on packet loss, prone to stuttering | Built-in congestion control tuning — smoother on poor networks |
| Common restrictions | Rarely throttled | Some networks throttle UDP specifically — worth checking |
If your network isn't friendly to UDP (some public Wi-Fi and corporate networks restrict it), Hysteria2's speed advantage may never materialize — in that case, switching back to a TCP-based protocol is actually more reliable.
Obfuscation & Extra Encryption: Adding Another Layer of Disguise
Beyond the protocol design itself, many implementations also support stacking an extra layer of obfuscation or encryption on top, to further reduce the odds of detection:
obfs plugin
- Commonly paired with Shadowsocks, dressing traffic up to look like an ordinary HTTP/TLS handshake
- Adds a bit of processing overhead, but effectively reduces the odds of getting caught by simple traffic-fingerprinting rules
REALITY / XTLS
- A newer censorship-resistance scheme that borrows a real website's TLS certificate handshake for disguise — nearly indistinguishable from normal traffic to that site
- Demands more from the server-side setup, but generally rated as one of the strongest options against detection in the community right now
This kind of "protocol + obfuscation" combo is usually pre-configured server-side by your subscription provider. As an end user, all you really need to know is: "seeing a name like REALITY or XTLS most likely means extra censorship-resistance has been layered on top of the base protocol" — you don't need to configure any of it yourself.
How to Choose: 3 Practical Rules of Thumb
- First, see what your subscription actually offers — the protocol is decided by your provider, so in most cases you're "picking a node," not "picking a protocol." Don't overthink this part.
- Speed-first and your network is UDP-friendly: go with Hysteria2. Speed-first but UDP is restricted: Shadowsocks is usually the least hassle.
- Heavily censored network: prefer Trojan or a TLS-wrapped VMess, trading a bit of speed for stronger censorship resistance.
In your Clash config, nodes on different protocols can live in the same proxy-groups — pair that with url-test auto latency testing and let the client automatically pick whichever is currently fastest, so you don't have to agonize over "which protocol is the right one."
If you're capable of running your own server (rather than relying entirely on a subscription provider), you can flip this logic around: deploy Trojan or a REALITY-based setup as your daily driver for the best balance of speed and censorship resistance, then keep one or two Hysteria2 nodes on hand as backup for poor-network conditions. Think of the two as complementary rather than trying to pick one single "best" answer.