Hysteria2 Protocol Guide: Why QUIC Is Fast and When to Use It

1. Hysteria2 and QUIC: What Makes It Fast?

Hysteria2 is a proxy protocol, not a service plan or a bandwidth boost switch. Shadowrocket, the client, uses server details, credentials, and transport settings you already have to establish a connection. Performance still depends on your local network, the carrier route, server load, and available outbound bandwidth.

QUIC runs over UDP and provides encryption, reliable delivery, flow control, and congestion control. UDP does not mean that “nothing is retransmitted”: when Hysteria2 proxies TCP connections, QUIC streams provide reliable delivery. Proxied UDP datagrams use different transport semantics, so the two should not be conflated.

With ordered delivery over a traditional TCP connection, later data may have to wait for lost data to be retransmitted. QUIC separates delivery across streams, so packet loss in one stream does not necessarily block ordered delivery in another. A stream still has to wait for missing data, and all streams share the same link capacity and congestion conditions. So it is inaccurate to say that “QUIC eliminates head-of-line blocking entirely.”

QUIC’s handshake can also reduce some connection setup overhead, but first-time connections, session resumption, and real-world network paths differ. Theoretical handshake benefits do not translate into a fixed percentage improvement in page load speed, and connection latency is not the same as sustained download speed.

2. Congestion Control and Bandwidth Settings: Bigger Isn’t Always Faster

Packet loss can come from wireless interference or queue congestion. Both can look like lost data to a client, but they call for different sending behavior. One notable feature of Hysteria2 is its bandwidth-target-driven Brutal congestion control. The protocol also supports bandwidth negotiation and other congestion-control paths, so not every connection sends data in the same way.

When a connection uses the relevant bandwidth settings, the sender adjusts transmission based on the target rate and packet loss. On links with random packet loss, this may make better use of available bandwidth than treating every lost packet as a sign of congestion. But if the link is already congested, an overly high target can increase queueing, retransmissions, and latency for other traffic.

• Upload: From the client-to-server perspective, enter the upload bandwidth required by your existing configuration. Don’t copy the download speed from your broadband plan.
• Download: From the client’s receiving perspective, set a rate based on the download capacity your network can sustain, not its short-lived peak.
• Units: Follow the units shown for the field. 20 Mbps is about 2.5 MB/s in decimal units; actual throughput is lower due to protocol overhead.
• Server limits: The server may cap bandwidth or change how it negotiates settings. Entering a higher value in the client won’t remove an outbound bandwidth limit on the server.

3. Use Cases: Mobile Networks, Packet Loss, and Battery Trade-offs

Mobile signal fluctuations, changing cell tower loads, and wireless retransmissions can make available bandwidth vary constantly. Hysteria2 may be worth testing where UDP is allowed, packet loss is intermittent, and spare capacity remains. The protocol itself cannot work around blocked or heavily rate-limited UDP, or a network that requires sign-in before connecting.

When switching from Wi-Fi to cellular, QUIC’s connection IDs and path validation can help handle address changes. Whether a session stays active also depends on the implementation, system network state, and server support. Reconnection may still occur, so “supports QUIC” does not mean every app session will stay uninterrupted.

• Remote file transfers: Watch sustained throughput and retries. A high short-term peak with frequent interruptions may not suit the task.
• Voice and interactive use: Watch latency variation and packet loss. An ongoing download that saturates the uplink can make interactive use feel sluggish.
• Stable wired networks with little packet loss: Switching protocols may not make a noticeable difference if the current connection is already stable. Compare results for the same destination at the same time.
• Restricted Wi-Fi: Complete network sign-in first, then confirm the server’s UDP port is reachable. TCP 443 being available does not mean UDP 443 is available too.

Battery use depends on the workload. Encryption, user-space transport processing, retransmissions, and sustained wireless transmission can all increase processor and radio activity. On the other hand, finishing a task sooner may reduce the time the device stays active. There is no blanket rule that Hysteria2 always uses more or less power. Compare completion time, device temperature, and battery usage records under the same network conditions, similar screen brightness, and with the same file size.

4. Shadowrocket Settings and What to Enter

In Shadowrocket, Home is where you select a connection and check its status, Config manages rule configurations, and Settings contains app settings. Before entering details manually, confirm that the information you have is for Hysteria2; an older Hysteria configuration is not automatically interchangeable. Field visibility and grouping vary by platform. The table below explains the parameters to check.

TLS verification confirms the identity of the server you connect to. If you connect by IP address but the certificate was issued for a domain, first check the correct SNI and certificate chain rather than treating certificate verification off as a routine fix. Authentication failures, certificate errors, and blocked UDP are different problems; changing the password won’t fix a blocked port.

5. Import Existing Details and Verify the Connection

Start with configuration details you already have and understand. This site does not provide, sell, or recommend proxy servers or subscriptions. A subscription URL is used to update configuration; it is not a server address. For example, https://example.com/sub?token=xxxx is a fictitious format example and cannot be used to connect. Treat credentials in links as sensitive: don’t share screenshots or paste them into public discussions.

1. Check your details

   Confirm the protocol is Hysteria2, and note the Server, Port, authentication value, SNI, and whether Obfs is enabled. If the bandwidth units aren’t specified, check with the service provider you already use.

2. Add a connection

   To add a connection manually, go to Home → tap “+” in the upper-right corner → Add Server, choose Hysteria2 under Type, and fill in each field. If you use an existing subscription, follow its import instructions and choose Subscribe; don’t enter the subscription URL as the Server.

3. Select and connect

   After saving, return to Home, select the item you just added, and turn on the connection. If the system asks for permission to add a VPN configuration, check the app name and confirm, then see whether the connection is established.

4. Check routing

   Under Global Routing, check whether the current mode is Config, Proxy, Direct, or Scene. For an initial test, you can temporarily use Proxy, then restore your usual configuration. This helps avoid mistaking requests that actually went Direct for a protocol failure.

5. Test again and restore settings

   Check page loading, sustained transfers, and brief interactive tasks separately. If you need to control the test period manually, review the triggers under Settings → On Demand to avoid automatic connections affecting your observations. Restore the original settings after testing.

Items imported through a subscription may change when updated. Before making manual edits, record the original values. After an update, check SNI, port, and bandwidth settings again. Seeing an item with the same name in the list does not mean its configuration is unchanged.

6. Compare Global Routing Modes to Separate Protocol and Rule Issues

The protocol determines how data is transported to the server; routing determines where a request is handled. An active Hysteria2 connection does not mean every request uses it. These comparisons explain Shadowrocket’s own settings. Which mode to use day to day still depends on whether the rules and policies in your existing configuration are correct.

In Config, DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP address ranges, GEOIP matches against an IP geolocation database, and FINAL specifies the final policy for requests that didn’t match earlier rules. Rule order affects which policy matches. If performance differs from expectations, check which policy actually matched before changing Hysteria2 settings.

7. Troubleshooting Timeouts, Authentication Failures, and Speed Fluctuations

Troubleshoot in order: establish the connection first, check request routing next, then tune speed. Changing the port, SNI, password, and bandwidth all at once makes comparisons meaningless. The observations below are diagnostic clues, not made-up benchmark results; no single symptom is enough to identify a cause with certainty.

• Times out after waiting: Check the Server and UDP Port, make sure Wi-Fi sign-in is complete, and compare the same configuration on another known-working network. A TCP port test alone does not prove that UDP is reachable.
• Certificate-related error: Check the device’s time, SNI, and server certificate chain. Successful domain resolution does not mean certificate verification has passed.
• Authentication failure reported: Check the full authentication value, spaces, and the result of any subscription update. If Obfs is enabled, confirm that the settings match on both ends.
• Connected, but a specific site fails: Check Global Routing and the matching rule first, then check destination resolution and the server’s ability to reach it. A successful protocol connection proves only that one part of the route is working.
• Fast downloads but laggy interaction: Stop other high-traffic tasks, lower the bandwidth target, and repeat the same test. Check whether latency fluctuations settle down.
• Wi-Fi works, but cellular doesn’t: Compare UDP reachability, signal strength, and network paths. Don’t assume a failure on one network means the password is wrong.