QUIC transport

Hysteria2 VPN With Salamander Obfuscation

Hysteria2 is ProofKit's QUIC/UDP transport. Salamander obfuscation XORs the entire QUIC packet, including the handshake that carries the SNI, so there is no clear VPN fingerprint on the wire and traffic looks like generic UDP.

Hysteria2 VPNQUIC VPNSalamander obfuscationUDP VPN DPIhy2 VPN
Protocol
VLESS Reality
Route
Direct or 2-hop
Payment
TON · pay/GB
Escrow
Non-custodial

01 /Salamander hides the whole packet

Salamander obfuscation XORs every byte of the QUIC packet, including the QUIC Initial that carries the TLS ClientHello. That means the SNI is not on the wire at all, and a censor's deep packet inspection sees random noise instead of a QUIC long-header or a recognizable VPN handshake. For DPI the SNI value does not even matter, because it is obfuscated.

02 /Best when UDP is allowed

Hysteria2 rides QUIC over UDP, so it can keep working where TCP-based transports are throttled but UDP still flows. It generally offers higher throughput with slightly higher latency than VLESS Reality. Where UDP or QUIC is throttled instead, ProofKit's TCP transports are the better fit, which is why the marketplace offers all three.

03 /Same pay-per-GB, same routes

Hysteria2 shares ProofKit's billing and routing with every other transport: pay per measured GB in non-custodial TON escrow, no monthly subscription, and optional 2-hop routing through an entry node that forwards encrypted traffic to the exit. The server uses a self-signed certificate that your client pins by SHA-256 hash.

04 /What you need to connect

Hysteria2 needs an Xray-core client such as Happ. Your subscription bundles every transport a route supports, and the client can url-test and auto-select the fastest working one. An advanced Xray JSON profile can add hands-off Reality-to-Hysteria2 failover, while a simple subscription lets the client pick on connect.

// faq

Common questions

What is Hysteria2 and how is it different from Reality?

Hysteria2 is a QUIC/UDP transport with Salamander obfuscation. VLESS Reality is a TCP transport that camouflages its handshake as ordinary HTTPS. Hysteria2 hides the SNI by obfuscating the whole packet and tends to push more throughput; Reality has the best latency and works anywhere TCP works.

Does the SNI matter for Hysteria2?

No. Salamander XORs the entire QUIC packet, so the SNI is never visible on the wire. What matters is that UDP/QUIC is not throttled and the server IP is not blocklisted. This is the opposite of plain Reality, where the SNI is the cleartext camouflage and matters a lot.

Which client do I need?

An Xray-core based client such as Happ. Import your ProofKit subscription and the client can auto-select Hysteria2 when it is the fastest working transport for the route.

Is Hysteria2 billed differently?

No. It uses the same pay-per-GB pricing, the same 2-hop options, and the same non-custodial TON escrow as every other ProofKit transport. You pay only for measured traffic and can withdraw unused balance.

// ready to try it

Browse Hysteria2-capable nodes

Pick a route by country, price, uptime, and proof status. Pay only for traffic you actually use. Unused TON balance is withdrawable from the escrow, subject to pending charges.

~/proofkit — quick start
$ proofkit auth --wallet
→ signed in as UQAv4F…D9Q
$ proofkit connect --auto
→ session live · 0.0046 TON/GB
proof sha256:c0a4e1ad…b7f9