XHTTP transport

XHTTP VPN: VLESS Over HTTP With REALITY

XHTTP is ProofKit's stealth TCP transport: VLESS over an HTTP-shaped transport with REALITY camouflage. It splits upload and download into separate padded HTTP request/response transactions, so the flow looks like a browser hitting a website rather than one long tunnel.

XHTTP VPNVLESS XHTTPREALITY over HTTPCDN VPNbehavioral DPI VPN
Protocol
VLESS Reality
Route
Direct or 2-hop
Payment
TON · pay/GB
Escrow
Non-custodial

01 /Beats behavioral DPI that plain Reality can trip

Reality hides the TLS handshake, but a raw Reality-TCP tunnel is one long constant bidirectional flow that L4 behavioral analysis can flag. XHTTP splits the upload and download into separate padded HTTP request and response transactions, so the traffic pattern looks like a browser loading a site instead of a continuous tunnel.

02 /TCP-survivable and CDN-frontable

Because it is literally HTTP-shaped, XHTTP works where UDP or QUIC is throttled or blocked, and it can ride a content delivery network the way an ordinary HTTP site does. That makes it a strong stealth default on networks where QUIC-based transports get squeezed.

03 /The SNI is on the wire, so it stays regional

Unlike Hysteria2, XHTTP's SNI is visible because it is REALITY's cleartext camouflage. ProofKit nodes therefore use a high-traffic, same-region camouflage domain so the handshake blends with normal local HTTPS, rather than pointing at a foreign domain that a censor might throttle.

04 /Native per-user billing, same escrow

XHTTP is VLESS, so per-user byte counters populate natively and traffic bills cleanly per GB, just like Reality. It uses the same non-custodial TON escrow, the same optional 2-hop routing through an entry node, and no monthly subscription. Connect with an Xray-core client such as Happ or v2rayNG.

// faq

Common questions

What does XHTTP add over VLESS Reality?

Plain Reality-TCP is one long flow that behavioral DPI can flag. XHTTP wraps VLESS in HTTP-shaped, padded request/response transactions so it looks like browser traffic, while keeping REALITY's handshake camouflage. It is also TCP-survivable and can be fronted by a CDN.

Does XHTTP hide the SNI?

No. XHTTP's SNI is on the wire as REALITY's camouflage, so ProofKit nodes pick a high-traffic, same-region domain to blend in. If you specifically need the SNI hidden, Hysteria2 with Salamander obfuscates the whole packet instead.

Which client supports XHTTP?

An Xray-core based client such as Happ, v2rayNG, or v2rayN. Import your ProofKit subscription and the client can select XHTTP when it is the best working transport for the route.

Is XHTTP billed the same way?

Yes. XHTTP bills per-GB through non-custodial TON escrow exactly like the other transports, with the same optional 2-hop routing and withdrawable unused balance.

// ready to try it

Browse XHTTP-capable nodes

Pick a route by country, price, uptime, and proof status. Pay only for traffic you actually use. Unused TON balance is withdrawable from the escrow, subject to pending charges.

~/proofkit — quick start
$ proofkit auth --wallet
→ signed in as UQAv4F…D9Q
$ proofkit connect --auto
→ session live · 0.0046 TON/GB
proof sha256:c0a4e1ad…b7f9