What Is Hysteria2 in Shadowrocket? How QUIC Transport Works and Which Networks It Suits

What Hysteria2, QUIC, and UDP each do

In short: Hysteria2 uses QUIC to establish a transport channel between the client and server, and QUIC packets are sent over UDP. UDP is the underlying transport; that does not mean all application data is sent unreliably. QUIC can provide encryption, acknowledgments, loss recovery, and reliable streams over UDP.

The connection to a website and the proxy transport channel are separate layers. For example, a website request may use TCP while the outer connection from Shadowrocket to a Hysteria2 server uses QUIC. When troubleshooting a firewall or server port, check the UDP transport—not just whether the TCP port with the same number is open.

QUIC streams can progress independently: a lost packet on one stream usually does not block data already received on other streams. This reduces cross-stream head-of-line blocking, but missing data within a reliable stream still needs to be recovered, and all streams still share the same network link. This does not mean video, web browsing, and file transfers can never affect one another.

Why it may be faster: congestion control, not UDP alone

In short: Hysteria2's advantage on some high-loss links comes from its congestion control and sending strategy—not because “UDP is inherently faster than TCP.” Packet loss may result from congestion, wireless interference, or other random loss. If all loss is treated as congestion and the sending rate is cut sharply, available bandwidth may go unused.

Hysteria2's Brutal congestion control adjusts sending behavior based on the configured bandwidth target and observed loss. It may trade more data sent over the network for higher useful throughput. In configurations that support bandwidth negotiation, results depend on the client's declared receive capacity, server limits, and the path's actual capacity. Some setups may also use congestion control such as BBR, so the protocol name alone does not tell you which mode a connection is using.

• Noticeable random packet loss, with capacity still available: A sending strategy that compensates for loss may help maintain throughput, but confirm this with repeated tests using the same task.
• Actual outbound congestion: Sending more data may worsen queueing, making web pages respond more slowly during file transfers.
• Low packet loss and stable latency: Protocol differences may not be the main bottleneck; server load, available bandwidth, and the destination website can still determine speed.
• UDP is blocked or heavily rate-limited: The transport may fail to establish or may only sustain very low throughput. Changing the bandwidth value cannot remove network restrictions.

Bandwidth settings also involve units. Mbps means megabits per second, while MB/s means megabytes per second. In decimal units, 80 Mbps has a theoretical maximum of about 10 MB/s; actual application data rates are lower because of protocol overhead and retransmissions. Follow the units shown by the app, and don't copy a number from a file transfer tool without checking its units.

Hysteria2 settings to check in Shadowrocket

In short: Map all the information from your server to the app before changing performance settings. Hysteria2 and the older Hysteria protocol are not interchangeable by simply changing the name; after importing, confirm that Type is set to Hysteria2. The table below explains the settings—it is not configuration syntax to paste into Config.

The connection address routes data to the server. SNI supplies the server name during the TLS handshake and is commonly used when checking the certificate name. They can differ, but both must come from trusted configuration instructions. If you see a certificate error, check the name, device time, and server certificate status rather than disabling verification.

• Field names, available options, and advanced settings depend on what the app currently displays. If your subscription does not include an optional setting, that does not mean you should add a value yourself.
• For an existing subscription, update it first to get corrected settings. Before making manual changes, note the original values so you can distinguish them from settings applied by the next update.
• When sharing troubleshooting details, include the error type and setting names only. Redact authentication strings, tokens in subscription URLs, and related passwords.

Import and first test: confirm the connection before checking rules

In short: Import and select the server in Home, then verify the connection with a single test request. Home manages servers and connection status, Config manages rule sets, and Settings manages app preferences. Separating transport failures from rule-selection issues helps narrow down the cause.

1. Gather the settings

   Check the server address, port, authentication details, and TLS requirements with your own service provider. If you use a subscription, make sure it actually contains a Hysteria2 entry; don't rely on its label alone to identify the protocol.

2. Import a subscription

   In Home, tap “+” in the upper-right corner, then go to Type → Subscribe. Enter your own subscription URL and save it, then update the subscription in Home. Treat any authentication token in the URL like a password.

3. Check the type

   Open the imported entry for editing and confirm Type is Hysteria2, then check the settings against the table above. To add a server manually, go to Home → “+” → Type → Hysteria2 and enter each value from your existing configuration.

4. Test the connection

   Return to Home, select the entry, and connect. Follow the system prompt to allow adding a VPN configuration. Note what happens after connecting: does it keep waiting, show a specific error, or open the test page you selected?

5. Check routing

   In Home → Global Routing, check the current mode. To temporarily isolate the effect of rules, use Proxy to test the same request, then restore the Config you normally use and check which policy the destination domain actually matches.

During the first test, also check Settings → On Demand. If On Demand is enabled, note its status. When testing disconnections or network changes, you can temporarily turn it off and restore it afterward to prevent automatic connection behavior from affecting the results. On Demand controls connection triggers; it does not fix Hysteria2 authentication, TLS, or UDP connectivity.

Use Global Routing to tell protocol issues from rule issues

In short: If the same Hysteria2 entry works in Proxy but not in Config, check rule matches and the selected policy first instead of immediately changing transport settings. The comparison below covers three modes in Global Routing for this test. Use Direct only as a baseline when the destination is normally reachable directly.

When checking rules, note that DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches address ranges, GEOIP uses an IP geolocation database, and FINAL determines the policy when no earlier rule matches. Rules are processed in order: once an earlier DIRECT or REJECT rule matches, a later proxy policy cannot change that result. DNS resolution can also affect IP-based matches.

How to troubleshoot connection failures, slow tests, and drops

In short: Check in this order: can the request reach the server, does the handshake and authentication complete, is routing correct, and is throughput limited? A single latency reading describes one kind of probe; it does not prove that UDP is reachable, authentication works, or sustained transfers are stable. Interpret a timed-out probe alongside the actual connection result.

These are troubleshooting criteria, not results from tests conducted by this site. For your own comparison, test the same file three times on the same network, observing each run for 30 seconds. Record whether it succeeds, the speed once stable, and how quickly web pages respond at the same time. Keep the test time and destination consistent to reduce misjudgments caused by caching, destination rate limits, or short-term network fluctuations.

• Change one variable per round: For example, switch between Wi-Fi and cellular in the first round, then check bandwidth settings in the next.
• Watch latency and throughput together: Higher speeds alongside noticeably slower interactions may indicate more queueing—not better settings.
• Keep an eye on data usage: Sustained transfers and retransmissions to compensate for packet loss can both use extra data. Check your plan's billing terms before testing.
• Keep reproducible notes: Record the network, selected entry, Global Routing mode, test destination, and error text. Don't share authentication details.

When Hysteria2 may help and what you need

Hysteria2 is worth testing with an existing configuration on networks where UDP is available and random packet loss or variable latency is present. If UDP is restricted, the server's outbound capacity is saturated, or the destination is rate-limited, the protocol name won't resolve the bottleneck. For regular use, consider success rate, sustained throughput, responsiveness, and data usage together—not just the single result with the lowest latency.

• Settings look complete, but the handshake fails: check UDP, TLS, and authentication before changing bandwidth values.
• The handshake succeeds, but the destination behaves unexpectedly: check Global Routing and Config rules first.
• The connection works, but speeds fluctuate: repeat the test with a fixed task and network, then assess whether congestion control fits the conditions of the link.

Shadowrocket is a closed-source commercial app primarily used on iPhone and iPad. Check the App Store product page for compatibility with Mac, Apple TV, and Apple Vision. System requirements, compatibility, and whether purchases are universal are as listed on the App Store page. The App Store is the only place to get the app. The developer is Shadow Launch Technology Limited, and the app ID is 932747118. Shadowrocket is a one-time purchase; check the store for the current price.