Hysteria2’s performance depends on UDP reachability, packet-loss patterns, and bandwidth settings—not simply on choosing a different Type. This guide is for Shadowrocket users who already have service details. Learn how QUIC handles reliable delivery and congestion control, check the parameters, import your configuration, and use consistent tests to see whether it suits your network.
1. QUIC Uses UDP, but Still Provides Reliable Delivery
Hysteria2 uses QUIC to carry proxy traffic. UDP sends datagrams but does not provide ordered delivery, retransmission, or connection state. QUIC adds encrypted connections, loss recovery, flow control, and multiplexing. Data that needs reliable delivery is still acknowledged and retransmitted, so it is not simply “fast because lost data is ignored.”
QUIC uses TLS 1.3 to establish secure connections and supports multiple independent reliable streams. If one stream is waiting for lost data, other streams do not have to stop because of a gap in the same transport-layer byte sequence. However, streams still share network capacity and congestion state, and data within each stream is still delivered in order. Multiplexing mitigates a specific form of head-of-line blocking; it does not eliminate all waiting.
- Transport basics: The server must be able to receive UDP traffic on the specified port. A reachable TCP port does not mean UDP is available on that same port.
- Security basics: QUIC’s encrypted handshake still requires the correct server identity and certificate verification. Do not skip verification instead of checking the settings.
- Application mapping: Hysteria2 can carry TCP connections and UDP traffic, but the two types of traffic are handled differently for reliability. This does not mean all UDP data becomes a reliable stream.
Port
443is a common configuration example, not a Hysteria2 requirement. Use the port specified by your existing service. Being able to open a regular HTTPS website does not prove that UDP 443 is reachable.
2. Why It Can Be Faster on Lossy or High-Latency Networks
Throughput depends on more than protocol overhead; it also depends on how the sender detects congestion. Congestion controls that rely heavily on packet loss may treat random losses caused by wireless interference as a reason to slow down, even when congestion is not the cause. Hysteria2’s Brutal congestion-control approach adjusts sending based on a target bandwidth and delivery feedback, which can reduce throughput drops caused by random loss. The control method actually used also depends on the implementation, configuration, and negotiation between both sides.
This approach does not mean sending without limits. Setting a target bandwidth above the network’s actual capacity can increase queueing, packet loss, and competition with other connections, and may make browsing less responsive. High-latency networks also need enough data in flight to fill the link, but no protocol can shorten physical distance or guarantee an uncongested server uplink.
| Network conditions | What to expect | What to check first |
|---|---|---|
| UDP is reachable, with random packet loss | May sustain throughput better than transport methods that back off readily in response to packet loss | Whether sustained throughput and interactive latency both improve |
| High round-trip latency | May improve bandwidth utilization, but first-visit latency is still affected by round-trip time | Record time to first byte and large-file speed separately |
| UDP is restricted or dropped | Handshake timeouts or severe speed limits after transfer begins | Compare Wi-Fi with a cellular connection |
| Low latency and low packet loss | The benefit may be less noticeable, with other bottlenecks more likely to dominate | Server load, destination website, and local bandwidth |
Here is an example of the relationship between bandwidth and latency: with 50 Mbps of available bandwidth and a 100 ms round-trip time, the bandwidth-delay product is about 0.625 MB. This is the approximate amount of data that needs to be in flight to sustain that bandwidth—not a speed guarantee after entering the settings. Keep the units straight: 50 Mbps is a theoretical byte rate of about 6.25 MB/s, before transmission overhead.
Takeaway: Check UDP Reachability First
Test the same existing Hysteria2 configuration on two access networks. If it consistently times out on only one, investigate that network’s UDP path first instead of repeatedly increasing the bandwidth setting.
3. What You Need Before Adding Hysteria2
This guide assumes you already have service details from your provider. Use the complete configuration supplied by the service first; if adding it manually, check each field against the original details. Do not assume Hysteria2 and older protocol types are interchangeable because their names look similar, and do not copy passwords or obfuscation settings from an older configuration into a new entry.
| Setting | What to enter | Common mistake |
|---|---|---|
Type | Select Hysteria2 | Selecting the wrong protocol type |
| Server address | The domain name or IP address provided for your existing service | Pasting the entire share link into the address field |
| Port | The UDP port the server actually listens on, such as 443 | Guessing from a website’s port or copying the example |
| Authentication | Copy the complete authentication value provided by the service | Omitting a symbol, adding spaces, or splitting the value yourself |
SNI | The name matching the server’s certificate configuration | Connecting by IP while overlooking the domain required by the certificate |
| Obfuscation settings | Enter the type and password as required only if obfuscation is enabled on the server | Treating the authentication password and obfuscation password as the same field |
| Upload and download bandwidth | If the interface provides this setting, check the units and use a realistic value | Confusing Mbps with MB/s or entering a value far above actual capacity |
The table explains what each setting means; field names and available options depend on the current Shadowrocket interface. The connection address and SNI can differ: the former determines where to connect, while the latter is used for TLS name negotiation and certificate identity checks. If you see a certificate error, check the name, device time, and server certificate status instead of disabling verification.
-
Check the source
Confirm that your existing service provides Hysteria2 settings or a compatible subscription, and keep the original details so you can revert changes. Do not show authentication values in public screenshots.
-
Choose an entry method
To add an entry manually, go to Home → tap “+” in the top-right → Type → Hysteria2. To import an existing subscription, go to Home → tap “+” in the top-right → Type → Subscribe.
-
Enter the details and save
For a manual entry, check the address, port, authentication, and TLS details one by one. For Subscribe, enter your own subscription URL and save it, then return to Home, update it, and check the type of the generated entries.
-
Allow the connection and test it
On Home, select the entry you want and turn on the connection. When prompted the first time, allow the system to add a VPN configuration. Then test website access and sustained transfers separately; do not rely on latency alone.
4. Global Routing Determines Whether Traffic Uses the Selected Entry
Correct protocol settings do not guarantee that test traffic is routed through Hysteria2. After selecting an entry on Home, check Global Routing as well. Everyday rule-based routing and temporary troubleshooting have different goals: first confirm the connection works, then verify which rules match. This helps avoid mistaking a routing issue for a protocol performance issue.
Config
RecommendedRouting follows the rules in the current configuration. Requests matching DIRECT connect directly; requests matching a proxy policy are forwarded according to the selected policy. Unmatched requests are handled by fallback settings such as FINAL, which does not guarantee a direct connection.
Best for: everyday use and checking rule-based routing
Proxy
Send requests covered by proxy routing through the proxy path. This can help temporarily rule out destination-based routing as a source of interference. During testing, also confirm that the selected policy points to the intended Hysteria2 entry, not another option.
Best for: briefly isolating rule-related factors and checking whether the connection works
Direct
This uses a direct connection path and cannot show whether Hysteria2 is working. If Direct opens a website but the proxy path fails, that only shows the two paths have different results; check authentication, UDP reachability, and server status.
Best for: establishing a direct-connection baseline
These are examples of rule syntax used in a configuration, not required performance optimizations. DOMAIN-SUFFIX matches a domain and its subdomains. Rules are checked in order, and FINAL handles requests that did not match earlier rules. Add rule snippets to the relevant rules section in Config; do not paste them into the server address or subscription URL field.
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTIf you need a consistent connection state for speed tests, check Settings → On Demand first. Note and temporarily disable any existing automatic triggers, then restore them after testing. Do not change the entry, rules, and trigger conditions at the same time during a comparison.
5. Use a Consistent Test Sequence to Compare Speed and Stability
The latency shown on Home reflects the response under that specific test method. A low latency result does not prove that sustained authenticated transfers, DNS resolution, and access to the destination website are all working. For a fair comparison, use the same device, destination resource, and similar time of day, changing only one variable at a time.
- Record a baseline: Note whether you are using Wi-Fi or cellular, the selected entry, Global Routing, and whether On Demand is enabled.
- Check access: Open a page you know should be accessible and note any DNS resolution failures, handshake timeouts, or certificate errors. Do not group different errors together as “slow speed.”
- Check sustained transfers: Use a consistent test resource of your own for about 60 seconds. Record the sustained rate, any interruptions, and whether page interactions become noticeably slower during the transfer.
- Switch access networks: Keep the entry and configuration unchanged, switch between Wi-Fi and cellular, and repeat the test three times on each. Keep cellular data usage in mind.
- Check consistency: An occasional improvement is not enough to establish a protocol advantage. If the same network consistently times out while another consistently works, investigate access-network restrictions first.
These numbers describe a test procedure, not a performance claim. There is no universal packet-loss percentage above which a protocol is guaranteed to be faster. Results depend on where loss occurs, whether it comes in bursts, round-trip latency, available bandwidth, and server load. Faster sustained transfers alongside noticeably slower interactions should not be considered an overall improvement.
Takeaway: Keep Improvements You Can Reproduce
Keep the current settings only if repeated tests under consistent conditions show more stable transfers without noticeably worse everyday interactions. Otherwise, restore the original values and check the bandwidth settings or network path separately.
6. Common Connection and Import Issues
Still timing out after entering 443?
Go back to Home, edit the entry, and check the port specified by the service instead of assuming it is 443. Then switch access networks without changing the configuration. If HTTPS websites work, that only confirms the relevant TCP path; it does not establish UDP reachability.
Latency looks fine, but websites will not load. What should I check?
First check Home → Global Routing and the currently selected entry. If needed, use Proxy briefly to isolate rule-related issues. If only domain names fail, check DNS resolution. For TLS errors, check SNI, device time, and the certificate. Do not keep switching protocols based on latency alone.
Imported a subscription, but there is no Hysteria2 entry?
Update the subscription on Home, then check whether its response includes Hysteria2 and whether the current app supports the relevant fields. An existing subscription may return only other protocol types; changing the display name will not convert them. Ask the service provider to verify the format of your existing configuration.
Does entering a higher bandwidth value make downloads faster?
No. Record the original value, check the units shown in the interface, and adjust it based on the bandwidth actually available. Change one setting at a time and repeat the test. If a higher value increases latency, causes more packet loss, or noticeably slows other pages, restore the original value rather than increasing it further.
The authentication password is correct. Why am I still getting an error?
Go back to Home and edit the entry. Check for extra spaces or line breaks in the copied value, and verify the authentication and obfuscation passwords separately. If obfuscation is enabled on the server, both sides must use matching types and passwords. A subscription update may overwrite the entry, so check the actual settings again after updating.
Manage the app purchase separately from connection services. Shadowrocket is a closed-source commercial app sold as a one-time purchase; buying the app does not include a connection plan. This guide explains how to use service details you already have and does not provide, sell, or recommend connection services. Shadowrocket is available only on Apple platforms, primarily for iPhone and iPad. The App Store is the only way to get it; check the App Store page for system requirements and general purchase eligibility.