Hysteria2 vs VLESS Reality: which protocol to use

Hysteria2 and VLESS Reality are two of the connection modes in Colitu. They are built for different conditions, and the practical difference comes down to one choice: the transport underneath. Hysteria2 runs over UDP, VLESS Reality over TCP. This guide explains what that means for speed, for restrictive networks and for what an observer sees, and when each one is the better pick.

#Hysteria2 in brief

Hysteria2 is a proxy protocol built on QUIC, the UDP-based transport that HTTP/3 uses. The handshake is standard TLS 1.3 and the server presents a valid certificate. Inside the connection the app authenticates with an HTTP/3 request, so a request without credentials is answered like an ordinary web server would answer it. Each TCP connection from your device gets its own QUIC stream, and UDP traffic such as calls, games and DNS travels as QUIC datagrams.

#VLESS Reality in brief

VLESS Reality combines VLESS, a minimal proxy protocol, with Reality, a TLS 1.3 layer that needs no certificate of its own. The app starts a handshake that carries the name of a real third-party website and imitates a Chrome fingerprint. A small authentication block is hidden inside the ClientHello. If it is valid, the server completes the handshake itself and the tunnel starts. If it is not, the connection is relayed byte for byte to the real website. Colitu also enables XTLS Vision, which reduces the "TLS inside TLS" pattern that nested HTTPS creates.

#Transport: UDP with QUIC against TCP with TLS

This is the core difference.

• Hysteria2 uses QUIC over UDP. Streams inside one connection are independent, so a lost packet in one stream does not hold up the others.
• VLESS Reality uses TCP with TLS 1.3. It is a single ordered byte stream, the same kind of connection a browser opens to any HTTPS site.

Neither is better in every situation. They suit different networks.

#Speed on lossy links

Classic TCP congestion control reads every lost packet as a sign that the path is overloaded and slows down. On mobile data, crowded Wi-Fi or a long international route, packets are often lost for other reasons, such as interference or a weak signal. TCP then slows down when it does not need to and recovers slowly.

Hysteria2 ships its own congestion control, called Brutal. When the available bandwidth is known it keeps sending at that rate and compensates for loss by retransmitting. Without a configured bandwidth it falls back to BBR, which estimates the bandwidth instead of reacting to each lost packet. The result is steadier throughput on lossy links. Calls and games also benefit, because UDP traffic travels as datagrams.

VLESS Reality behaves like any TCP protocol. On a stable wired or Wi-Fi connection with little loss it performs well and Vision keeps the overhead low. On a link with heavy loss it slows down, and Hysteria2 is usually faster there.

#When UDP is limited on a network

Some corporate, hotel, campus and mobile networks restrict UDP or QUIC. Where that happens, Hysteria2 cannot connect or runs slowly. VLESS Reality is the stronger choice there, because it runs over TCP and works wherever ordinary HTTPS works.

The same holds for networks that treat QUIC to unfamiliar addresses differently from TCP. The guide UDP blocked: what it means for your VPN goes through the reasons and what to do about them.

#How each looks on the wire

• Hysteria2 looks like HTTP/3 to a site with a valid certificate. A passive observer sees QUIC traffic, and a probe without credentials gets the answer of a normal web server.
• VLESS Reality looks like a TLS 1.3 handshake with a real third-party website, with a browser-like fingerprint. A probe without the key is relayed to that website and sees its real certificate and pages.

Both are designed so that the connection resembles ordinary web traffic. They differ in how: one through a certificate of its own and HTTP/3, the other by borrowing a real site's handshake.

#Side by side

#So which one should you use?

• Phone on mobile data, busy or distant Wi-Fi, long routes, calls and games: Hysteria2.
• A network that limits UDP or QUIC, or where Hysteria2 does not connect: VLESS Reality.
• A stable connection with little loss: either works well.

Keep in mind that no technique carries a permanent guarantee. Networks change, and what works today on one network may behave differently tomorrow. That is the reason to avoid tying yourself to one protocol.

#Colitu picks for you

You do not have to choose. Adaptive Connect, the automatic mode in every Colitu app, tries the connection modes in a fixed order and checks that real traffic flows before it keeps one.

Hysteria2 comes first on every platform, because when UDP gets through it copes best with packet loss. If UDP is limited, the handshake fails or the tunnel carries nothing, the app moves on. On Android and iOS, VLESS Reality is the next mode, followed by VLESS XHTTP, Trojan and Shadowsocks 2022. On Windows and Linux the app tries the TCP modes in order of their measured connect time. A mode that carried nothing is pushed back, so the next connection does not waste time on it.

Every mode is encrypted, so switching never means falling back to an unencrypted connection. The details of each are on the Protocol Hub pages for Hysteria2, VLESS Reality and Adaptive Connect.

#Sources

• Hysteria 2 documentation
• Project X (Xray) documentation
• REALITY on GitHub
• RFC 9000: QUIC, a UDP-based multiplexed and secure transport
• RFC 8446: The Transport Layer Security (TLS) protocol version 1.3