Hysteria2 Explained: Why It Is Fast on Bad Networks

Hysteria2 is the newest big name in NPV Tunnel's protocol list. If you have a shaky Wi-Fi, a long-distance link or a congested network, it may feel dramatically faster than the alternatives. Here is why.

Built on QUIC

Hysteria2 is a TCP and UDP proxy that runs on QUIC (the same transport that powers HTTP/3). It carries your data using QUIC streams and datagrams. By design it looks like HTTP/3 traffic: the client authenticates with an HTTP/3 request, and a client that fails authentication receives a normal web-server style response instead of an error, so probing does not reveal a proxy.

Brutal congestion control

Most connections slow down when they sense packet loss, assuming the network is congested. On a link that loses packets for reasons that are not congestion (poor wireless, throttling, long distance), that behaviour is a handicap. Hysteria's Brutal algorithm sends at a rate you declare regardless of perceived loss, and the server can use the standard BBR algorithm when no bandwidth is declared.

The flip side is real: declare more bandwidth than your connection can actually support and you will cause congestion and an unstable link. If your config has up and down speed fields, set them honestly, slightly below what a speed test shows.

Salamander obfuscation

Some networks block QUIC specifically. Hysteria2 offers an optional Salamander layer that scrambles each packet with a key derived from a shared password, so it no longer looks like QUIC. It only helps if the network blocks QUIC but allows other UDP. If the obfuscation password does not match the server's, you will see a plain timeout, which is easy to mistake for a dead server.

When to choose Hysteria2

• High packet loss or a long distance to the server.
• Streaming and downloads over a throttled link.
• Networks that allow UDP.

When not to

• Networks that block UDP altogether. Use a TCP-based protocol such as VLESS or Trojan.
• Cases where you cannot tell your real bandwidth.

Troubleshooting

1. Timeout: check the obfuscation password and port.
2. Connected but slow: lower the declared bandwidth.
3. Works on mobile data but not Wi-Fi: the Wi-Fi may block UDP/QUIC.

Compare with the others in VLESS vs VMess vs Trojan, or return to all protocols.

Hysteria2 versus WireGuard and VLESS

Authentication and masquerade

Instead of a handshake that only a proxy would use, Hysteria2 authenticates with an HTTP/3 request. A server that receives a request without valid credentials answers like an ordinary web server, so a curious scanner sees a website, not a proxy. Behind it, the server can be set to proxy real website content to strengthen the disguise.

Ports and port hopping

Many UDP-friendly networks apply per-port limits or shape long-lived UDP flows. Hysteria2 servers can listen on a range of ports, and clients can hop between them. If your provider hands out a config with a port range, leave it as it is.

Picking sensible bandwidth numbers

If your config has Upload and Download Mbps fields, run a speed test on the network you will use (not on a different one) and enter about 80 to 90 percent of the results. Too high and the Brutal algorithm will flood your link; too low and you leave speed on the table.

Frequently asked questions

Keep reading