SS vs VMess vs Trojan vs Hysteria2: which to use
What actually differs between the five common proxy protocols, where each one wins, and why you should keep two different kinds on hand rather than picking a favourite.
Day to day, your client handles all of this. Two situations make it worth knowing anyway: when one protocol stops working, and when choosing a provider.
The whole thing in one table
| Protocol | Transport | Disguise | Overhead | Under packet loss | Where it stands |
|---|---|---|---|---|---|
| Shadowsocks | TCP | Weak | Lowest | Poor | Veteran; still good for low latency |
| VMess | TCP | Medium | Medium | Poor | Legacy; works, not a first choice |
| VLESS + Reality | TCP | Strongest | Low | Poor | The current recommendation |
| Trojan | TCP | Strong | Low | Poor | Dependable, widely supported |
| Hysteria2 | UDP/QUIC | Medium | Medium | Best | The answer on bad connections |
| TUIC | UDP/QUIC | Medium | Medium | Good | Similar to Hysteria2 |
One at a time
Shadowsocks — oldest, not obsolete
Strengths: lowest overhead, lowest latency, broadest client support, simplest configuration — four parameters and you are done.
Weakness: bare SS has a relatively distinctive signature and gets targeted on networks doing deep inspection.
Use it for:
- Getting around ordinary network restrictions (corporate, campus) where nothing is inspecting deeply
- Old hardware — a Raspberry Pi or an ageing router cannot handle heavier protocols
- Latency-sensitive work such as gaming
- Anywhere the network environment is relaxed
VMess — the middle generation
Strengths: complete feature set, multiple transports (tcp/ws/grpc), mature ecosystem.
Weaknesses:
- Signature well studied at this point
- Clock-sensitive — two minutes of skew and the handshake fails
- Carries its own encryption layer, which is redundant alongside TLS
Use it for: whatever you already have. Vmess is still common among free nodes for historical reasons.
Always paired with ws + tls; bare vmess is a waste of time. See Free V2Ray nodes.
VLESS + Reality — the current best answer
What new deployments choose.
VLESS strips VMess's own encryption and leaves it to TLS, lowering overhead.
The real advance is Reality: instead of presenting its own certificate, it borrows a genuine website's TLS handshake. What an observer sees is indistinguishable from a visit to that real site.
Strengths: best disguise available, good performance. Weaknesses: more involved to configure; older clients may not support it.
Trojan — the low-drama option
How it works: presents as ordinary HTTPS on port 443. The handshake is close enough to a normal website visit that blocking it means damaging legitimate traffic.
Strengths: stable, near-universal client support, simple configuration. Weaknesses: needs a real domain and certificate; disguise is slightly behind Reality.
My view: the one that causes the fewest problems. Not the most impressive on paper, rarely the source of a bad evening.
Hysteria2 — when the line is bad
How it works: built on QUIC (UDP), with its own congestion control and forward error correction.
The problem it solves: TCP responds to loss with retransmission and congestion backoff, and throughput collapses. Hysteria2 absorbs a few dropped packets and keeps going.
Where it wins big:
| Situation | Why |
|---|---|
| Residential peak hours | Many home lines hit 3–10% loss in the evening |
| Mobile networks | Much higher loss than fixed lines |
| Mediocre long-haul routes | More hops, more chances to drop |
Measured on the same server during an 8% loss window: TCP-based protocols managed 3 Mbps, Hysteria2 held above 40.
Where it fails:
- The network restricts UDP. Some campus and corporate networks block it entirely.
- UDP is being actively disrupted at that moment.
- Significant clock skew also causes trouble.
TUIC — same family
Also QUIC-based, similar reasoning. In practice close enough to Hysteria2 that you should just use whichever your provider offers.
By situation
Browsing and AI tools
Trojan or VLESS+Reality. Stability above everything; AI tools break badly on dropped connections.
And pin the node manually rather than letting a group auto-switch — reasoning in Using ChatGPT over a free VPN.
Video
Depends on your line:
- Clean (under 1% loss) → anything; bandwidth is the limit
- Lossy at peak → Hysteria2, and the difference is obvious
Gaming
Latency and jitter, not bandwidth.
- Shadowsocks (lowest overhead)
- Or Hysteria2 if your line drops packets
Make sure the node config has udp: true, or game traffic will not pass.
Routers and transparent proxies
Trojan or SS, because router CPUs are weak and overhead matters.
Hysteria2's encryption can outrun a low-powered device before it saturates the link.
Heavily inspected networks
VLESS + Reality. Best disguise currently available.
Keep two kinds
Have one TCP-based node and one UDP-based node available at all times.
They fail for different reasons:
- When TCP-based protocols get targeted, UDP-based ones may still pass
- When UDP is restricted — campus networks, certain hours — the TCP ones keep working
My client holds:
- Primary: a Trojan or VLESS node
- Backup: a Hysteria2 node
- Fallback: a handful of free nodes, assorted protocols
Switching takes a second, which beats hunting for a replacement mid-task.
When choosing a provider, prefer one supporting several protocols — a single-protocol service is a single point of failure. More on that in Luobo Cloud after three months.
If you want one sentence
Check that your provider offers Hysteria2 and either VLESS or Trojan. Beyond that, let the client deal with it.
Read next
- Free V2Ray nodes: decoding a vmess link
- sing-box setup
- How to actually test a free node
- Luobo Cloud after three months
Questions people keep asking
Which protocol is fastest?
None of them, in general. On a healthy connection the differences are small and the bottleneck is server bandwidth. On a lossy connection, QUIC-based protocols like Hysteria2 pull ahead substantially, because forward error correction means a few dropped packets do not collapse throughput.
Which is hardest to detect?
VLESS with Reality, currently. It borrows a real website's TLS handshake, so there is almost nothing distinctive to fingerprint. Trojan is close behind, presenting as ordinary HTTPS. Bare Shadowsocks and VMess have more recognisable signatures.
Why will my Hysteria2 node not connect?
Usually because your network restricts UDP, which is what QUIC runs on. Some campus and corporate networks block it outright, and it is disrupted at certain times on others. Test by trying a TCP-based node from the same provider; if that works and Hysteria2 does not, UDP is your problem.
Do I need to understand this to use a subscription?
No. A subscription and a modern client handle it for you. Knowing a little helps in two situations: when one protocol stops working and you need to know what to switch to, and when choosing a provider and deciding what to look for.