Key takeaways
- Hysteria2 rides QUIC, the UDP transport behind HTTP/3, so to network equipment it looks like ordinary web traffic.
- Its party trick is speed on bad networks. Custom congestion control keeps throughput high on lossy hotel Wi-Fi and throttled mobile links where TCP-based protocols choke themselves.
- The catch is UDP. Networks that block unfamiliar UDP kill it outright, so it needs a TCP fallback like VLESS Reality beside it. Very few commercial VPNs ship either.
Hysteria2 is a VPN protocol built on QUIC, the UDP transport that carries HTTP/3. That one design choice produces both of its selling points. To the equipment between you and the server, its traffic resembles ordinary HTTP/3. And because it does not lean on TCP, it stays fast on exactly the networks where everything else falls apart.
Fast where it counts: bad networks
On clean home fibre, every modern protocol is quick and the differences are noise. The gap opens on ugly links: hotel Wi-Fi at 11pm, an oversubscribed mobile tower, a long international route shedding packets the whole way. TCP treats every lost packet as a congestion signal and throttles itself. That reflex is polite on a healthy network and disastrous on a lossy one, and every protocol carried over TCP inherits it, so your connection crawls at a fraction of what the line can actually deliver.
Hysteria2 replaces the reflex. It ships its own congestion control, tuned to hold throughput through loss instead of surrendering to it. The practical effect: connections that stay usable on networks where a TCP tunnel drops to a trickle. If you have ever watched a VPN turn hotel Wi-Fi from bad to unusable, this is the protocol aimed at you.
It blends in with the web
QUIC already carries a big slice of everyday traffic. Google, YouTube and most Cloudflare-fronted sites speak HTTP/3. A DPI filter that wants to kill Hysteria2 on sight risks breaking normal browsing along with it, so many filters let it pass. That is why it sits next to VLESS Reality in serious anti-censorship setups, including the ones that still work in China.
The honest limit: it rides UDP
Camouflage does not help against a blunt instrument. Some hostile networks skip the fingerprinting and throttle or drop unfamiliar UDP wholesale, while TCP sails through. Corporate firewalls do this, and so do some national ones. On those networks Hysteria2 dies along with everything else on UDP.
The fallback is a stealth protocol on TCP port 443, which is exactly what VLESS Reality is. The two travel together for a reason: Hysteria2 for speed wherever UDP flows, Reality for the stubborn networks that kill it. A provider that ships only one has solved half the problem.
VPN suddenly dead on one specific network? It is usually this UDP problem, not your account. Switch protocols before you email support. Our blocked-on-Wi-Fi guide walks through the diagnosis.
Hysteria2 vs WireGuard vs VLESS Reality
| Hysteria2 | WireGuard | VLESS Reality | |
|---|---|---|---|
| Transport | UDP (QUIC) | UDP | TCP, usually port 443 |
| Looks like | Ordinary HTTP/3 | Recognisable WireGuard packets | A real site’s TLS handshake |
| Strong point | Holds speed on lossy, throttled links | Raw speed and battery life on clean networks | Survives networks that kill unknown UDP |
| Weak point | Dies where UDP is blocked | Fingerprinted and dropped by DPI | TCP pays a speed tax on long, lossy routes |
The longer tour of each is in our protocols guide. For the two stealth siblings specifically, the most detailed side-by-side we know of is VPNBaron’s own Hysteria2 vs VLESS Reality page, which includes a per-country picker and a straight FAQ.
Who actually offers it
Mostly nobody commercial. Hysteria2 lives in self-hosted land: a sing-box or Xray config on a VPS you rent, or an Amnezia-style server you stand up yourself. Self-hosting works, but you become your own support desk, and a lone VPS IP is trivial for a censor to block once it gets noticed.
If you want a VPN with Hysteria2 and no homework, the list gets short fast. VPNBaron is the rare provider that ships it natively in its own Windows, macOS, iOS and Android apps, next to VLESS Reality and IKEv2. Its Pathfinder feature tries routes automatically, so when a network kills UDP the app falls back to Reality without you touching anything. Pricing is $8.99 month-to-month or an effective $3.49/mo on the yearly plan, renewal priced the same, 5 devices, and a 7-day money-back window to test it on your actual worst network. We rate it 9.7, currently our #1, and the protocol stack is a large part of why.