Hysteria2 vs VLESS Reality: A Deep Comparison

Why New Protocols Emerged

The history of proxy protocols is essentially an ongoing cat-and-mouse game. Shadowsocks launched in 2012, using lightweight symmetric encryption to obscure traffic in a way that made it hard to distinguish from normal HTTPS. But as network-level traffic analysis and machine-learning classifiers became more sophisticated, Shadowsocks traffic became easier to fingerprint, its stability under heavy load declined, and active probing attacks made it easy to expose on networks with aggressive filtering.

VMess, introduced by the V2Ray project in 2016, was the next step forward: it supported WebSocket over TLS (WS+TLS), disguising traffic as ordinary HTTPS that's hard to block outright — short of blocking port 443 entirely, which comes with too much collateral damage to be practical. But WS+TLS adds TLS handshake latency, which hurts on lossy long-distance connections (think trans-Pacific links, or peak-hour congestion), and TLS on its own doesn't hide which site you're actually connecting to.

To address these limitations, the community introduced two protocols with very different design philosophies between 2022 and 2023: Hysteria2 and VLESS Reality. Both are natively supported by the Clash.Meta (Mihomo) core and fully implemented in Clash Plus. Understanding how they differ can help you make a smarter choice when picking a plan from a proxy provider or setting up your own server.

Hysteria2 Explained

Hysteria2 (Hy2 for short) is built on top of the QUIC protocol. QUIC was originally developed by Google and became the transport layer underlying HTTP/3 in 2021 (RFC 9000), and it's now widely deployed by services like YouTube, Google Search, and Cloudflare.

QUIC runs over UDP and bakes in TLS 1.3 encryption, stream multiplexing, and 0-RTT reconnection. Traditional TCP triggers congestion control whenever it detects packet loss, pausing the entire connection to wait for retransmission — but QUIC's multiple streams are independent of each other, so packet loss on one stream doesn't stall the rest. That's a significant advantage on lossy long-haul connections.

Hysteria2 layers a custom congestion-control algorithm (a BBR variant) on top of QUIC, along with a "Brutal" bandwidth strategy that keeps throughput close to its configured ceiling even when packet loss hits 30% or higher. In real-world testing, Hy2 consistently outperforms traditional TCP-based protocols during peak-congestion hours (roughly 8–11pm local time).

Hy2's main weakness: UDP traffic gets blocked or heavily throttled on some hotel, university, and corporate networks, since those environments often only allow TCP port 443 through. QUIC traffic also has a slightly different fingerprint from ordinary HTTPS, which means it can be specifically targeted on networks with unusually aggressive filtering.

VLESS Reality Explained

VLESS Reality takes a completely different approach from Hysteria2 — its core goal is "zero fingerprint": making proxy traffic indistinguishable from a real website's TLS traffic, even under deep packet inspection (DPI).

Traditional TLS-based proxy setups (WS+TLS, gRPC+TLS) share a fundamental problem: the server's TLS certificate is either self-signed or issued by a minor CA, and lacks the SCT (Certificate Transparency) records that a real website would have — something active probing can detect. Reality gets around this by "borrowing" the TLS certificate and handshake parameters of a real, well-known site (Microsoft, Google, Cloudflare, and similar), so the proxy server's TLS handshake looks byte-for-byte identical to a real visit to that site. Even capturing packets with Wireshark won't reveal any difference between the proxy server and an ordinary HTTPS server.

VLESS Reality runs over TCP, so it's unaffected by UDP blocking and has the best compatibility across restrictive networks. The trade-off is that it's bound by TCP's congestion control, so it can't match Hysteria2's throughput on lossy connections — a single connection's ceiling is largely determined by underlying TCP performance, with limited room to optimize further.

Head-to-Head Comparison

Which Should You Choose?

Choose Hysteria2 if: your network doesn't block UDP and your connection to the server has relatively high packet loss (long-distance links, peak-hour congestion). If your main priority is download speed and streaming (4K/8K video, large file transfers), Hysteria2's throughput advantage is significant — on the same server, it typically runs 20–50% faster than VLESS Reality at full tilt.

Choose VLESS Reality if: you're on a network that restricts UDP (a corporate network, campus Wi-Fi, or certain hotel networks); or you care most about staying under the radar and want your proxy traffic to be as inconspicuous as possible; or your provider simply doesn't offer Hysteria2 nodes. For situations where inconspicuousness matters most, VLESS Reality is widely considered the strongest option available today.

Use both: Good proxy providers typically offer both Hysteria2 and VLESS Reality nodes. The best practice is to let Clash's "Auto Select" policy group include nodes of both protocols, letting latency tests decide which one gets used at any given time. That way you get Hysteria2's speed on unrestricted networks and automatically fall back to Reality for reliability on restrictive ones.

Benchmark Data

The numbers below come from a US-based test server over a residential broadband connection, measured on a weekday evening around 9pm (peak-congestion hours). Treat this as a rough reference only — actual results vary considerably depending on your ISP, time of day, and server location.

Final Thoughts

Hysteria2 and VLESS Reality represent two different directions in proxy protocol design: one optimized for raw transfer performance, the other for near-perfect traffic disguise. They're not really competitors — they're complementary tools suited to different situations.

For most everyday users, the easiest approach is to pick a provider that offers both protocols and let Clash Plus's auto-speed-test feature handle the rest. The Mihomo core behind Clash Plus has an optimized native implementation of both, so whichever one you end up using, the client-side experience stays consistent and reliable.

As network filtering techniques keep evolving, proxy protocols keep evolving right alongside them. Following the release notes for the Mihomo (formerly Clash.Meta) and Xray projects is the most direct way to stay on top of what's coming next.