Hysteria 2 is not a VPN provider - it is free, MIT-licensed proxy software you deploy on your own server, and this dossier treats it that way: there is no company, no subscription, no support desk and no audit trail, just code and a protocol specification. Built on QUIC/HTTP3 with a custom 'Brutal' congestion control that holds a fixed user-declared rate even through heavy packet loss, it has become one of the most used censorship-circumvention protocols for China, Iran and Russia, with 22.8k GitHub stars and first-class support in sing-box, Surge and a long list of third-party apps. Its censorship story is strong on paper: the server masquerades as an ordinary HTTP/3 website and even answers unauthenticated probes like one, which sing-box's own compatibility table rates as active-probe resistant. But the counter-move is documented and it targets the transport, not the protocol: Russia's TSPU blocked wholesale QUIC traffic from 2022 and later SNI-filters it, the GFW began decrypting QUIC Initial packets at scale from April 7, 2024 (per the USENIX Security 2025 paper that notes even Hysteria's own project domain is on the QUIC blocklist), and Iranian ISPs were already blocking 'unknown' UDP protocols in 2022. Brutal is also ethically contentious: it deliberately ignores congestion signals and sends faster under loss, which a rival developer (Xray-core) warns can get the VPS or ISP to restrict your traffic. If you can run a server and your network leaves UDP alone, it is arguably the fastest honest tool in the category; if UDP is squeezed where you are, it fails like every other QUIC proxy.
open source4 red flagsfacts verified - operator site (hysteria.network home, protocol spec, 3rd-party apps, changelog), GitHub repos (apernet/hysteria, apernet/tcp-brutal) and developer profile, sing-box + Surge third-party protocol docs, gfw.report USENIX Security 2025 paper page, net4people/bbs issues #181 and #425, HN Algolia thread index + full comment tree, and r/VPN archive all fetched live 2026-11-03. Note: arctic-shift Reddit search was rate-limited (422/429 'Too many requests') on repeat queries during this session; the one successful body=hysteria query returned 200 and its comments are cited below.
Security-fix history is real, not marketing: v2.8.2 fixed a server OOM crash from crafted QUIC packets when sniffing was enabled; v2.9.2 (labeled 'important security fixes... strongly encourage everyone to upgrade') fixed UDP packets bypassing ACL, an ACL bypass via trailing dots in domains, and another server OOM via incomplete/oversized HTTP requests - fixed quickly, but self-hosters who skip upgrades wear the risk alone
The GFW blocks Hysteria's own project domain: the USENIX Security 2025 QUIC-SNI paper notes 'Hysteria faces a situation where not only its main project domain v2.hysteria.network is blocked, but users' custom [server domains too]' - the project homepage being on a censorship blocklist is itself telling about how the tool is classified
Brutal's loss-compensation mechanism is documented in Hysteria's own config docs as sending faster than the set rate under loss; deployed at scale on rented VPS space it is the behavior most likely to trigger provider abuse controls (Xray-core developer's warning on net4people #425)
+1 more red flags - expand before signing up
No audit exists (as of 2026-11-03) - trust rests entirely on open code and community scrutiny
Review
draft generated by Qwen3, fact-checked by the vpncomparison editorial desk · review version 2 · prose updated 2026-11-03 · facts as of 2026-11-03 · how we verify
Honesty note: we have not run our own tests on Hysteria2 (QUIC/UDP-based censorship-resistant proxy) yet (leak tests, speed, kill switch). Everything on this page is source-based meta-research with dated links. When we test it, results appear here and on the change log.
Overview
Hysteria2 (QUIC/UDP-based censorship-resistant proxy) homepage - live capture 2026-09-29
Hysteria2 is not a VPN provider but a free, open-source, self-hosted proxy tool built on QUIC/HTTP3 for users in censored regions. It’s maintained by a volunteer community led by an anonymous developer ("Toby") under the MIT license. You run it on your own VPS - there’s no central service, no subscription, and no support. The real cost is your hosting bill, not a software fee.
Logging & privacy
There is no central logging claim because there is no operator - logging depends entirely on how you configure your own server. The software is open source (MIT), so server behavior is auditable, but no third-party security audit of the codebase exists as of 2026. The protocol mimics standard HTTP/3 traffic to unauthenticated clients, reducing detection risk. Jurisdiction is irrelevant: no legal entity exists, and the lead developer uses a fictional location (40 Eridani) on GitHub.
Pricing & the renewal trap
Hysteria2 itself is free - no intro or renewal pricing applies. The real cost is your VPS, typically $4-6/month. The derived renewal ratio is 1 (same monthly cost), and the three-year cash total is not applicable - money goes to your hosting provider, not Hysteria. No refunds, contracts, or billing cycles exist. You can pay for VPS anonymously using crypto, but Hysteria collects nothing.
Hysteria2 uses QUIC with obfuscation (Salamander, Gecko, Chrome fingerprinting), port hopping, and ECH to resist detection. It supports SOCKS5, HTTP, TProxy, and TUN modes across Windows, Mac, Linux, Android, iOS (via Surge), and routers. No multihop, kill switch, or split tunneling is built in. P2P is supported; streaming is not a design goal. Performance relies on its "Brutal" congestion control, which maintains fixed speeds under loss - but risks triggering VPS abuse limits.
Ownership & track record
Hysteria is community-driven, led by anonymous developer Toby (GitHub: tobyxdd). No corporate owner exists. Security fixes are prompt - v2.8.2 and v2.9.2 patched OOM crashes and ACL bypasses - but self-hosters bear full responsibility for updates. The GFW blocks its domain (v2.hysteria.network), and Russian and Iranian networks actively target QUIC. No audit exists, so trust rests on code transparency and community scrutiny.
Censorship resistance
Hysteria2 is designed for high-censorship environments like China, Iran, and Russia, using HTTP/3 masquerading, Salamander obfuscation, and port hopping. It resists passive detection and active probes per sing-box’s compatibility table. However, the GFW now decrypts QUIC Initial packets (since April 2024), and Russia blocks QUIC wholesale. If your network blocks UDP/QUIC, Hysteria2 will fail - despite its strong design, it’s not magic.
Verdict
Hysteria2 is a top-tier censorship-circumvention tool for technical users who can self-host on a VPS and accept full responsibility for setup, updates, and risk. It’s fast, stealthy, and widely trusted - but fails where UDP/QUIC is blocked. No affiliate trail exists: Hysteria pays no review sites, and no one profits from its promotion.
++ What holds up
Genuinely free and open source (MIT, PROTOCOL.md spec published) - the only cost is your own VPS, roughly USD 5/month
Designed for exactly the networks where WireGuard/OpenVPN die: Brutal congestion control holds target speed on high-loss, high-latency links (the sing-box docs call Brutal 'the selling point')
HTTP/3 masquerading with reverse-proxy mode: unauthenticated visitors see a working web server - rated active-probe resistant in sing-box's own protocol comparison table
Huge ecosystem: supported by sing-box, Surge (iOS/Mac), and dozens of third-party clients listed in official docs; cross-platform builds everywhere
Documented, disciplined development: changelog shows rapid security fixes (2.8.2 server OOM fix, 2.9.2 ACL-bypass fixes) and anti-censorship features landing continuously (ECH, Chrome parroting, port hopping, Realms NAT traversal)
Developer engages publicly with censorship researchers on net4people/bbs and shipped counter-moves (obfs off, alpn h3, faketcp) in response to measured blocking
-- What to watch
UDP is the Achilles heel: QUIC-based proxies are the documented target of Russia's QUIC blocking (2022+), China's QUIC SNI censorship (April 2024, USENIX Security 2025), and Iran's blocking of 'unknown' UDP protocols (2022)
You are the operator: every log, IP reputation problem and legal exposure of the server is yours; dirty VPS IP ranges are a leading cause of connection failure (net4people Iran thread)
Brutal congestion control deliberately misbehaves - it does not back off on loss and compensates by sending faster, which can congest shared links and, per the Xray-core developer, invite VPS/ISP restrictions
The official install script (bash <(curl -fsSL https://get.hy2.sh/)) drew HN criticism as a curl-piped-to-root pattern; security-minded users pin it to a commit hash or build from source
No company, no support, no third-party audit, no kill switch or consumer app features - everything beyond the protocol depends on third-party clients
The 'custom QUIC' is closer to standard than the README implies (RFC 9000 + RFC 9221), but HN reviewers still flag trust friction with a China-diaspora-authored project installing via piped shell scripts
Pricing reality check
Intro price
$5 /mo · renews $5/mo
Renewal price
$5/mo
Notes
No vendor price exists: the software is free and MIT-licensed. The real cost is renting your own VPS to run the server (entry tiers at major hosts run roughly USD 4-6/month) plus optionally a domain name for automatic ACME TLS certificates. Community voices describe the model plainly: 'you can buy a VPS and deploy one of these protocols by yourself' (HN).
none - there is no account or signup anywhere; authentication is a password you set on your own server
Apps
windows, mac, linux, android, ios (via third-party apps such as Surge), router (cross-platform Go builds for every major platform and architecture)
Check the renewal price above before any multi-year plan - true-cost calculator.
Is Hysteria2 legit?
Legal domicile: none - Hysteria is not a company; it is MIT-licensed open-source software (Go) developed by a volunteer community around lead developer 'Toby' (GitHub: tobyxdd), with the repo on GitHub and docs at hysteria.network. Logging claim: No central logging claim exists or is possible - there is no Hysteria operator. Hysteria ships a Traffic Stats API that an operator can enable to count users' traffic, so logging is entirely whatever the person running the server configures. - evidence class: no logging claim at all. No incidents on file in our research - absence of evidence is not proof of innocence. Facts verified - operator site (hysteria.network home, protocol spec, 3rd-party apps, changelog), GitHub repos (apernet/hysteria, apernet/tcp-brutal) and developer profile, sing-box + Surge third-party protocol docs, gfw.report USENIX Security 2025 paper page, net4people/bbs issues #181 and #425, HN Algolia thread index + full comment tree, and r/VPN archive all fetched live 2026-11-03. Note: arctic-shift Reddit search was rate-limited (422/429 'Too many requests') on repeat queries during this session; the one successful body=hysteria query returned 200 and its comments are cited below. (not fully verified) as of 2026-11-03 - read the sources below.
The money trail - what review sites earn by recommending this
affiliate status not verified yet
If we sign up for this program, every link here becomes rel="nofollow sponsored" and routes through /go/. Until then our links point straight to the provider's website with zero tracking. Ranking logic physically cannot read affiliate fields - here is the proof.
On the website
Captured by our screenshot bot from the live site (or its public archive). A capture is evidence of what the page showed at capture time - not an endorsement.
Hysteria2 (QUIC/UDP-based censorship-resistant proxy) homepage - live capture 2026-09-29Hysteria2 (QUIC/UDP-based censorship-resistant proxy) apps / download page - live capture 2026-09-29
Before you pay: check the renewal price, the refund window, and whether a cheaper or free path covers your use case - the honest checklist.
Is Hysteria2 (QUIC/UDP-based censorship-resistant proxy) legit?
Based on our checks as of 2026-11-03: Hysteria2 (QUIC/UDP-based censorship-resistant proxy) scores 4.3/10 in our weighted review. We logged 4 red flags (listed above). User reports, ownership and the incident record are documented with dated sources in the meta-review below.
What do I actually get for the price?
You get free, open-source software - no account, no fee. You must rent your own VPS (~$5/month) and configure the server yourself using the official install script and config.
What is the renewal price and total cost over three years?
There is no renewal price - Hysteria2 is free. The derived renewal monthly equivalent is $5, reflecting typical VPS costs. The three-year cash total is not applicable - costs depend on your hosting provider.
What evidence supports the no-logs claim?
There is no vendor to log - logging is whatever your server config allows. The code is open (MIT), but no third-party audit exists. Trust comes from transparency, not certification.
Does it work in heavily censored countries like China or Iran?
It can, but with caveats: the GFW now decrypts QUIC, and Iran/Russia block UDP/QUIC. Success depends on your server’s location, domain, and whether your network allows QUIC traffic.
Can I pay anonymously?
Yes - Hysteria2 requires no payment. Your VPS provider may accept crypto, and no KYC is needed to use the software. Your anonymity depends on your hosting choice.
What happens if the project shuts down?
Nothing - since it’s self-hosted and open source, your instance keeps running. Development continues on GitHub (22.8k stars), and the protocol is embedded in clients like sing-box and Surge.
What’s the honest free or cheap alternative?
Shadowsocks or Trojan for TCP-based stealth; TUIC for another QUIC option. For non-technical users, consider a reputable, audited, independent VPN - but expect higher cost and less control.
The meta-review: what the internet says about Hysteria2 (QUIC/UDP-based censorship-resistant proxy)
We do not expect you to trust us. This review is a meta-review: below you see what other review sites claim - with their conflicts of interest labeled - what users report on Reddit and forums, and who actually operates Hysteria2 (QUIC/UDP-based censorship-resistant proxy). Every claim links to its source so you can verify it yourself.
What other reviewers say (3)
Every source carries a conflict label from our review-site database. "Affiliate-funded" means the site earns money if you buy what it recommends. We include critical voices deliberately.
Fetched 2026-11-03 (HTTP 200): independent multi-protocol client's documentation - 'Hysteria 2 is a simple, Chinese-made protocol based on QUIC. The selling point is Brutal, a congestion control algorithm that tries to achieve a user-defined bandwidth despite packet loss.' Warning: 'Even though GFW rarely blocks UDP-based proxies, such protocols actually have far more obvious characteristics than TCP based proxies.' Compatibility table rates hysteria.network spec: resists passive detection = alert; resists active probes = check.
Fetched 2026-11-03 (HTTP 200): commercial iOS/Mac proxy app ships native Hysteria 2 support (iOS 5.8.0+, Mac 5.4.0+): 'a proxy protocol built on QUIC, designed for high throughput on lossy networks. It always encrypts traffic with TLS over QUIC and supports both TCP and UDP relay with connection multiplexing'; parameters include port hopping and Salamander/Gecko obfuscation - evidence of mainstream client adoption.
Fetched 2026-11-03 (HTTP 200): a commercial VPN provider adding Hysteria 2 as its 8th protocol; country-by-country assessment: China 'partially blocked' (such protocols often have more obvious characteristics than TCP-based proxies), Iran 'partially blocked' (previously blocked outbound QUIC temporarily), Russia 'mostly available' (HTTP/3 not very stable but works well); notes Salamander mode breaks the plain-HTTP/3 camouflage; interview with the Hysteria lead developer announced.
What users say (5)
Reddit, forums, HN - paraphrased and linked, never quoted out of context. Anecdotes, not proof - but refund complaints and leak reports are the best early-warning system this market has.
Fetched 2026-11-03 (HTTP 200): Iranian users document Hysteria/TUIC UDP connections being selectively dropped (Ncat packets pass on the same port, Hysteria packets do not; working IPs eventually blocked too); net4people's wkrp concludes 'dynamic protocol detection, not IP blocking'; Hysteria's developer tobyxdd participates: Iranian ISPs 'may be blocking all unknown UDP protocols, including non-HTTP/3 QUIC', suggests alpn=h3 on UDP 443 or faketcp, and previews the HTTP/3-masquerade design that became Hysteria 2.
Fetched 2026-11-03 (HTTP 200): the ecosystem's own state-of-the-field thread; Xray-core developer RPRX ranks methods and says QUIC-class proxies like Hysteria 'have been reported to be blocked on a large scale, but are currently basically available', warning aggressive packet sending invites VPS/ISP restrictions; a user reports port hopping delays but does not prevent whole-IP blocking for UDP gaming.
Fetched 2026-11-03 (HTTP 200): relevant hits - 'VPN ban is strangling communication in Myanmar' (renonce comment, 2024), 'Ask HN: The government of my country blocked VPN access' (2025, Hysteria2/TUIC named as the QUIC generation), 'Quad9 to exit France' (2026, own-your-chain comment citing Hysteria2), 'GitHub permanently banned my account for using Actions to validate VPN nodes' (2026, Hysteria2-based Russian client), 'Show HN: MoaV - Mother of all VPNs' (2026, Hysteria2 in a multi-protocol circumvention stack). Earlier generic 'hysteria' searches return mostly unrelated words, hence the precise query.
Fetched 2026-11-03 (HTTP 200): full comment tree - China field reports (works well as shadowsocks alternative; single-IP traffic eventually blocked), install-script security debate (curl|bash criticism and commit-hash pinning), protocol-scrutiny (standard RFC 9000 + RFC 9221 + custom congestion control), Tor-pluggable-transport question, TikTok-ban use case.
Fetched 2026-11-03 (HTTP 200 via curl): recent r/VPN comments naming Hysteria - a step-by-step self-host install guide (June 2026), 'Trojan and Hysteria work better... VLESS kinda falls behind' on Russia censorship (May 2026), 'for now I'm looking at Hysteria' in an Iran config thread (April 2026). Repeat queries during this session were rate-limited (422/429 'Too many requests'/'Timeout') - r/dumbclub was not usable for the same reason.
AI fact summary - everything we know, compressed
Generated by Qwen3 on 2026-11-03 from our fact database plus the linked sources. It summarizes - it does not add facts. Check anything that matters against the linked sources.
Bottom line: Hysteria2 is not a service but free, open-source software you self-host on a VPS. There is no subscription, no provider, and no support - just code. You pay only for the VPS (typically $4-6/month), but you must manage setup, security, and blocking risks yourself.
The logging truth: There is no central logging because there is no operator - logging depends entirely on your server configuration. The code is MIT-licensed and auditable, but no independent audit has been published. Jurisdiction is irrelevant: the project has no legal entity, and the lead developer (Toby, GitHub: tobyxdd) remains anonymous.
Pricing reality: There is no pricing from the project - Hysteria2 is free. You pay your VPS provider monthly (around $5), with no intro discounts or renewal traps. The cost is purely infrastructure; donations to the developer are optional.
What reviewers say vs what users say: Reviewers (e.g., sing-box docs) note Hysteria2 resists active probes but has "far more obvious characteristics" than TCP tools, making it detectable. Users on Reddit and HN confirm it works in Russia and China, but field reports show IP blocks after port hopping fails. Conflict: commercial providers (e.g., Xeovo blog) call it "mostly available," while technical users report transient success and eventual blocking.
Who runs it: Hysteria2 is developed and maintained by a volunteer community led by Toby (GitHub: tobyxdd), with no corporate backing. The project operates under no legal entity, hosted on GitHub under the HyNetworks org, and funded by GitHub Sponsors.
Sources & how this review was built
Every external source used on this page, with the date we fetched it and its evidence class [A]-[D] (A = primary/operator, B = serious press/research, C = community, D = our own measurements). Methodology: how we verify. Sources disappear or change - if a link is dead, tell us via contact.
Evidence classes on this page:[A] A: 7[B] B: 6[C] C: 5[D] D: 0(D stays empty until our own test phase)
A censorship-unblocking tool that now wears nonprofit clothes: Lantern's parent became the 501(c)(3) Brave New Software Project and the site now reads like a…
A DNS-layer filtering service that has grown up in public: born January-April 2021 out of the Windscribe team (same three founders, spun out precisely because…
open source
intro $3 /mo
Canada - CONTROLD, Inc., Toronto, Ontario; operator about-us page states 'Founded in 2021 - Toronto, Canada' and site footer reads '2026 CONTROLD, Inc.'; free-dns FAQ calls it 'based in Toronto, Canada... the sister company of Windscribe'privacy tool 9 d ago
The mainstream default of DNS-level filtering, with a genuinely honest scoping the operator itself states plainly: AdGuard DNS sits at the resolver - it…
open source
intro $2.49 /mo
Cyprus - operator is Adguard Software Limited, registered in Limassol, Cyprus (privacy policy and about page, both fetched live); the parent AdGuard company was founded in Moscow, Russia in 2009 and later moved its headquarters to Cyprus (Wikipedia)privacy tool 9 d ago
No comments yet - be the first. Posting runs a short proof-of-work in your browser (anti-spam), no account needed.