What Is Hysteria2 and When Should You Use It?

Hysteria2 runs on QUIC instead of TCP, so it handles packet loss better than most VPN protocols do. Here is when that matters most, and when it does not.

A video call freezes the moment your train drops from LTE to 3G, recovers for ten seconds, then freezes again. Most people blame "bad signal" and move on. Often the signal is fine — it's the VPN protocol underneath falling apart, because it was never built to handle packets going missing mid-stream. Hysteria2 was built specifically for that failure mode.

What is Hysteria2?

Hysteria2 is a VPN protocol built on top of QUIC, the transport that Google originally designed to speed up HTTP traffic and that now underpins HTTP/3. QUIC itself runs over UDP, not TCP. That single design choice explains most of what Hysteria2 is good at, and where it runs into trouble.

Most older VPN protocols — OpenVPN in its common TCP mode, plenty of proxy tools — inherit TCP's habits: strict ordering, acknowledgements for every packet, and a congestion control algorithm that slows everything down the moment it sees loss. QUIC was designed after decades of watching TCP struggle on real networks, and Hysteria2 inherits QUIC's answer to that problem.

On RocketVPN, Hysteria2 is one of eight protocols available inside a single subscription, alongside WireGuard, AmneziaWG, V2Ray, OpenVPN, IKEv2/IPsec, L2TP/IPsec, and Shadowsocks. Switching between them costs nothing extra — it's a setting in your account area, not a different plan.

Why does UDP behave differently than TCP on a bad connection?

TCP treats every packet as part of one strict sequence. If packet 47 goes missing, packets 48 through 60 have to wait in a buffer until 47 is retransmitted and confirmed — even if they already arrived. On a link that's dropping packets steadily, that pause-and-retransmit cycle repeats constantly, and TCP's congestion control reacts to loss by assuming the network is overloaded and throttling itself further. The result is a connection that feels like it's stuttering: fine for a second, then stalled, then fine again.

QUIC, and Hysteria2 with it, doesn't force that same lockstep ordering. It can carry multiple independent streams over one UDP connection, so the loss of one packet doesn't stall data that has nothing to do with it. It also handles retransmission and congestion response with more current assumptions about real-world networks — mobile handoffs, satellite-style latency, Wi-Fi interference — rather than the assumptions TCP made in the 1980s. None of this means packet loss stops mattering. It means the protocol degrades more gracefully instead of cliff-diving in throughput the moment loss shows up.

Where does Hysteria2 actually help?

The scenarios line up with what a lossy, congested link actually looks like. Think of a packed mobile tower during rush hour, with your phone competing against hundreds of other devices for the same spectrum. Or a long-haul route, where your traffic crosses several countries and any single hop along the way can drop packets. Hotel and café Wi-Fi is its own category — weak signal, a dozen routers fighting over the same channel, nobody managing any of it. TCP-based tunnels visibly buckle under these conditions; QUIC-based ones tend to hold their shape better. None of it makes Hysteria2 immune to a genuinely dead connection, though — if a tower is overloaded to the point of dropping most of its traffic, no protocol fixes that, Hysteria2 included.

It's also relevant if you're connecting from abroad and routing traffic back through a distant server — for context on why people do that in the first place, see our piece on getting a Russian IP address while abroad. The longer and more congested the path, the more a loss-tolerant protocol has to work with.

What Hysteria2 is not designed to fix is a clean, stable connection that's simply being blocked or filtered by content or protocol. That's a different problem, and it's where the other protocols in the lineup earn their keep.

How does Hysteria2 compare to WireGuard, AmneziaWG, and V2Ray?

All four are UDP-based at some level, but they solve different problems. WireGuard is built for speed and simplicity — a small, modern codebase with ChaCha20 encryption that barely taxes the processor. The tradeoff is that its handshake has a recognizable pattern, so networks doing protocol fingerprinting can identify and block it specifically, even without inspecting content.

AmneziaWG takes WireGuard and wraps its packets so they don't carry that recognizable signature — to deep packet inspection, the traffic looks like generic UDP noise rather than a WireGuard handshake. It keeps WireGuard's speed while fixing the one thing that gives WireGuard away.

V2Ray takes a different approach entirely: it wraps traffic in TLS handshakes that are difficult to distinguish from an ordinary HTTPS connection to any website. It's disguise-first — the goal is to look boring and unremarkable to whatever is watching, at some cost to raw throughput.

Hysteria2 isn't primarily a disguise strategy. Its QUIC foundation happens to look like the same traffic your phone generates for video calls and modern websites, which helps in some places, but its main argument is behavioral: it keeps working when the link underneath is unreliable. That's a different axis from "does it look suspicious" — it's "does it fall over when packets go missing."

RocketVPN also includes OpenVPN, IKEv2/IPsec, L2TP/IPsec, and Shadowsocks in the same subscription, each suited to its own situation — IKEv2, for instance, is built into iOS, macOS, Windows, and most routers, so it needs no separate app and reconnects almost instantly when you switch from Wi-Fi to mobile data. L2TP still ships on virtually every device too, though it's slower than the newer options; we've written separately about which VPN providers still support L2TP if that history interests you.

Where does Hysteria2 fall short?

It isn't a universal answer, and treating it as one sets you up for disappointment.

If the network in front of you is filtering by blocking UDP traffic outright — some restrictive networks do exactly that, allowing only TCP on standard ports — Hysteria2 can perform worse than a protocol like V2Ray that rides on TLS and looks like routine HTTPS. Packet-loss tolerance doesn't help if UDP packets aren't getting through at all.

Client support is narrower, too. WireGuard and IKEv2 are supported natively or near-natively across a wide set of operating systems and routers, including some setups that work without installing a dedicated VPN app. Hysteria2 support is newer and less universal — you need a client that specifically implements it, and not every router firmware or older device will. Worth checking before you standardize on it: open your router's admin panel and look for Hysteria2 or QUIC-tunnel support in the firmware notes. Plenty of older router firmware simply doesn't have it, regardless of which client you install on your phone.

There's no single best protocol here — only a best protocol for the network you're actually on right now. A protocol that's ideal on your home Wi-Fi might be the wrong pick on a hotel connection abroad, and vice versa. That's the entire reason a subscription with eight switchable protocols is more useful than a VPN that locks you into one.

How do you switch to Hysteria2 in your RocketVPN account?

You'll need a client application that supports the Hysteria2 protocol specifically — not every generic VPN client does, so check what you're installing before you rely on it. Connection details, including the server address, login, and password, live in your account area and are generated per server and protocol, so you pull them fresh rather than reusing settings from a different protocol. A common mistake here is grabbing old credentials from a different protocol instead of pulling fresh ones — Hysteria2 needs its own login and password from the account area, and reusing WireGuard or V2Ray details simply won't connect.

The general order looks like this:

1. Sign in to your account area at rocketvpn.net, or create an account if you haven't yet.
2. Pick a server from the available locations — RocketVPN covers 54 of them, including Moscow and Saint Petersburg.
3. Select Hysteria2 as the protocol for that connection and retrieve the connection details shown in your account area.
4. Install a client that supports Hysteria2 on the device you're setting up, and enter those details.
5. Test the connection on the actual network you plan to use it on — a clean office Wi-Fi test tells you little about how it'll behave on mobile data later.

If you're setting this up on a router rather than a single device, our router settings guide walks through the general process; there are separate walkthroughs for iOS and Android as well. All plans include the same 5 devices, every location, and no data cap, so switching protocols to test which one fits your network doesn't cost you anything extra — see the pricing page for the full breakdown across Bronze, Silver, Gold, and Platinum. Payment on the checkout page covers cards, SBP, crypto, and a few other methods; if you're paying from Russia specifically, we've covered what that looks like in more detail. For anything that doesn't go as expected, support is reachable from the account area or at support@rocketvpn.net.

Broader guides to picking between all eight protocols, not just Hysteria2, live in the information section if you want the fuller picture before you commit to one.

Frequently asked questions

Is Hysteria2 faster than WireGuard?

Not inherently, and not in a way that holds across every network. On a clean, low-loss connection, WireGuard's lighter overhead often has the edge. Hysteria2's advantage shows up specifically when packets are being dropped — that's where TCP-style protocols visibly slow down and QUIC-based ones tend not to.

Does Hysteria2 work well for streaming or video calls?

It can, particularly under the exact conditions it's built for: unstable mobile signal or congested Wi-Fi. On a stable wired connection, the difference between Hysteria2 and any other protocol in the subscription is unlikely to be noticeable.

Can Hysteria2 be blocked?

Any protocol can be blocked if a network specifically targets it. Because Hysteria2 runs over UDP, networks that block UDP broadly — rather than trying to fingerprint individual protocols — will affect it along with other UDP-based tools. That's a different failure mode than protocol-specific detection, and it's why having alternatives like V2Ray in the same subscription matters.

Do I need a special app to use Hysteria2?

Yes — a client that specifically supports the Hysteria2 protocol. This is narrower than WireGuard or IKEv2, which have broader native and third-party support, so confirm your device's client handles Hysteria2 before you build a setup around it.

Is Hysteria2 more secure than the other protocols?

Security isn't really the axis Hysteria2 is optimized on — encryption is standard across all eight protocols in the subscription. Hysteria2's distinguishing trait is how it behaves under packet loss, not a stronger or weaker security model.

Which protocol should I use if I'm not sure?

Start with what you know about your network. If your connection is flaky — mobile data, weak Wi-Fi, a long international route — try Hysteria2 first. If a specific protocol seems to be blocked outright, try V2Ray or AmneziaWG instead. There's no wrong starting point, since switching between all eight is included and instant from the account area.

Do I have to pay extra to use Hysteria2 instead of another protocol?

No. All four RocketVPN plans — Bronze, Silver, Gold, and Platinum — include every protocol and every location at no additional cost, so trying Hysteria2 alongside the others is just a matter of switching a setting.