An AnyTLS server is described by a password and its TLS settings. AnyTLS runs inside TLS and pads its traffic, so the connection looks like an ordinary HTTPS visit and doesn't show the usual signs of a proxy inside TLS. Potatso connects to a server when it supports the server's TLS settings. Use the tables below to check your server's settings, as shown by your provider or in its anytls:// link.
You can add an AnyTLS server by hand, with an anytls:// link, or by importing:
- a Clash or Mihomo subscription,
- a Surge configuration.
Potatso doesn't import AnyTLS servers from a sing-box configuration yet. Use the server's anytls:// link instead.
TLS
| Setting | Clash key | Link parameter | Supported |
|---|---|---|---|
| Server name (SNI) | sni |
sni |
✅ Without one, Potatso uses the server's address. |
| ALPN | alpn |
alpn |
✅ Without one, Potatso sends none, as Clash does. |
| Skip certificate verification | skip-cert-verify |
insecure |
✅ |
| Certificate pinning (SHA-256) | fingerprint |
hpkp |
✅ |
| Browser fingerprint | client-fingerprint |
fp |
✅ chrome, firefox, safari, ios, android, edge and random. Other names connect with a default handshake. |
| REALITY | reality-opts |
✅ | |
| Encrypted Client Hello (ECH) | ech-opts |
✅ With the ECH configuration in the subscription, or looked up in DNS | |
| Custom CA certificate | ❌ | ||
| TLS client certificate | certificate, private-key |
❌ |
Turning off certificate verification lets anyone between you and the server read your traffic. Pin the server's certificate instead if it uses a self-signed one: set the SHA-256 of its certificate as the certificate pin.
A browser fingerprint makes the connection's TLS handshake look like that browser's. It doesn't change what the server must support.
Potatso doesn't import a server that needs a TLS client certificate, since the server would refuse the connection.
REALITY
A REALITY server borrows another website's TLS certificate, so it doesn't need one of its own. sing-box servers offer AnyTLS with REALITY. Set the server's public key and short ID as your provider gives them, and the server name to the website the server borrows from. REALITY needs a browser fingerprint, such as chrome.
Connections
AnyTLS reuses its TLS connections: when a connection to a website ends, the next one uses the same TLS connection instead of opening a new one. Each TLS connection carries one connection at a time, so several at once open several TLS connections, which are reused later.
| Setting | Clash key | Supported |
|---|---|---|
| How often idle connections are checked | idle-session-check-interval |
✅ In seconds, 30 by default |
| How long an idle connection stays open | idle-session-timeout |
✅ In seconds, 60 by default |
| How many idle connections stay open | min-idle-session |
✅ 1 by default |
Values of 5 seconds or less mean 30, as in Clash. These settings come from a Clash subscription. Potatso uses the defaults for servers you add by hand or by link.
A Surge configuration's reuse=false doesn't apply: Potatso always reuses connections, as the AnyTLS specification does. Potatso imports the server and shows a warning.
Padding
AnyTLS pads the start of every connection to hide the sizes that give away a proxy. A server can send its own padding scheme. Potatso uses it from the next TLS connection on, as AnyTLS defines. There's nothing to set on your device.
UDP
AnyTLS carries UDP inside its TLS connection (UDP over TCP). UDP is off by default, as in Clash. Turn on UDP Relay in the server's settings if your server relays UDP. A Clash subscription turns it on with udp: true, and a Surge configuration always turns it on.
Feature support
| Feature | Supported |
|---|---|
| AnyTLS protocol v2: password, padding, connection reuse | ✅ |
| Padding schemes sent by the server | ✅ |
| UDP over TCP | ✅ |
| Idle connection settings | ✅ |
| REALITY, ECH | ✅ |
| Certificate pinning, browser fingerprints | ✅ |
| Custom CA, TLS client certificates | ❌ |
anytls:// links |
✅ |
Every supported feature is tested against at least one real AnyTLS server: anytls-go, sing-box or mihomo.
When the password is wrong, the server closes the connection. Check the password first when an AnyTLS server never connects.
anytls:// links
An anytls:// link holds a whole server in one line:
anytls://password@host:port/?parameters#name| Part | Description |
|---|---|
password |
The password, percent-encoded. |
host |
Server address. Put an IPv6 address in square brackets, such as [2001:db8::1]. |
port |
Server port. When it's missing, Potatso uses 443. |
name |
Optional. The server's name in Potatso. |
The parameters follow the anytls-go format, plus a few some apps add:
| Parameter | Description |
|---|---|
sni |
The TLS server name. |
insecure |
1 turns off certificate verification. |
alpn |
The ALPN list, separated by commas and percent-encoded. |
fp |
The browser fingerprint. |
hpkp |
The SHA-256 of the server's certificate. |
When Potatso shares an AnyTLS server, it offers an anytls:// link with the same parameters.
Examples
Each example shows the link to import. The password is secret.
A basic server:
anytls://secret@anytls.example.com:443/?sni=anytls.example.com#BasicA self-signed certificate, without verification:
anytls://secret@203.0.113.7/?insecure=1#Self-signedA Chrome fingerprint, an ALPN list and a pinned certificate:
anytls://secret@anytls.example.com:443/?sni=anytls.example.com&alpn=h2%2Chttp%2F1.1&fp=chrome&hpkp=abababababababababababababababababababababababababababababababab#Shaped