An HTTP proxy is a server that opens connections for you when asked with an HTTP CONNECT request. An HTTPS proxy is the same server reached over TLS, so the connection to the proxy is encrypted too. Potatso connects to both, with or without a user name and password.
An HTTP proxy only carries TCP. See UDP for what happens to the rest of your traffic.
You can add an HTTP or HTTPS proxy by hand, with an http:// or https:// link, or by importing:
- a Clash or Mihomo subscription (
type: http), - a Surge configuration (
httpandhttps), - an Xray or V2Ray configuration (
httpoutbound).
To add an HTTPS proxy by hand, choose HTTP and turn on TLS.
Settings
| Setting | Description |
|---|---|
| Server, port | The proxy's address and port. An IPv6 address works too. |
| User name, password | Optional. Sent with Basic authentication. |
| TLS | On for an HTTPS proxy. |
| Server name | HTTPS only, optional. The name sent in the TLS handshake and checked against the certificate. Leave it empty to use the server address. |
| Skip Certificate Verification | HTTPS only. Accepts any certificate. Use it only for testing. |
| Certificate pin | HTTPS only, optional. The SHA-256 fingerprint of the proxy's certificate, as 64 hex digits. With a pin, Potatso accepts the pinned certificate, including a self-signed one, and nothing else. |
The password can contain any character, including : and non-ASCII letters. The user name can't contain :.
Custom headers
A Clash, Mihomo or Xray configuration can add headers to the CONNECT request, such as a User-Agent your provider asks for. Potatso keeps them when it imports the proxy and sends them on every connection. A Host header replaces the one Potatso sends. You can't add or edit headers in the app.
Certificates
An HTTPS proxy needs a certificate your device trusts, unless you set a certificate pin or turn on Skip Certificate Verification.
Potatso doesn't support:
- a custom CA certificate for an HTTPS proxy: pin the proxy's certificate instead,
- a TLS client certificate (Clash
certificateandprivate-key): Potatso doesn't import a proxy that needs one, - an ALPN list: Potatso always talks HTTP/1.1 to the proxy.
UDP
HTTP proxies only carry TCP, so Potatso never sends UDP to one. UDP is used by QUIC, voice and video calls and many games.
- With rules, Potatso skips a rule that sends UDP to an HTTP or HTTPS proxy, and the next rule that matches decides. UDP that no other rule matches is sent directly.
- In Global mode, UDP doesn't work, because all traffic must go through the proxy.
To send UDP through a proxy too, use a server whose protocol carries UDP, such as SOCKS5 or Shadowsocks.
Feature support
| Feature | Supported |
|---|---|
CONNECT tunnels (RFC 9110 §9.3.6) to IPv4, IPv6 and domain targets |
✅ |
| Basic authentication (RFC 7617), UTF-8 passwords | ✅ |
| Digest authentication (RFC 7616) | ❌ |
| HTTPS proxies (HTTP over TLS) | ✅ With server name, certificate pin and skip-certificate-verification |
Custom CONNECT headers |
✅ From imports |
| An IPv6 proxy address | ✅ |
HTTP/2 CONNECT (RFC 9113 §8.5) |
❌ |
HTTP/3 CONNECT (RFC 9114 §4.4) |
❌ |
UDP through the proxy (CONNECT-UDP, RFC 9298) |
❌ |
Plain-HTTP forwarding without CONNECT (absolute-form requests) |
❌ Potatso uses CONNECT for every connection |
| TLS client certificates, custom CA, ALPN | ❌ |
Every supported feature is tested against real proxy servers: tinyproxy, sing-box, Xray and Mihomo.
Use the server's CONNECT port, not a web port that only forwards plain web requests. Some proxies only allow CONNECT to port 443. If only some sites work through your proxy, ask your provider whether it limits CONNECT ports.
Links
An http:// or https:// link holds a whole proxy in one line:
http://user:password@host:port#name
https://user:password@host:port?sni=…&insecure=1#name| Part | Description |
|---|---|
user:password |
Optional. Percent-encode :, @ and other special characters in the password, for example p%3Ass for p:ss. |
host |
Proxy address. Put an IPv6 address in square brackets, such as [2001:db8::1]. |
port |
Proxy port. |
sni |
HTTPS only, optional. The server name. Potatso also reads peer and servername. |
insecure |
HTTPS only, optional. 1 turns on Skip Certificate Verification. Potatso also reads allowInsecure and skip-cert-verify. |
name |
Optional. The proxy's name in Potatso. |
A link can't hold a certificate pin or custom headers. Potatso also imports the older form, where everything between :// and # is Base64-encoded:
http://base64(user:password@host:port)#nameExamples
A proxy without a password:
http://proxy.example.com:8080#OpenA proxy with the user name alice and the password s3cret:
http://alice:s3cret@proxy.example.com:8080#BasicThe password p:ss wörd, percent-encoded:
http://alice:p%3Ass%20w%C3%B6rd@proxy.example.com:8080#EncodedAn HTTPS proxy:
https://alice:s3cret@proxy.example.com:443#TLSAn HTTPS proxy reached by its IP address, with the certificate name proxy.example.com:
https://alice:s3cret@203.0.113.10:443?sni=proxy.example.com#SNIAn HTTPS proxy with a self-signed certificate:
https://proxy.example.com:443?insecure=1#Self-signedA proxy with an IPv6 address:
http://[2001:db8::1]:8080#IPv6The older form of the basic proxy:
http://YWxpY2U6czNjcmV0QHByb3h5LmV4YW1wbGUuY29tOjgwODA#Legacy