---
title: "HTTP and HTTPS"
description: "The HTTP and HTTPS proxy options, links and features Potatso supports."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.potatso.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HTTP and HTTPS

An HTTP proxy is a server that opens connections for you when asked with an HTTP `CONNECT` request. An **HTTPS** proxy is the same server reached over TLS, so the connection to the proxy is encrypted too. Potatso connects to both, with or without a user name and password.

An HTTP proxy only carries TCP. See [UDP](#udp) for what happens to the rest of your traffic.

You can add an HTTP or HTTPS proxy by hand, with an [`http://` or `https://` link](#links), or by importing:

- a Clash or Mihomo subscription (`type: http`),
- a Surge configuration (`http` and `https`),
- an Xray or V2Ray configuration (`http` outbound).

To add an HTTPS proxy by hand, choose **HTTP** and turn on **TLS**.

## Settings {#settings}

| Setting | Description |
| --- | --- |
| Server, port | The proxy's address and port. An IPv6 address works too. |
| User name, password | Optional. Sent with Basic authentication. |
| TLS | On for an HTTPS proxy. |
| Server name | HTTPS only, optional. The name sent in the TLS handshake and checked against the certificate. Leave it empty to use the server address. |
| Skip Certificate Verification | HTTPS only. Accepts any certificate. Use it only for testing. |
| Certificate pin | HTTPS only, optional. The SHA-256 fingerprint of the proxy's certificate, as 64 hex digits. With a pin, Potatso accepts the pinned certificate, including a self-signed one, and nothing else. |

The password can contain any character, including `:` and non-ASCII letters. The user name can't contain `:`.

### Custom headers {#headers}

A Clash, Mihomo or Xray configuration can add headers to the `CONNECT` request, such as a `User-Agent` your provider asks for. Potatso keeps them when it imports the proxy and sends them on every connection. A `Host` header replaces the one Potatso sends. You can't add or edit headers in the app.

### Certificates {#certificates}

An HTTPS proxy needs a certificate your device trusts, unless you set a [certificate pin](#settings) or turn on **Skip Certificate Verification**.

Potatso doesn't support:

- a custom CA certificate for an HTTPS proxy: pin the proxy's certificate instead,
- a TLS client certificate (Clash `certificate` and `private-key`): Potatso doesn't import a proxy that needs one,
- an ALPN list: Potatso always talks HTTP/1.1 to the proxy.

## UDP {#udp}

HTTP proxies only carry TCP, so Potatso never sends UDP to one. UDP is used by QUIC, voice and video calls and many games.

- With rules, Potatso skips a rule that sends UDP to an HTTP or HTTPS proxy, and the next rule that matches decides. UDP that no other rule matches is sent directly.
- In Global mode, UDP doesn't work, because all traffic must go through the proxy.

To send UDP through a proxy too, use a server whose protocol carries UDP, such as SOCKS5 or Shadowsocks.

## Feature support {#features}

| Feature | Supported |
| --- | --- |
| `CONNECT` tunnels ([RFC 9110 §9.3.6](https://www.rfc-editor.org/rfc/rfc9110#section-9.3.6)) to IPv4, IPv6 and domain targets | ✅ |
| Basic authentication ([RFC 7617](https://www.rfc-editor.org/rfc/rfc7617)), UTF-8 passwords | ✅ |
| Digest authentication ([RFC 7616](https://www.rfc-editor.org/rfc/rfc7616)) | ❌ |
| HTTPS proxies (HTTP over TLS) | ✅ With server name, certificate pin and skip-certificate-verification |
| Custom `CONNECT` headers | ✅ From imports |
| An IPv6 proxy address | ✅ |
| HTTP/2 `CONNECT` ([RFC 9113 §8.5](https://www.rfc-editor.org/rfc/rfc9113#section-8.5)) | ❌ |
| HTTP/3 `CONNECT` ([RFC 9114 §4.4](https://www.rfc-editor.org/rfc/rfc9114#section-4.4)) | ❌ |
| UDP through the proxy (`CONNECT-UDP`, [RFC 9298](https://www.rfc-editor.org/rfc/rfc9298)) | ❌ |
| Plain-HTTP forwarding without `CONNECT` (absolute-form requests) | ❌ Potatso uses `CONNECT` for every connection |
| TLS client certificates, custom CA, ALPN | ❌ |

Every supported feature is tested against real proxy servers: [tinyproxy](https://tinyproxy.github.io/), [sing-box](https://sing-box.sagernet.org/), [Xray](https://xtls.github.io/) and [Mihomo](https://wiki.metacubex.one/).

Use the server's `CONNECT` port, not a web port that only forwards plain web requests. Some proxies only allow `CONNECT` to port 443. If only some sites work through your proxy, ask your provider whether it limits `CONNECT` ports.

## Links {#links}

An `http://` or `https://` link holds a whole proxy in one line:

```text
http://user:password@host:port#name
https://user:password@host:port?sni=…&insecure=1#name
```

| Part | Description |
| --- | --- |
| `user:password` | Optional. Percent-encode `:`, `@` and other special characters in the password, for example `p%3Ass` for `p:ss`. |
| `host` | Proxy address. Put an IPv6 address in square brackets, such as `[2001:db8::1]`. |
| `port` | Proxy port. |
| `sni` | HTTPS only, optional. The [server name](#settings). Potatso also reads `peer` and `servername`. |
| `insecure` | HTTPS only, optional. `1` turns on Skip Certificate Verification. Potatso also reads `allowInsecure` and `skip-cert-verify`. |
| `name` | Optional. The proxy's name in Potatso. |

A link can't hold a certificate pin or custom headers. Potatso also imports the older form, where everything between `://` and `#` is Base64-encoded:

```text
http://base64(user:password@host:port)#name
```

### Examples {#link-examples}

A proxy without a password:

```text
http://proxy.example.com:8080#Open
```

A proxy with the user name `alice` and the password `s3cret`:

```text
http://alice:s3cret@proxy.example.com:8080#Basic
```

The password `p:ss wörd`, percent-encoded:

```text
http://alice:p%3Ass%20w%C3%B6rd@proxy.example.com:8080#Encoded
```

An HTTPS proxy:

```text
https://alice:s3cret@proxy.example.com:443#TLS
```

An HTTPS proxy reached by its IP address, with the certificate name `proxy.example.com`:

```text
https://alice:s3cret@203.0.113.10:443?sni=proxy.example.com#SNI
```

An HTTPS proxy with a self-signed certificate:

```text
https://proxy.example.com:443?insecure=1#Self-signed
```

A proxy with an IPv6 address:

```text
http://[2001:db8::1]:8080#IPv6
```

The older form of the basic proxy:

```text
http://YWxpY2U6czNjcmV0QHByb3h5LmV4YW1wbGUuY29tOjgwODA#Legacy
```

Source: https://docs.potatso.com/protocols/http/index.mdx