---
title: "Shadowsocks"
description: "The Shadowsocks ciphers, plugins, links and features Potatso supports."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.potatso.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Shadowsocks

A Shadowsocks server is described by a **cipher** and a **password**, and optionally a **plugin** that disguises the connection. Potatso connects to a server when it supports the cipher and, if there is one, the plugin. Use the tables below to check your server's settings, as shown by your provider or in its `ss://` link.

You can add a Shadowsocks server by hand, with an [`ss://` link](#links), or by importing:

- a Clash or Mihomo subscription,
- a [SIP008](https://shadowsocks.org/doc/sip008.html) online configuration, from a file or a link,
- a shadowsocks-rust or shadowsocks-libev `config.json`,
- a Surge configuration, or an Xray or V2Ray configuration.

## Ciphers {#ciphers}

Prefer a 2022 cipher if your server offers one, then an AEAD cipher. Stream ciphers have known weaknesses: use them only with servers that offer nothing else.

| Cipher | Kind | Supported |
| --- | --- | --- |
| `2022-blake3-aes-128-gcm`, `2022-blake3-aes-256-gcm` | 2022 | ✅ With [multi-user](#multi-user) |
| `2022-blake3-chacha20-poly1305`, `2022-blake3-chacha8-poly1305` | 2022 | ✅ |
| `aes-128-gcm`, `aes-192-gcm`, `aes-256-gcm` | AEAD | ✅ |
| `chacha20-ietf-poly1305`, `xchacha20-ietf-poly1305` | AEAD | ✅ |
| `aes-128-ccm`, `aes-256-ccm`, `aes-128-gcm-siv`, `aes-256-gcm-siv` | AEAD | ✅ |
| `sm4-gcm`, `sm4-ccm` | AEAD | ✅ |
| `aes-128-ctr`, `aes-192-ctr`, `aes-256-ctr` | Stream | ✅ |
| `aes-128-cfb`, `aes-192-cfb`, `aes-256-cfb` (also written `-cfb128`) | Stream | ✅ |
| `aes-128-cfb1`, `aes-192-cfb1`, `aes-256-cfb1` | Stream | ✅ |
| `aes-128-cfb8`, `aes-192-cfb8`, `aes-256-cfb8` | Stream | ✅ |
| `aes-128-ofb`, `aes-192-ofb`, `aes-256-ofb` | Stream | ✅ |
| `camellia-128-ctr`, `camellia-192-ctr`, `camellia-256-ctr` | Stream | ✅ |
| `camellia-128-cfb`, `camellia-192-cfb`, `camellia-256-cfb` (also written `-cfb128`) | Stream | ✅ |
| `camellia-128-cfb1`, `camellia-192-cfb1`, `camellia-256-cfb1` | Stream | ✅ |
| `camellia-128-cfb8`, `camellia-192-cfb8`, `camellia-256-cfb8` | Stream | ✅ |
| `camellia-128-ofb`, `camellia-192-ofb`, `camellia-256-ofb` | Stream | ✅ |
| `chacha20-ietf`, `chacha20`, `salsa20` | Stream | ✅ |
| `bf-cfb`, `rc4-md5`, `rc4`, `table` | Stream | ✅ |
| `none` (also written `plain`) | No encryption | ✅ |
| `cast5-cfb`, `des-cfb`, `idea-cfb`, `rc2-cfb`, `seed-cfb`, `rc4-md5-6` | Stream | ❌ ShadowsocksR only |
| `xchacha20`, `xsalsa20` | Stream | ❌ |

Names aren't case-sensitive, so `AES-256-GCM` works the same as `aes-256-gcm`.

`none` sends your traffic unencrypted. Use it only with a plugin that encrypts the connection itself, such as v2ray-plugin with TLS.

Every supported cipher is tested against at least one real Shadowsocks server: [shadowsocks-rust](https://github.com/shadowsocks/shadowsocks-rust), [sing-box](https://sing-box.sagernet.org/) or the original Python server. Of the AEAD ciphers above, only shadowsocks-rust servers offer `aes-*-ccm`, `aes-*-gcm-siv` and `sm4-*`, and few providers use them.

### 2022 keys {#2022-keys}

The 2022 ciphers ([SIP022](https://shadowsocks.org/doc/sip022.html)) don't use a password. They use a key: random bytes, Base64-encoded, of the length the cipher needs. `2022-blake3-aes-128-gcm` needs a 16-byte key and the other 2022 ciphers a 32-byte key. Use the key exactly as your server has it.

Potatso doesn't connect with a key of the wrong length, or with a password that isn't Base64. To make a new key for your server, run `openssl rand -base64 16` for `2022-blake3-aes-128-gcm`, or `openssl rand -base64 32` for the other 2022 ciphers.

### Multi-user servers {#multi-user}

A 2022 server can share one port between several users ([SIP023](https://shadowsocks.org/doc/sip023.html)). Each user has their own key. For these servers, set the password to the server key and your user key, separated by a colon:

```text
server-key:user-key
```

Only `2022-blake3-aes-128-gcm` and `2022-blake3-aes-256-gcm` support multi-user servers.

## Plugins {#plugins}

A plugin wraps the Shadowsocks connection to make it harder to detect. Potatso has these plugins built in, so there's nothing else to install.

| Plugin | Plugin names | Supported | UDP |
| --- | --- | --- | --- |
| Simple Obfs | `obfs-local`, `simple-obfs`, `obfs` | ✅ `obfs=http` and `obfs=tls` | Sent to the server without the plugin |
| v2ray-plugin | `v2ray-plugin` | ✅ WebSocket, with or without TLS. QUIC mode isn't supported. | ❌ |
| gost-plugin | `gost-plugin` | ✅ WebSocket, with or without TLS | ❌ |
| ShadowTLS | `shadow-tls` | ✅ Versions 1, 2 and 3 | ❌ |
| Restls | `restls` | ✅ | ❌ |
| JLS | `jls` | ✅ | ❌ |

Potatso doesn't import a server that needs another plugin:

- Cloak, xray-plugin and other plugins are programs your device would have to run next to Potatso, which iOS doesn't allow.
- kcptun and ech-tls-tunnel aren't available in Potatso yet.

### Setting a plugin {#set-plugin}

In the server's settings, choose the plugin under **Plugin**, then enter its options in **Plugin Parameter**. Options are `key=value` pairs separated by semicolons, as in this Simple Obfs example:

```text
obfs=tls;obfs-host=cdn.example.com
```

A key on its own, such as `tls`, turns that option on. Leave out any option you don't need; the tables below give each default.

When you import a server, Potatso sets the plugin and its options for you:

- An [`ss://` link](#links) carries them in its `plugin` parameter, after the plugin name: `simple-obfs;obfs=tls;obfs-host=cdn.example.com`.
- A Clash or Mihomo subscription carries them in `plugin` and `plugin-opts`.
- A SIP008 configuration or a shadowsocks-rust or shadowsocks-libev `config.json` carries them in `plugin` and `plugin_opts`.

These are the same options in every form. If your provider lists them one per line, as in a Clash `plugin-opts`, write each as `key=value` and join them with semicolons.

### Plugin options {#plugin-options}

**Simple Obfs**

| Option | Description |
| --- | --- |
| `obfs` | Required. `http` or `tls`. |
| `obfs-host` | The `Host` header (`http`) or the server name sent in the TLS handshake (`tls`). When it's empty, Potatso uses the server's address. |
| `obfs-uri` | `http` only. The request path. Default `/`. |
| `http-method` | `http` only. The request method. Default `GET`. |

**v2ray-plugin**

| Option | Description |
| --- | --- |
| `mode` | `websocket`, the default. QUIC mode isn't supported. |
| `tls` | Connects over TLS. Off by default. |
| `host` | The `Host` header, and the server name for TLS. When it's empty, Potatso uses the server's address. |
| `path` | The WebSocket path. Default `/`. |
| `mux` | Multiplexing. Off by default. Turn it on only if your server uses it. |
| `skip-cert-verify` | Accepts any server certificate. Use it only with a server you trust. |
| `header` | An extra request header, as `header=Name:Value`. Repeat it for more headers. |

**gost-plugin**

| Option | Description |
| --- | --- |
| `mode` | Required. `websocket`. |
| `tls` | Connects over TLS. Off by default. |
| `host` | The `Host` header, and the server name for TLS. Default `bing.com`, as in gost. |
| `path` | The WebSocket path. Default `/`. |
| `mux` | Multiplexing. On by default. |
| `skip-cert-verify` | Accepts any server certificate. Use it only with a server you trust. |
| `fingerprint` | The SHA-256 fingerprint of the server certificate, to accept only that certificate. |
| `header` | An extra request header, as `header=Name:Value`. Repeat it for more headers. |

**ShadowTLS**

| Option | Description |
| --- | --- |
| `host` | Required. The cover site's server name, such as `www.example.com`. |
| `version` | Required. `1`, `2` or `3`. |
| `password` | The password. Versions 2 and 3 need it. |
| `alpn` | The ALPN list, separated by commas. Default `h2,http/1.1`. |
| `skip-cert-verify` | Accepts any cover site certificate. |

**Restls**

| Option | Description |
| --- | --- |
| `host` | Required. The cover site's server name. |
| `password` | Required. The password. |
| `version-hint` | Required. `tls13` or `tls12`, as your server is set up. |
| `restls-script` | The record script, if your provider gives one. |

**JLS**

| Option | Description |
| --- | --- |
| `host` | Required. The cover site's server name. |
| `username` | Required. The user name. |
| `password` | Required. The password. |
| `alpn` | The ALPN list, separated by commas. Default `h2,http/1.1`. |

Potatso doesn't connect to a server when a required option is missing or a value isn't valid.

## UDP {#udp}

UDP is on by default for Shadowsocks servers and works with every supported cipher. Turn it off in the server's settings if your server doesn't relay UDP.

UDP isn't sent through a plugin, so with a plugin other than Simple Obfs the server only carries TCP. Potatso doesn't support UDP-over-TCP (`udp-over-tcp` or `uot` in a link or subscription) and doesn't import a server that requires it.

## Feature support {#features}

| Feature | Supported |
| --- | --- |
| [SIP002](https://shadowsocks.org/doc/sip002.html) `ss://` links | ✅ Including the older Base64 form |
| [SIP003](https://shadowsocks.org/doc/sip003.html) plugins | The [built-in plugins](#plugins) only |
| SIP003u (UDP through a plugin) | ❌ |
| [AEAD ciphers](https://shadowsocks.org/doc/aead.html) (SIP004) | ✅ |
| [SIP008](https://shadowsocks.org/doc/sip008.html) online configuration | ✅ |
| [SIP022](https://shadowsocks.org/doc/sip022.html) 2022 ciphers | ✅ TCP and UDP |
| [SIP023](https://shadowsocks.org/doc/sip023.html) multi-user identity headers | ✅ For the AES 2022 ciphers |
| [Stream ciphers](https://shadowsocks.org/doc/stream.html) | ✅ See [Ciphers](#ciphers) |
| UDP-over-TCP | ❌ |
| TCP Fast Open, MPTCP | ❌ |

Some shadowsocks-rust features are settings of its own client program, `sslocal`, and Potatso does the same job its own way:

- Local SOCKS5, HTTP, tunnel, redir, DNS and TUN servers: Potatso captures your device's traffic itself.
- Access control lists (ACL): use rules in your profile.
- Picking the fastest of several servers: use a proxy group in your profile.

## `ss://` links {#links}

An `ss://` link holds a whole server in one line ([SIP002](https://shadowsocks.org/doc/sip002.html)):

```text
ss://userinfo@host:port/?plugin=…#name
```

| Part | Description |
| --- | --- |
| `userinfo` | The cipher and password as `cipher:password`, either Base64-encoded or percent-encoded. A 2022 cipher must use the percent-encoded form. |
| `host` | Server address. Put an IPv6 address in square brackets, such as `[2001:db8::1]`. |
| `port` | Server port. |
| `plugin` | Optional. The plugin name and its options, separated by semicolons and percent-encoded, such as `simple-obfs;obfs=tls;obfs-host=cdn.example.com`. |
| `name` | Optional. The server's name in Potatso. |

Potatso also imports the older form, where everything before the `#` is Base64-encoded:

```text
ss://base64(cipher:password@host:port)#name
```

Potatso accepts standard and URL-safe Base64, with or without `=` padding. When Potatso shares a server, it offers the Base64 and percent-encoded forms of SIP002 and the older form.

### Examples {#link-examples}

Each example shows the link to import. The password in the AEAD examples is `secret`.

A basic server with `aes-256-gcm`:

```text
ss://YWVzLTI1Ni1nY206c2VjcmV0@ss.example.com:8388#Basic
```

A 2022 server with the 16-byte key `MTIzNDU2Nzg5MDEyMzQ1Ng==`:

```text
ss://2022-blake3-aes-128-gcm:MTIzNDU2Nzg5MDEyMzQ1Ng%3D%3D@ss.example.com:8388#2022
```

A multi-user 2022 server, with the server key and user key separated by a colon (`%3A`):

```text
ss://2022-blake3-aes-256-gcm:MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTI%3D%3AYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU%3D@ss.example.com:8388#Multi-user
```

Simple Obfs with TLS, using `cdn.example.com` as the server name:

```text
ss://YWVzLTI1Ni1nY206c2VjcmV0@ss.example.com:443/?plugin=simple-obfs%3Bobfs%3Dtls%3Bobfs-host%3Dcdn.example.com#Obfs
```

The older form of the basic server:

```text
ss://YWVzLTI1Ni1nY206c2VjcmV0QHNzLmV4YW1wbGUuY29tOjgzODg#Legacy
```

A server with an IPv6 address:

```text
ss://YWVzLTI1Ni1nY206c2VjcmV0@[2001:db8::1]:8388#IPv6
```

Source: https://docs.potatso.com/protocols/shadowsocks/index.mdx