A ShadowsocksR (SSR) server is described by three settings: a cipher, a protocol and an obfs (obfuscation) method. Potatso connects to a server only when it supports all three. Use the tables below to check your server's settings, as shown by your provider or in its ssr:// link.
You can add an SSR server by hand, with an ssr:// link, or from a Clash or Mihomo subscription. Potatso keeps the protocol and obfs your provider names, including the _compatible forms.
Ciphers
| Cipher | Supported |
|---|---|
none |
✅ |
aes-128-ctr, aes-192-ctr, aes-256-ctr |
✅ |
aes-128-cfb, aes-192-cfb, aes-256-cfb |
✅ |
camellia-128-cfb, camellia-192-cfb, camellia-256-cfb |
✅ |
chacha20, chacha20-ietf |
✅ |
salsa20 |
✅ |
bf-cfb |
✅ |
rc4-md5 |
✅ |
cast5-cfb, des-cfb, idea-cfb, rc2-cfb, seed-cfb |
✅ |
rc4-md5-6, table |
✅ |
xchacha20, xsalsa20 |
❌ |
AEAD ciphers such as aes-256-gcm are Shadowsocks ciphers, not ShadowsocksR ones. If your provider lists one for an SSR server, check whether the server is actually a Shadowsocks server.
Protocols
| Protocol | Supported | Multi-user |
|---|---|---|
origin |
✅ | — |
verify_deflate |
✅ | — |
auth_sha1, auth_sha1_v2 |
Deprecated (not tested against a real server) | — |
auth_sha1_v4 |
✅ | — |
auth_sha1_v4_compatible |
✅ | — |
auth_aes128_md5 |
✅ | ✅ |
auth_aes128_sha1 |
✅ | ✅ |
auth_chain_a |
✅ | ✅ |
auth_chain_b |
✅ | ✅ |
verify_simple, verify_sha1, auth_simple |
Deprecated (imported as origin) |
— |
Multi-user servers share one port between several users. For these, set the protocol parameter (protocol-param, or protoparam in an ssr:// link) to uid:key, using the user ID and key from your provider.
Current ShadowsocksR servers no longer offer auth_sha1 and auth_sha1_v2. Potatso still connects with them, but they haven't been tested against a real server, so prefer another protocol if your provider offers one.
Older versions of Potatso listed verify_simple, verify_sha1 and auth_simple but always connected with origin. Potatso still imports them as origin and shows a warning when it does.
Obfs
| Obfs | Supported |
|---|---|
plain |
✅ |
http_simple, http_simple_compatible |
✅ |
http_post, http_post_compatible |
✅ |
tls1.2_ticket_auth, tls1.2_ticket_auth_compatible |
✅ |
tls1.2_ticket_fastauth, tls1.2_ticket_fastauth_compatible |
✅ |
random_head, random_head_compatible |
✅ Deprecated |
A _compatible name means the server also accepts clients that don't use obfuscation. Potatso uses the obfs method it names, so you can keep the name your provider gives you.
For the HTTP methods, the obfs parameter (obfs-param, or obfsparam in an ssr:// link) sets the Host header. It can be a single host, a comma-separated list of hosts, or a block of custom headers. When it's empty, Potatso uses the server's address. For the TLS methods, it sets the server name sent in the TLS handshake.
UDP
UDP works with every supported protocol and is on by default for SSR servers. Turn it off in the server's settings if your server doesn't relay UDP.
ssr:// links
An ssr:// link holds a whole server in one line. Everything after ssr:// is Base64-encoded:
ssr://base64(host:port:protocol:cipher:obfs:base64(password)/?obfsparam=…&protoparam=…&remarks=…)The part before /? is six fields separated by colons:
| Field | Description |
|---|---|
host |
Server address. Put an IPv6 address in square brackets, such as [2001:db8::1]. |
port |
Server port. |
protocol |
One of the protocols above. If it's empty, Potatso uses origin. |
cipher |
One of the ciphers above. Required. |
obfs |
One of the obfs methods above. If it's empty, Potatso uses plain. |
password |
The password, Base64-encoded. |
The part after /? is optional. Each value is Base64-encoded:
| Parameter | Description |
|---|---|
obfsparam |
The obfs parameter, such as the Host for http_simple. |
protoparam |
The protocol parameter, such as uid:key for a multi-user server. |
remarks |
The server's name in Potatso. |
Potatso ignores other parameters, such as group, udpport and uot, and any #name at the end of the link. UDP isn't part of the link: it's on by default, and you can turn it off after importing.
Potatso accepts standard and URL-safe Base64, with or without = padding. Names aren't case-sensitive, so AUTH_CHAIN_A works the same as auth_chain_a. When Potatso shares a server, it writes URL-safe Base64 without padding.
Examples
Each example shows the decoded text first, then the link to import. The password in every example is secret.
A basic server with no protocol plugin and no obfuscation:
ssr.example.com:8388:origin:aes-256-cfb:plain:c2VjcmV0/?remarks=QmFzaWMssr://c3NyLmV4YW1wbGUuY29tOjgzODg6b3JpZ2luOmFlcy0yNTYtY2ZiOnBsYWluOmMyVmpjbVYwLz9yZW1hcmtzPVFtRnphV00TLS obfuscation, with cdn.example.com as the server name:
ssr.example.com:443:auth_aes128_md5:chacha20-ietf:tls1.2_ticket_auth:c2VjcmV0/?obfsparam=Y2RuLmV4YW1wbGUuY29t&remarks=VExTIG9iZnMssr://c3NyLmV4YW1wbGUuY29tOjQ0MzphdXRoX2FlczEyOF9tZDU6Y2hhY2hhMjAtaWV0Zjp0bHMxLjJfdGlja2V0X2F1dGg6YzJWamNtVjAvP29iZnNwYXJhbT1ZMlJ1TG1WNFlXMXdiR1V1WTI5dCZyZW1hcmtzPVZFeFRJRzlpWm5NA multi-user server: user 2173 with key userkey, the none cipher, and HTTP obfuscation:
ssr.example.com:8080:auth_chain_a:none:http_simple:c2VjcmV0/?obfsparam=Y2RuLmV4YW1wbGUuY29t&protoparam=MjE3Mzp1c2Vya2V5&remarks=TXVsdGktdXNlcgssr://c3NyLmV4YW1wbGUuY29tOjgwODA6YXV0aF9jaGFpbl9hOm5vbmU6aHR0cF9zaW1wbGU6YzJWamNtVjAvP29iZnNwYXJhbT1ZMlJ1TG1WNFlXMXdiR1V1WTI5dCZwcm90b3BhcmFtPU1qRTNNenAxYzJWeWEyVjUmcmVtYXJrcz1UWFZzZEdrdGRYTmxjZwA server with an IPv6 address:
[2001:db8::1]:8388:auth_sha1_v4:rc4-md5:http_post:c2VjcmV0/?remarks=SVB2Ngssr://WzIwMDE6ZGI4OjoxXTo4Mzg4OmF1dGhfc2hhMV92NDpyYzQtbWQ1Omh0dHBfcG9zdDpjMlZqY21WMC8_cmVtYXJrcz1TVkIyTmc