---
title: "ShadowsocksR"
description: "The ShadowsocksR ciphers, protocols and obfuscation methods Potatso supports."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.potatso.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ShadowsocksR

A ShadowsocksR (SSR) server is described by three settings: a **cipher**, a **protocol** and an **obfs** (obfuscation) method. Potatso connects to a server only when it supports all three. Use the tables below to check your server's settings, as shown by your provider or in its `ssr://` link.

You can add an SSR server by hand, with an [`ssr://` link](#links), or from a Clash or Mihomo subscription. Potatso keeps the protocol and obfs your provider names, including the `_compatible` forms.

## Ciphers {#ciphers}

| Cipher | Supported |
| --- | --- |
| `none` | ✅ |
| `aes-128-ctr`, `aes-192-ctr`, `aes-256-ctr` | ✅ |
| `aes-128-cfb`, `aes-192-cfb`, `aes-256-cfb` | ✅ |
| `camellia-128-cfb`, `camellia-192-cfb`, `camellia-256-cfb` | ✅ |
| `chacha20`, `chacha20-ietf` | ✅ |
| `salsa20` | ✅ |
| `bf-cfb` | ✅ |
| `rc4-md5` | ✅ |
| `cast5-cfb`, `des-cfb`, `idea-cfb`, `rc2-cfb`, `seed-cfb` | ✅ |
| `rc4-md5-6`, `table` | ✅ |
| `xchacha20`, `xsalsa20` | ❌ |

AEAD ciphers such as `aes-256-gcm` are Shadowsocks ciphers, not ShadowsocksR ones. If your provider lists one for an SSR server, check whether the server is actually a Shadowsocks server.

## Protocols {#protocols}

| Protocol | Supported | Multi-user |
| --- | --- | --- |
| `origin` | ✅ | — |
| `verify_deflate` | ✅ | — |
| `auth_sha1`, `auth_sha1_v2` | Deprecated (not tested against a real server) | — |
| `auth_sha1_v4` | ✅ | — |
| `auth_sha1_v4_compatible` | ✅ | — |
| `auth_aes128_md5` | ✅ | ✅ |
| `auth_aes128_sha1` | ✅ | ✅ |
| `auth_chain_a` | ✅ | ✅ |
| `auth_chain_b` | ✅ | ✅ |
| `verify_simple`, `verify_sha1`, `auth_simple` | Deprecated (imported as `origin`) | — |

**Multi-user** servers share one port between several users. For these, set the protocol parameter (`protocol-param`, or `protoparam` in an `ssr://` link) to `uid:key`, using the user ID and key from your provider.

Current ShadowsocksR servers no longer offer `auth_sha1` and `auth_sha1_v2`. Potatso still connects with them, but they haven't been tested against a real server, so prefer another protocol if your provider offers one.

Older versions of Potatso listed `verify_simple`, `verify_sha1` and `auth_simple` but always connected with `origin`. Potatso still imports them as `origin` and shows a warning when it does.

## Obfs {#obfs}

| Obfs | Supported |
| --- | --- |
| `plain` | ✅ |
| `http_simple`, `http_simple_compatible` | ✅ |
| `http_post`, `http_post_compatible` | ✅ |
| `tls1.2_ticket_auth`, `tls1.2_ticket_auth_compatible` | ✅ |
| `tls1.2_ticket_fastauth`, `tls1.2_ticket_fastauth_compatible` | ✅ |
| `random_head`, `random_head_compatible` | ✅ Deprecated |

A `_compatible` name means the server also accepts clients that don't use obfuscation. Potatso uses the obfs method it names, so you can keep the name your provider gives you.

For the HTTP methods, the obfs parameter (`obfs-param`, or `obfsparam` in an `ssr://` link) sets the `Host` header. It can be a single host, a comma-separated list of hosts, or a block of custom headers. When it's empty, Potatso uses the server's address. For the TLS methods, it sets the server name sent in the TLS handshake.

## UDP {#udp}

UDP works with every supported protocol and is on by default for SSR servers. Turn it off in the server's settings if your server doesn't relay UDP.

## `ssr://` links {#links}

An `ssr://` link holds a whole server in one line. Everything after `ssr://` is Base64-encoded:

```text
ssr://base64(host:port:protocol:cipher:obfs:base64(password)/?obfsparam=…&protoparam=…&remarks=…)
```

The part before `/?` is six fields separated by colons:

| Field | Description |
| --- | --- |
| `host` | Server address. Put an IPv6 address in square brackets, such as `[2001:db8::1]`. |
| `port` | Server port. |
| `protocol` | One of the [protocols](#protocols) above. If it's empty, Potatso uses `origin`. |
| `cipher` | One of the [ciphers](#ciphers) above. Required. |
| `obfs` | One of the [obfs methods](#obfs) above. If it's empty, Potatso uses `plain`. |
| `password` | The password, Base64-encoded. |

The part after `/?` is optional. Each value is Base64-encoded:

| Parameter | Description |
| --- | --- |
| `obfsparam` | The obfs parameter, such as the `Host` for `http_simple`. |
| `protoparam` | The protocol parameter, such as `uid:key` for a multi-user server. |
| `remarks` | The server's name in Potatso. |

Potatso ignores other parameters, such as `group`, `udpport` and `uot`, and any `#name` at the end of the link. UDP isn't part of the link: it's on by default, and you can turn it off after importing.

Potatso accepts standard and URL-safe Base64, with or without `=` padding. Names aren't case-sensitive, so `AUTH_CHAIN_A` works the same as `auth_chain_a`. When Potatso shares a server, it writes URL-safe Base64 without padding.

### Examples {#link-examples}

Each example shows the decoded text first, then the link to import. The password in every example is `secret`.

A basic server with no protocol plugin and no obfuscation:

```text
ssr.example.com:8388:origin:aes-256-cfb:plain:c2VjcmV0/?remarks=QmFzaWM
```

```text
ssr://c3NyLmV4YW1wbGUuY29tOjgzODg6b3JpZ2luOmFlcy0yNTYtY2ZiOnBsYWluOmMyVmpjbVYwLz9yZW1hcmtzPVFtRnphV00
```

TLS obfuscation, with `cdn.example.com` as the server name:

```text
ssr.example.com:443:auth_aes128_md5:chacha20-ietf:tls1.2_ticket_auth:c2VjcmV0/?obfsparam=Y2RuLmV4YW1wbGUuY29t&remarks=VExTIG9iZnM
```

```text
ssr://c3NyLmV4YW1wbGUuY29tOjQ0MzphdXRoX2FlczEyOF9tZDU6Y2hhY2hhMjAtaWV0Zjp0bHMxLjJfdGlja2V0X2F1dGg6YzJWamNtVjAvP29iZnNwYXJhbT1ZMlJ1TG1WNFlXMXdiR1V1WTI5dCZyZW1hcmtzPVZFeFRJRzlpWm5N
```

A multi-user server: user `2173` with key `userkey`, the `none` cipher, and HTTP obfuscation:

```text
ssr.example.com:8080:auth_chain_a:none:http_simple:c2VjcmV0/?obfsparam=Y2RuLmV4YW1wbGUuY29t&protoparam=MjE3Mzp1c2Vya2V5&remarks=TXVsdGktdXNlcg
```

```text
ssr://c3NyLmV4YW1wbGUuY29tOjgwODA6YXV0aF9jaGFpbl9hOm5vbmU6aHR0cF9zaW1wbGU6YzJWamNtVjAvP29iZnNwYXJhbT1ZMlJ1TG1WNFlXMXdiR1V1WTI5dCZwcm90b3BhcmFtPU1qRTNNenAxYzJWeWEyVjUmcmVtYXJrcz1UWFZzZEdrdGRYTmxjZw
```

A server with an IPv6 address:

```text
[2001:db8::1]:8388:auth_sha1_v4:rc4-md5:http_post:c2VjcmV0/?remarks=SVB2Ng
```

```text
ssr://WzIwMDE6ZGI4OjoxXTo4Mzg4OmF1dGhfc2hhMV92NDpyYzQtbWQ1Omh0dHBfcG9zdDpjMlZqY21WMC8_cmVtYXJrcz1TVkIyTmc
```

Source: https://docs.potatso.com/protocols/shadowsocksr/index.mdx