A Snell server is described by a PSK (pre-shared key) and its version, and optionally by obfuscation. Snell is the Surge team's proxy protocol. The client's version must match the server's, so check it first: it's the version in your provider's Surge configuration, or the snell-server release your server runs.
You can add a Snell server by hand, with a snell:// link, or by importing:
- a Clash or Mihomo subscription,
- a Surge configuration.
Versions
| Version | Supported | Tested with |
|---|---|---|
| v1, v2 | ❌ | |
| v3 | ✅ | open-snell |
| v4 | ✅ | snell-server v4 |
| v5 | ✅ Without QUIC Proxy Mode | snell-server v5 |
| v6 | ✅ | snell-server v6 |
A v5 server also accepts v4 clients, and a v4 server accepts a client set to v5. Every other mix of versions doesn't connect.
v5's QUIC Proxy Mode is a way Surge relays QUIC traffic. Potatso relays QUIC like any other UDP traffic instead, so QUIC still works.
Snell v6 is in beta at Surge and may still change in ways that break older clients. Keep your server's version the one your provider recommends.
Obfuscation
| Obfuscation | v3 | v4, v5 | v6 |
|---|---|---|---|
| None | ✅ | ✅ | ✅ |
| HTTP | ✅ | ✅ | |
| TLS | ✅ | ❌ The servers only offer HTTP |
Obfuscation makes the connection's start look like an HTTP request or a TLS handshake. It must match the server's obfs setting. Set the obfuscation host to the host name your provider gives: without one, Potatso uses bing.com, as Clash does.
A v6 server has no obfuscation. It shapes its traffic from the PSK instead, and needs nothing on your device for that.
v6 modes
| Mode | Supported |
|---|---|
default: encryption and traffic shaping |
✅ |
unshaped: encryption without traffic shaping |
✅ |
unsafe-raw: no encryption, no shaping |
✅ |
The mode must match the server's mode setting. unsafe-raw sends your traffic as it is and doesn't check the PSK: use it only inside another secure tunnel.
Connection reuse
With Reuse Connections on, Potatso keeps a Snell connection open when a connection to a website ends, and uses it for the next one. That saves a round trip. Reuse works with v4 and later. v3 servers never reuse a connection, so the setting doesn't show for v3.
UDP
Snell v3 and later carry UDP inside the Snell connection. UDP is off by default, as in Clash. Turn on UDP Relay in the server's settings if your server relays UDP. A Surge configuration always turns it on, as Surge does.
With a v5 server, UDP replies larger than about 2.5 KB arrive cut short: the server sends them in a form only Surge reads. Most UDP traffic, such as DNS, QUIC and calls, uses smaller packets. A v4 or v6 server doesn't have this problem.
Surge settings
Potatso imports the snell lines of a Surge configuration:
Snell = snell, snell.example.com, 8443, psk=secret, version=4, obfs=http, obfs-host=bing.com, reuse=true| Setting | Supported |
|---|---|
psk |
✅ |
version |
✅ 3 to 6. Without version, Surge uses v1, so Potatso doesn't import the line. |
obfs, obfs-host |
✅ See Obfuscation |
obfs-uri |
❌ |
reuse |
✅ |
mode |
✅ v6 only |
udp-port |
❌ |
shadow-tls-password |
❌ |
tfo |
❌ Ignored |
Potatso doesn't import a line that needs one of the unsupported settings, or obfs=tls with v4 or later, since it couldn't connect to that server.
Feature support
| Feature | Supported |
|---|---|
| Snell v3, v4, v5 and v6 | ✅ |
| Snell v1, v2 | ❌ |
| HTTP obfuscation (v3 to v5), TLS obfuscation (v3) | ✅ |
| v6 modes | ✅ |
| Connection reuse (v4 and later) | ✅ |
| UDP (v3 and later) | ✅ |
| v5 QUIC Proxy Mode | ❌ QUIC goes over UDP instead |
| ShadowTLS, Restls or JLS around Snell | ❌ |
snell:// links |
✅ |
Every supported version is tested against a real Snell server: snell-server v4, v5 and v6 from Surge, and open-snell for v3, since Surge no longer offers v3 servers.
When the PSK, the version or the obfuscation doesn't match, the server closes the connection. Check those three first when a Snell server never connects.
snell:// links
Snell has no official link format. Potatso reads and shares Snell servers as:
snell://psk@host:port?version=4&obfs=http&obfs-host=bing.com#name| Part | Description |
|---|---|
psk |
The PSK, percent-encoded. |
host |
Server address. Put an IPv6 address in square brackets, such as [2001:db8::1]. |
port |
Server port. |
version |
The Snell version, 4 when it's missing. |
obfs, obfs-host |
The obfuscation and its host name. |
name |
Optional. The server's name in Potatso. |
Examples
Each example shows the link to import. The PSK is secret.
A v4 server:
snell://secret@snell.example.com:8443?version=4#BasicA v4 server with HTTP obfuscation:
snell://secret@snell.example.com:8443?version=4&obfs=http&obfs-host=bing.com#HTTP