---
title: "Snell"
description: "The Snell versions, obfuscation, Surge settings and features Potatso supports."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.potatso.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Snell

A Snell server is described by a **PSK** (pre-shared key) and its **version**, and optionally by **obfuscation**. Snell is the Surge team's proxy protocol. The client's version must match the server's, so check it first: it's the `version` in your provider's Surge configuration, or the snell-server release your server runs.

You can add a Snell server by hand, with a [`snell://` link](#links), or by importing:

- a Clash or Mihomo subscription,
- a Surge configuration.

## Versions {#versions}

| Version | Supported | Tested with |
| --- | --- | --- |
| v1, v2 | ❌ | |
| v3 | ✅ | open-snell |
| v4 | ✅ | snell-server v4 |
| v5 | ✅ Without QUIC Proxy Mode | snell-server v5 |
| v6 | ✅ | snell-server v6 |

A v5 server also accepts v4 clients, and a v4 server accepts a client set to v5. Every other mix of versions doesn't connect.

v5's QUIC Proxy Mode is a way Surge relays QUIC traffic. Potatso relays QUIC like any other UDP traffic instead, so QUIC still works.

Snell v6 is in beta at Surge and may still change in ways that break older clients. Keep your server's version the one your provider recommends.

## Obfuscation {#obfuscation}

| Obfuscation | v3 | v4, v5 | v6 |
| --- | --- | --- | --- |
| None | ✅ | ✅ | ✅ |
| HTTP | ✅ | ✅ | |
| TLS | ✅ | ❌ The servers only offer HTTP | |

Obfuscation makes the connection's start look like an HTTP request or a TLS handshake. It must match the server's `obfs` setting. Set the **obfuscation host** to the host name your provider gives: without one, Potatso uses `bing.com`, as Clash does.

A v6 server has no obfuscation. It shapes its traffic from the PSK instead, and needs nothing on your device for that.

### v6 modes {#v6-modes}

| Mode | Supported |
| --- | --- |
| `default`: encryption and traffic shaping | ✅ |
| `unshaped`: encryption without traffic shaping | ✅ |
| `unsafe-raw`: no encryption, no shaping | ✅ |

The mode must match the server's `mode` setting. `unsafe-raw` sends your traffic as it is and doesn't check the PSK: use it only inside another secure tunnel.

## Connection reuse {#reuse}

With **Reuse Connections** on, Potatso keeps a Snell connection open when a connection to a website ends, and uses it for the next one. That saves a round trip. Reuse works with v4 and later. v3 servers never reuse a connection, so the setting doesn't show for v3.

## UDP {#udp}

Snell v3 and later carry UDP inside the Snell connection. UDP is off by default, as in Clash. Turn on UDP Relay in the server's settings if your server relays UDP. A Surge configuration always turns it on, as Surge does.

With a v5 server, UDP replies larger than about 2.5 KB arrive cut short: the server sends them in a form only Surge reads. Most UDP traffic, such as DNS, QUIC and calls, uses smaller packets. A v4 or v6 server doesn't have this problem.

## Surge settings {#surge}

Potatso imports the `snell` lines of a Surge configuration:

```text
Snell = snell, snell.example.com, 8443, psk=secret, version=4, obfs=http, obfs-host=bing.com, reuse=true
```

| Setting | Supported |
| --- | --- |
| `psk` | ✅ |
| `version` | ✅ 3 to 6. Without `version`, Surge uses v1, so Potatso doesn't import the line. |
| `obfs`, `obfs-host` | ✅ See [Obfuscation](#obfuscation) |
| `obfs-uri` | ❌ |
| `reuse` | ✅ |
| `mode` | ✅ v6 only |
| `udp-port` | ❌ |
| `shadow-tls-password` | ❌ |
| `tfo` | ❌ Ignored |

Potatso doesn't import a line that needs one of the unsupported settings, or `obfs=tls` with v4 or later, since it couldn't connect to that server.

## Feature support {#features}

| Feature | Supported |
| --- | --- |
| Snell v3, v4, v5 and v6 | ✅ |
| Snell v1, v2 | ❌ |
| HTTP obfuscation (v3 to v5), TLS obfuscation (v3) | ✅ |
| v6 modes | ✅ |
| Connection reuse (v4 and later) | ✅ |
| UDP (v3 and later) | ✅ |
| v5 QUIC Proxy Mode | ❌ QUIC goes over UDP instead |
| ShadowTLS, Restls or JLS around Snell | ❌ |
| `snell://` links | ✅ |

Every supported version is tested against a real Snell server: [snell-server](https://kb.nssurge.com/surge-knowledge-base/release-notes/snell) v4, v5 and v6 from Surge, and [open-snell](https://github.com/icpz/open-snell) for v3, since Surge no longer offers v3 servers.

When the PSK, the version or the obfuscation doesn't match, the server closes the connection. Check those three first when a Snell server never connects.

## `snell://` links {#links}

Snell has no official link format. Potatso reads and shares Snell servers as:

```text
snell://psk@host:port?version=4&obfs=http&obfs-host=bing.com#name
```

| Part | Description |
| --- | --- |
| `psk` | The PSK, percent-encoded. |
| `host` | Server address. Put an IPv6 address in square brackets, such as `[2001:db8::1]`. |
| `port` | Server port. |
| `version` | The Snell version, 4 when it's missing. |
| `obfs`, `obfs-host` | The obfuscation and its host name. |
| `name` | Optional. The server's name in Potatso. |

### Examples {#link-examples}

Each example shows the link to import. The PSK is `secret`.

A v4 server:

```text
snell://secret@snell.example.com:8443?version=4#Basic
```

A v4 server with HTTP obfuscation:

```text
snell://secret@snell.example.com:8443?version=4&obfs=http&obfs-host=bing.com#HTTP
```

Source: https://docs.potatso.com/protocols/snell/index.mdx