A SOCKS5 server opens connections for you and relays UDP, with or without a user name and password (RFC 1928). SOCKS5 over TLS is the same server reached over TLS, so the connection to the server is encrypted too.
Potatso sends the server the name of the site you visit, not its address, and the server looks the name up. This is what other apps call socks5h, or remote DNS.
You can add a SOCKS5 server by hand, with a socks5:// link, or by importing:
- a Clash or Mihomo subscription (
type: socks5), - a Surge configuration (
socks5andsocks5-tls), - an Xray or V2Ray configuration (
socksoutbound, with or without TLS).
To add a SOCKS5 over TLS server by hand, choose SOCKS5 and turn on TLS.
Settings
| Setting | Description |
|---|---|
| Server, port | The server's address and port. An IPv6 address works too. |
| Authentication | None, or a user name and password. |
| User name, password | Each up to 255 bytes. |
| UDP Relay | On by default. See UDP. |
| TLS | On for SOCKS5 over TLS. |
| Skip Certificate Verification | SOCKS5 over TLS only. Accepts any certificate. Use it only for testing. |
| Certificate pin | SOCKS5 over TLS only, optional. The SHA-256 fingerprint of the server's certificate, as 64 hex digits. With a pin, Potatso accepts the pinned certificate, including a self-signed one, and nothing else. |
If the server asks for a user name and password and you haven't set them, Potatso doesn't connect. Potatso doesn't support GSSAPI (Kerberos) authentication.
A Clash or Mihomo server with an empty username is imported without authentication, as Clash does.
Certificates
With SOCKS5 over TLS, the server name in the TLS handshake is always the server's address, and the server's certificate must be valid for it. If it isn't, set a certificate pin or turn on Skip Certificate Verification. You can't set a different server name: Potatso doesn't import a link, a Surge server or an Xray server that has one. Clash and Mihomo have no server name for SOCKS5, so Potatso ignores an sni there, as they do.
Potatso doesn't support:
- a custom CA certificate: pin the server's certificate instead,
- a TLS client certificate (Clash
certificateandprivate-key), or a different name to check the certificate against (name-cert-verify): Potatso doesn't import a server that needs one, - an ALPN list: Potatso imports the server without it.
UDP
UDP is used by QUIC, voice and video calls and many games. With UDP Relay on, Potatso sends UDP through the server (UDP ASSOCIATE), to IPv4 and IPv6 addresses. It also works with a server behind NAT that reports its address as 0.0.0.0: Potatso sends UDP to the address you set.
Turn UDP Relay off if your server doesn't relay UDP. Then:
- With rules, Potatso skips a rule that sends UDP to this server, and the next rule that matches decides. UDP that no other rule matches is sent directly.
- In Global mode, UDP doesn't work, because all traffic must go through the server.
Some things to know about UDP:
- UDP is relayed with the server's separate UDP port, so the server's firewall must let UDP through.
- With SOCKS5 over TLS, only the connection to the server is encrypted. SOCKS5 sends UDP outside it, so your UDP traffic reaches the server unencrypted.
- For UDP, Potatso looks up the site's address itself and sends the server the address.
- When you import from Clash, Mihomo or Surge, UDP Relay is on unless the server sets
udp: false(udp-relay=falsein Surge). Clash leaves UDP off whenudpis missing, so check that your server relays UDP.
Feature support
| Feature | Supported |
|---|---|
CONNECT to IPv4, IPv6 and domain targets (RFC 1928) |
✅ |
Remote DNS: domain names looked up by the server (socks5h) |
✅ For TCP |
| No authentication | ✅ |
| User name and password (RFC 1929) | ✅ |
| GSSAPI (RFC 1961) | ❌ |
UDP ASSOCIATE to IPv4 and IPv6 targets |
✅ |
UDP with a server behind NAT (0.0.0.0 relay address) |
✅ |
| UDP fragmentation | ❌ Fragmented datagrams are dropped, which RFC 1928 allows |
BIND (incoming connections, such as active-mode FTP) |
❌ |
| SOCKS5 over TLS | ✅ With certificate pin and skip-certificate-verification |
| TLS server name other than the server address, ALPN, custom CA, client certificate | ❌ |
| UDP encrypted with TLS | ❌ SOCKS5 sends UDP outside TLS |
| An IPv6 server address | ✅ |
| SOCKS4 and SOCKS4a | ❌ |
Every supported feature is tested against real SOCKS5 servers: Xray, sing-box, Mihomo, 3proxy and microsocks. sing-box serves SOCKS5 over TLS on its mixed inbound, not its socks inbound.
Links
A SOCKS5 link holds a whole server in one line:
socks5://user:password@host:port#name
socks5+tls://user:password@host:port?insecure=1#name| Part | Description |
|---|---|
| scheme | socks5://, socks:// or socks5h:// for SOCKS5; socks5+tls:// or socks+tls:// for SOCKS5 over TLS. Potatso always sends domain names to the server, so socks5h:// works the same as socks5://. |
user:password |
Optional. Percent-encode :, @ and other special characters in the password, for example p%3Ass for p:ss. The user name can't contain :. |
host |
Server address. Put an IPv6 address in square brackets, such as [2001:db8::1]. |
port |
Server port. |
insecure |
SOCKS5 over TLS only, optional. 1 turns on Skip Certificate Verification. Potatso also reads allowInsecure and skip-cert-verify. |
name |
Optional. The server's name in Potatso. |
A link can't hold a certificate pin. A link with an sni other than the server address isn't imported.
Potatso also imports two other forms:
socks://base64(user:password)@host:port#name
socks5://base64(user:password@host:port)#nameThe first is how v2rayN shares SOCKS servers. The second is the older form, where everything between :// and # is Base64-encoded. When Potatso shares a SOCKS5 server with a password, it offers the standard link and the v2rayN form.
Examples
A server without a password:
socks5://proxy.example.com:1080#OpenA server with the user name alice and the password s3cret:
socks5://alice:s3cret@proxy.example.com:1080#AuthThe password p:ss wörd, percent-encoded:
socks5://alice:p%3Ass%20w%C3%B6rd@proxy.example.com:1080#EncodedThe same server as a socks5h:// link:
socks5h://alice:s3cret@proxy.example.com:1080#Remote-DNSThe v2rayN form, with alice:s3cret Base64-encoded:
socks://YWxpY2U6czNjcmV0@proxy.example.com:1080#v2rayNThe older form:
socks5://YWxpY2U6czNjcmV0QHByb3h5LmV4YW1wbGUuY29tOjEwODA#LegacyA server with an IPv6 address:
socks5://[2001:db8::1]:1080#IPv6A SOCKS5 over TLS server:
socks5+tls://alice:s3cret@proxy.example.com:443#TLSA SOCKS5 over TLS server with a self-signed certificate:
socks+tls://proxy.example.com:443?insecure=1#Self-signed