---
title: "SOCKS5 and SOCKS5 over TLS"
description: "The SOCKS5 and SOCKS5 over TLS options, links and features Potatso supports."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.potatso.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SOCKS5 and SOCKS5 over TLS

A SOCKS5 server opens connections for you and relays UDP, with or without a user name and password ([RFC 1928](https://www.rfc-editor.org/rfc/rfc1928)). **SOCKS5 over TLS** is the same server reached over TLS, so the connection to the server is encrypted too.

Potatso sends the server the name of the site you visit, not its address, and the server looks the name up. This is what other apps call `socks5h`, or remote DNS.

You can add a SOCKS5 server by hand, with a [`socks5://` link](#links), or by importing:

- a Clash or Mihomo subscription (`type: socks5`),
- a Surge configuration (`socks5` and `socks5-tls`),
- an Xray or V2Ray configuration (`socks` outbound, with or without TLS).

To add a SOCKS5 over TLS server by hand, choose **SOCKS5** and turn on **TLS**.

## Settings {#settings}

| Setting | Description |
| --- | --- |
| Server, port | The server's address and port. An IPv6 address works too. |
| Authentication | None, or a user name and password. |
| User name, password | Each up to 255 bytes. |
| UDP Relay | On by default. See [UDP](#udp). |
| TLS | On for SOCKS5 over TLS. |
| Skip Certificate Verification | SOCKS5 over TLS only. Accepts any certificate. Use it only for testing. |
| Certificate pin | SOCKS5 over TLS only, optional. The SHA-256 fingerprint of the server's certificate, as 64 hex digits. With a pin, Potatso accepts the pinned certificate, including a self-signed one, and nothing else. |

If the server asks for a user name and password and you haven't set them, Potatso doesn't connect. Potatso doesn't support GSSAPI (Kerberos) authentication.

A Clash or Mihomo server with an empty `username` is imported without authentication, as Clash does.

### Certificates {#certificates}

With SOCKS5 over TLS, the server name in the TLS handshake is always the server's address, and the server's certificate must be valid for it. If it isn't, set a [certificate pin](#settings) or turn on **Skip Certificate Verification**. You can't set a different server name: Potatso doesn't import a link, a Surge server or an Xray server that has one. Clash and Mihomo have no server name for SOCKS5, so Potatso ignores an `sni` there, as they do.

Potatso doesn't support:

- a custom CA certificate: pin the server's certificate instead,
- a TLS client certificate (Clash `certificate` and `private-key`), or a different name to check the certificate against (`name-cert-verify`): Potatso doesn't import a server that needs one,
- an ALPN list: Potatso imports the server without it.

## UDP {#udp}

UDP is used by QUIC, voice and video calls and many games. With **UDP Relay** on, Potatso sends UDP through the server (UDP ASSOCIATE), to IPv4 and IPv6 addresses. It also works with a server behind NAT that reports its address as `0.0.0.0`: Potatso sends UDP to the address you set.

Turn UDP Relay off if your server doesn't relay UDP. Then:

- With rules, Potatso skips a rule that sends UDP to this server, and the next rule that matches decides. UDP that no other rule matches is sent directly.
- In Global mode, UDP doesn't work, because all traffic must go through the server.

Some things to know about UDP:

- UDP is relayed with the server's separate UDP port, so the server's firewall must let UDP through.
- With SOCKS5 over TLS, only the connection to the server is encrypted. SOCKS5 sends UDP outside it, so your UDP traffic reaches the server unencrypted.
- For UDP, Potatso looks up the site's address itself and sends the server the address.
- When you import from Clash, Mihomo or Surge, UDP Relay is on unless the server sets `udp: false` (`udp-relay=false` in Surge). Clash leaves UDP off when `udp` is missing, so check that your server relays UDP.

## Feature support {#features}

| Feature | Supported |
| --- | --- |
| `CONNECT` to IPv4, IPv6 and domain targets ([RFC 1928](https://www.rfc-editor.org/rfc/rfc1928)) | ✅ |
| Remote DNS: domain names looked up by the server (`socks5h`) | ✅ For TCP |
| No authentication | ✅ |
| User name and password ([RFC 1929](https://www.rfc-editor.org/rfc/rfc1929)) | ✅ |
| GSSAPI ([RFC 1961](https://www.rfc-editor.org/rfc/rfc1961)) | ❌ |
| `UDP ASSOCIATE` to IPv4 and IPv6 targets | ✅ |
| UDP with a server behind NAT (`0.0.0.0` relay address) | ✅ |
| UDP fragmentation | ❌ Fragmented datagrams are dropped, which RFC 1928 allows |
| `BIND` (incoming connections, such as active-mode FTP) | ❌ |
| SOCKS5 over TLS | ✅ With certificate pin and skip-certificate-verification |
| TLS server name other than the server address, ALPN, custom CA, client certificate | ❌ |
| UDP encrypted with TLS | ❌ SOCKS5 sends UDP outside TLS |
| An IPv6 server address | ✅ |
| SOCKS4 and SOCKS4a | ❌ |

Every supported feature is tested against real SOCKS5 servers: [Xray](https://xtls.github.io/), [sing-box](https://sing-box.sagernet.org/), [Mihomo](https://wiki.metacubex.one/), [3proxy](https://3proxy.org/) and [microsocks](https://github.com/rofl0r/microsocks). sing-box serves SOCKS5 over TLS on its `mixed` inbound, not its `socks` inbound.

## Links {#links}

A SOCKS5 link holds a whole server in one line:

```text
socks5://user:password@host:port#name
socks5+tls://user:password@host:port?insecure=1#name
```

| Part | Description |
| --- | --- |
| scheme | `socks5://`, `socks://` or `socks5h://` for SOCKS5; `socks5+tls://` or `socks+tls://` for SOCKS5 over TLS. Potatso always sends domain names to the server, so `socks5h://` works the same as `socks5://`. |
| `user:password` | Optional. Percent-encode `:`, `@` and other special characters in the password, for example `p%3Ass` for `p:ss`. The user name can't contain `:`. |
| `host` | Server address. Put an IPv6 address in square brackets, such as `[2001:db8::1]`. |
| `port` | Server port. |
| `insecure` | SOCKS5 over TLS only, optional. `1` turns on Skip Certificate Verification. Potatso also reads `allowInsecure` and `skip-cert-verify`. |
| `name` | Optional. The server's name in Potatso. |

A link can't hold a certificate pin. A link with an `sni` other than the server address isn't imported.

Potatso also imports two other forms:

```text
socks://base64(user:password)@host:port#name
socks5://base64(user:password@host:port)#name
```

The first is how v2rayN shares SOCKS servers. The second is the older form, where everything between `://` and `#` is Base64-encoded. When Potatso shares a SOCKS5 server with a password, it offers the standard link and the v2rayN form.

### Examples {#link-examples}

A server without a password:

```text
socks5://proxy.example.com:1080#Open
```

A server with the user name `alice` and the password `s3cret`:

```text
socks5://alice:s3cret@proxy.example.com:1080#Auth
```

The password `p:ss wörd`, percent-encoded:

```text
socks5://alice:p%3Ass%20w%C3%B6rd@proxy.example.com:1080#Encoded
```

The same server as a `socks5h://` link:

```text
socks5h://alice:s3cret@proxy.example.com:1080#Remote-DNS
```

The v2rayN form, with `alice:s3cret` Base64-encoded:

```text
socks://YWxpY2U6czNjcmV0@proxy.example.com:1080#v2rayN
```

The older form:

```text
socks5://YWxpY2U6czNjcmV0QHByb3h5LmV4YW1wbGUuY29tOjEwODA#Legacy
```

A server with an IPv6 address:

```text
socks5://[2001:db8::1]:1080#IPv6
```

A SOCKS5 over TLS server:

```text
socks5+tls://alice:s3cret@proxy.example.com:443#TLS
```

A SOCKS5 over TLS server with a self-signed certificate:

```text
socks+tls://proxy.example.com:443?insecure=1#Self-signed
```

Source: https://docs.potatso.com/protocols/socks5/index.mdx