A Trojan server is described by a password and its TLS settings, and optionally a transport that carries the connection, such as WebSocket or gRPC. Trojan always runs inside TLS (or REALITY), so to anyone watching, the connection looks like an ordinary HTTPS visit. Potatso connects to a server when it supports the server's transport and TLS settings. Use the tables below to check your server's settings, as shown by your provider or in its trojan:// link.
You can add a Trojan server by hand, with a trojan:// link, or by importing:
- a Clash or Mihomo subscription,
- an Xray or V2Ray configuration,
- a Surge configuration.
Potatso doesn't import Trojan servers from a sing-box configuration yet. Use the server's trojan:// link instead.
Transports
| Transport | Link type |
Supported | Tested with |
|---|---|---|---|
| TLS only (no transport) | tcp, or none |
✅ | Xray, sing-box, trojan-go |
| WebSocket | ws |
✅ With or without early data | Xray, sing-box, trojan-go |
| gRPC | grpc |
✅ | Xray, sing-box |
| HTTP/2 | http or h2 |
✅ | sing-box |
| HTTP Upgrade | httpupgrade |
✅ | Xray, sing-box |
| XHTTP | xhttp |
❌ | |
| mKCP, QUIC | kcp, quic |
❌ |
Every transport works with UDP. Potatso doesn't import a server whose transport it doesn't support.
Xray no longer offers HTTP/2: Xray servers that used it now use XHTTP, which Potatso doesn't support yet.
TLS
| Setting | Clash key | Link parameter | Supported |
|---|---|---|---|
| Server name (SNI) | sni |
sni, peer |
✅ Without one, Potatso uses the server's address. |
| ALPN | alpn |
alpn |
✅ Without one, Potatso sends h2, http/1.1, or http/1.1 for WebSocket and HTTP Upgrade, and h2 for gRPC and HTTP/2. |
| Skip certificate verification | skip-cert-verify |
allowInsecure, insecure |
✅ |
| Certificate pinning (SHA-256) | fingerprint |
✅ | |
| Browser fingerprint | client-fingerprint |
fp |
✅ chrome, firefox, safari, ios, android, edge and random. Other names connect with a default handshake. |
| REALITY | reality-opts |
security=reality, pbk, sid |
✅ With no transport or with gRPC |
| Encrypted Client Hello (ECH) | ech-opts |
ech |
✅ With the ECH configuration in the link or subscription |
| Custom CA certificate | ❌ | ||
| TLS client certificate | certificate, private-key |
❌ |
Turning off certificate verification lets anyone between you and the server read your traffic. Pin the server's certificate instead if it uses a self-signed one: set the SHA-256 of its certificate as the certificate pin.
A browser fingerprint makes the connection's TLS handshake look like that browser's. It doesn't change what the server must support.
REALITY
A REALITY server borrows another website's TLS certificate, so it doesn't need one of its own. Set the server's public key and short ID as your provider gives them, and the server name to the website the server borrows from. REALITY needs a browser fingerprint: when your link or settings don't have one, Potatso uses chrome.
REALITY works with no transport and with gRPC. Potatso doesn't import a REALITY server that uses another transport.
Multiplexing
Potatso can run several connections over one Trojan connection with sing-box's multiplexing (smux, yamux or h2mux), set with smux in a Clash subscription. The server must have multiplexing turned on. TCP and UDP both work.
trojan-go's own multiplexing (mux in a trojan-go server) is a different protocol, and Potatso doesn't support it. A trojan-go server still accepts Potatso's connections without it.
UDP
Trojan carries UDP over the same TLS connection as TCP. UDP is off by default, as in Clash. Turn on UDP Relay in the server's settings if your server relays UDP: Xray, sing-box and trojan-go all do. A Clash subscription turns it on with udp: true.
Feature support
| Feature | Supported |
|---|---|
Trojan protocol: password hash, CONNECT |
✅ |
Trojan UDP ASSOCIATE |
✅ |
Trojan without TLS (security=none) |
❌ |
| Several users on one server | ✅ Each with their own password |
| WebSocket, gRPC, HTTP/2 and HTTP Upgrade transports | ✅ See Transports |
| XHTTP, mKCP and QUIC transports | ❌ |
| REALITY | ✅ With no transport or with gRPC |
| ECH | ✅ |
| sing-box multiplexing (smux, yamux, h2mux) | ✅ |
| trojan-go multiplexing | ❌ |
trojan-go Shadowsocks encryption (ss-opts, encryption=ss;…) |
❌ |
| ShadowTLS, Restls or JLS around Trojan | ❌ |
trojan:// and trojan-go:// links |
✅ |
Every supported feature is tested against at least one real Trojan server: Xray, sing-box or trojan-go.
When a password is wrong, a Trojan server answers like an ordinary website instead (its fallback). Potatso then can't connect, and doesn't show a password error: check the password first when a Trojan server never connects.
Potatso doesn't import a server that uses trojan-go's Shadowsocks encryption, ShadowTLS, Restls or JLS around Trojan, since it would connect without them and the server wouldn't answer.
Some trojan-go features are settings of its own client program, and Potatso does the same job its own way:
- Routing: use rules in your profile.
- Local SOCKS5 and HTTP servers, and forwarding: Potatso captures your device's traffic itself.
trojan:// links
A trojan:// link holds a whole server in one line:
trojan://password@host:port?parameters#name| Part | Description |
|---|---|
password |
The password, percent-encoded. Everything before the @ is the password, including any :. |
host |
Server address. Put an IPv6 address in square brackets, such as [2001:db8::1]. |
port |
Server port. When it's missing, Potatso uses 443. |
name |
Optional. The server's name in Potatso. |
The parameters follow the format Xray and v2rayN use:
| Parameter | Description |
|---|---|
security |
tls (the default) or reality. |
type |
The transport: tcp, ws, grpc, http (HTTP/2) or httpupgrade. |
sni, peer |
The TLS server name. |
alpn |
The ALPN list, separated by commas and percent-encoded. |
fp |
The browser fingerprint. |
allowInsecure |
1 turns off certificate verification. |
host |
The HTTP Host for WebSocket, HTTP/2 and HTTP Upgrade. |
path |
The path for WebSocket, HTTP/2 and HTTP Upgrade. A WebSocket path such as /ws?ed=2048 turns on early data. |
serviceName |
The gRPC service name. |
pbk, sid |
The REALITY public key and short ID. |
ech |
The ECH configuration, Base64-encoded and percent-encoded. |
Potatso also imports trojan-go:// links, with type=original (no transport) or type=ws. It doesn't import one with an encryption parameter, which needs trojan-go's Shadowsocks encryption.
When Potatso shares a Trojan server, it offers a trojan:// link with the same parameters.
Examples
Each example shows the link to import. The password is secret.
A basic server:
trojan://secret@trojan.example.com:443?sni=trojan.example.com#BasicWebSocket through cdn.example.com:
trojan://secret@trojan.example.com:443?security=tls&type=ws&host=cdn.example.com&path=%2Fws#WebSocketgRPC with the service name TrojanGun:
trojan://secret@trojan.example.com:443?security=tls&type=grpc&serviceName=TrojanGun#gRPCHTTP/2:
trojan://secret@trojan.example.com:443?security=tls&type=http&host=cdn.example.com&path=%2Fh2#HTTP2HTTP Upgrade:
trojan://secret@trojan.example.com:443?security=tls&type=httpupgrade&host=cdn.example.com&path=%2Fup#UpgradeREALITY, borrowing www.example.com:
trojan://secret@trojan.example.com:443?security=reality&sni=www.example.com&pbk=Z84J2IelR9ch3k8VtlVhhs5ycBUlXA7wHBWcBrjqnAw&sid=0123abcd&fp=chrome#REALITY