---
title: "Trojan"
description: "The Trojan transports, TLS options, links and features Potatso supports."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.potatso.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Trojan

A Trojan server is described by a **password** and its **TLS settings**, and optionally a **transport** that carries the connection, such as WebSocket or gRPC. Trojan always runs inside TLS (or REALITY), so to anyone watching, the connection looks like an ordinary HTTPS visit. Potatso connects to a server when it supports the server's transport and TLS settings. Use the tables below to check your server's settings, as shown by your provider or in its `trojan://` link.

You can add a Trojan server by hand, with a [`trojan://` link](#links), or by importing:

- a Clash or Mihomo subscription,
- an Xray or V2Ray configuration,
- a Surge configuration.

Potatso doesn't import Trojan servers from a sing-box configuration yet. Use the server's `trojan://` link instead.

## Transports {#transports}

| Transport | Link `type` | Supported | Tested with |
| --- | --- | --- | --- |
| TLS only (no transport) | `tcp`, or none | ✅ | Xray, sing-box, trojan-go |
| WebSocket | `ws` | ✅ With or without early data | Xray, sing-box, trojan-go |
| gRPC | `grpc` | ✅ | Xray, sing-box |
| HTTP/2 | `http` or `h2` | ✅ | sing-box |
| HTTP Upgrade | `httpupgrade` | ✅ | Xray, sing-box |
| XHTTP | `xhttp` | ❌ | |
| mKCP, QUIC | `kcp`, `quic` | ❌ | |

Every transport works with UDP. Potatso doesn't import a server whose transport it doesn't support.

Xray no longer offers HTTP/2: Xray servers that used it now use XHTTP, which Potatso doesn't support yet.

## TLS {#tls}

| Setting | Clash key | Link parameter | Supported |
| --- | --- | --- | --- |
| Server name (SNI) | `sni` | `sni`, `peer` | ✅ Without one, Potatso uses the server's address. |
| ALPN | `alpn` | `alpn` | ✅ Without one, Potatso sends `h2, http/1.1`, or `http/1.1` for WebSocket and HTTP Upgrade, and `h2` for gRPC and HTTP/2. |
| Skip certificate verification | `skip-cert-verify` | `allowInsecure`, `insecure` | ✅ |
| Certificate pinning (SHA-256) | `fingerprint` | | ✅ |
| Browser fingerprint | `client-fingerprint` | `fp` | ✅ `chrome`, `firefox`, `safari`, `ios`, `android`, `edge` and `random`. Other names connect with a default handshake. |
| [REALITY](#reality) | `reality-opts` | `security=reality`, `pbk`, `sid` | ✅ With no transport or with gRPC |
| Encrypted Client Hello (ECH) | `ech-opts` | `ech` | ✅ With the ECH configuration in the link or subscription |
| Custom CA certificate | | | ❌ |
| TLS client certificate | `certificate`, `private-key` | | ❌ |

Turning off certificate verification lets anyone between you and the server read your traffic. Pin the server's certificate instead if it uses a self-signed one: set the SHA-256 of its certificate as the certificate pin.

A browser fingerprint makes the connection's TLS handshake look like that browser's. It doesn't change what the server must support.

### REALITY {#reality}

A REALITY server borrows another website's TLS certificate, so it doesn't need one of its own. Set the server's **public key** and **short ID** as your provider gives them, and the server name to the website the server borrows from. REALITY needs a browser fingerprint: when your link or settings don't have one, Potatso uses `chrome`.

REALITY works with no transport and with gRPC. Potatso doesn't import a REALITY server that uses another transport.

## Multiplexing {#mux}

Potatso can run several connections over one Trojan connection with sing-box's multiplexing (`smux`, `yamux` or `h2mux`), set with `smux` in a Clash subscription. The server must have multiplexing turned on. TCP and UDP both work.

trojan-go's own multiplexing (`mux` in a trojan-go server) is a different protocol, and Potatso doesn't support it. A trojan-go server still accepts Potatso's connections without it.

## UDP {#udp}

Trojan carries UDP over the same TLS connection as TCP. UDP is off by default, as in Clash. Turn on UDP Relay in the server's settings if your server relays UDP: Xray, sing-box and trojan-go all do. A Clash subscription turns it on with `udp: true`.

## Feature support {#features}

| Feature | Supported |
| --- | --- |
| [Trojan protocol](https://trojan-gfw.github.io/trojan/protocol): password hash, `CONNECT` | ✅ |
| Trojan `UDP ASSOCIATE` | ✅ |
| Trojan without TLS (`security=none`) | ❌ |
| Several users on one server | ✅ Each with their own password |
| WebSocket, gRPC, HTTP/2 and HTTP Upgrade transports | ✅ See [Transports](#transports) |
| XHTTP, mKCP and QUIC transports | ❌ |
| [REALITY](#reality) | ✅ With no transport or with gRPC |
| ECH | ✅ |
| sing-box multiplexing (smux, yamux, h2mux) | ✅ |
| trojan-go multiplexing | ❌ |
| trojan-go Shadowsocks encryption (`ss-opts`, `encryption=ss;…`) | ❌ |
| ShadowTLS, Restls or JLS around Trojan | ❌ |
| `trojan://` and `trojan-go://` links | ✅ |

Every supported feature is tested against at least one real Trojan server: [Xray](https://xtls.github.io/), [sing-box](https://sing-box.sagernet.org/) or [trojan-go](https://p4gefau1t.github.io/trojan-go/).

When a password is wrong, a Trojan server answers like an ordinary website instead (its fallback). Potatso then can't connect, and doesn't show a password error: check the password first when a Trojan server never connects.

Potatso doesn't import a server that uses trojan-go's Shadowsocks encryption, ShadowTLS, Restls or JLS around Trojan, since it would connect without them and the server wouldn't answer.

Some trojan-go features are settings of its own client program, and Potatso does the same job its own way:

- Routing: use rules in your profile.
- Local SOCKS5 and HTTP servers, and forwarding: Potatso captures your device's traffic itself.

## `trojan://` links {#links}

A `trojan://` link holds a whole server in one line:

```text
trojan://password@host:port?parameters#name
```

| Part | Description |
| --- | --- |
| `password` | The password, percent-encoded. Everything before the `@` is the password, including any `:`. |
| `host` | Server address. Put an IPv6 address in square brackets, such as `[2001:db8::1]`. |
| `port` | Server port. When it's missing, Potatso uses 443. |
| `name` | Optional. The server's name in Potatso. |

The parameters follow the format Xray and v2rayN use:

| Parameter | Description |
| --- | --- |
| `security` | `tls` (the default) or `reality`. |
| `type` | The [transport](#transports): `tcp`, `ws`, `grpc`, `http` (HTTP/2) or `httpupgrade`. |
| `sni`, `peer` | The TLS server name. |
| `alpn` | The ALPN list, separated by commas and percent-encoded. |
| `fp` | The browser fingerprint. |
| `allowInsecure` | `1` turns off certificate verification. |
| `host` | The HTTP `Host` for WebSocket, HTTP/2 and HTTP Upgrade. |
| `path` | The path for WebSocket, HTTP/2 and HTTP Upgrade. A WebSocket path such as `/ws?ed=2048` turns on early data. |
| `serviceName` | The gRPC service name. |
| `pbk`, `sid` | The REALITY public key and short ID. |
| `ech` | The ECH configuration, Base64-encoded and percent-encoded. |

Potatso also imports `trojan-go://` links, with `type=original` (no transport) or `type=ws`. It doesn't import one with an `encryption` parameter, which needs trojan-go's Shadowsocks encryption.

When Potatso shares a Trojan server, it offers a `trojan://` link with the same parameters.

### Examples {#link-examples}

Each example shows the link to import. The password is `secret`.

A basic server:

```text
trojan://secret@trojan.example.com:443?sni=trojan.example.com#Basic
```

WebSocket through `cdn.example.com`:

```text
trojan://secret@trojan.example.com:443?security=tls&type=ws&host=cdn.example.com&path=%2Fws#WebSocket
```

gRPC with the service name `TrojanGun`:

```text
trojan://secret@trojan.example.com:443?security=tls&type=grpc&serviceName=TrojanGun#gRPC
```

HTTP/2:

```text
trojan://secret@trojan.example.com:443?security=tls&type=http&host=cdn.example.com&path=%2Fh2#HTTP2
```

HTTP Upgrade:

```text
trojan://secret@trojan.example.com:443?security=tls&type=httpupgrade&host=cdn.example.com&path=%2Fup#Upgrade
```

REALITY, borrowing `www.example.com`:

```text
trojan://secret@trojan.example.com:443?security=reality&sni=www.example.com&pbk=Z84J2IelR9ch3k8VtlVhhs5ycBUlXA7wHBWcBrjqnAw&sid=0123abcd&fp=chrome#REALITY
```

Source: https://docs.potatso.com/protocols/trojan/index.mdx