Hysteria 2: What Masquerade and Obfuscation Actually Do

Most write-ups of Hysteria 2 describe it as fast. That is the least interesting thing about it. What makes it worth understanding is that it stacks three separate disguises, each solving a different problem, and its own documentation tells you when to leave them off.

Layer one: looking like the web

Hysteria 2 runs over QUIC, and by default the Hysteria protocol mimics HTTP/3.

This is the baseline disguise and it costs nothing. A network doing shallow inspection sees UDP traffic shaped like modern web browsing, because that is increasingly what modern web browsing looks like. No configuration, no password, no performance cost.

It also sets the trap that the next two layers exist to escape.

Layer two: when QUIC itself is the problem

If HTTP/3 is what you look like, then a network that blocks HTTP/3 blocks you. The documentation is precise about this narrow case: if your network specifically blocks QUIC or HTTP/3 traffic (but not UDP in general), obfuscation can be used to work around this.

Two implementations are offered, Salamander and Gecko, and both need a matching password on client and server.

Read the condition carefully, because it contains a but. Obfuscation helps when QUIC is blocked and UDP is not. If the network drops UDP wholesale, obfuscating the QUIC handshake changes nothing, and you need a different transport entirely. Enabling obfuscation because it sounds safer is how people spend an evening debugging a tunnel that was never going to work.

Layer three: surviving an actual visit

The first two layers handle traffic that is watched. Masquerade handles traffic that is probed.

With it configured, the server also responds to HTTP requests like a regular web server. The documentation gives the reason without euphemism: your server must actually serve some content to make it appear authentic to potential censors.

That word actually is the whole point. A censor testing an address does not analyse packet timing, it opens a connection and asks for a page. A server that returns nothing has failed the simplest possible test, and an address that refuses to behave like a website while speaking something HTTP-shaped is more conspicuous than one that never tried to hide.

The sentence that should decide your config

Buried in the reference is the line that saves the most time:

If censorship is not a concern, you can omit the masquerade section entirely.

This tells you what masquerade is not. It is not encryption, not authentication, not a hardening measure. It is a countermeasure against active probing by a censor, and outside that threat model it adds configuration surface for nothing.

The same logic runs through the whole design. Each layer answers a specific adversary: shallow inspection, protocol blocking, active probing. Enabling all three by reflex means maintaining defences against threats you may not face, and every unnecessary option is one more thing to misconfigure.

The bandwidth settings, since they confuse everyone

They are limits, not promises. The server values act as speed limits, limiting the maximum rate at which the server will send and receive data (per client), and they can be omitted or set to zero for no limit.

The naming is where people trip: the server's upload speed is the client's download speed, and vice versa. Setting what you think is a generous download cap on the server while actually capping uploads is a common and entirely self-inflicted bottleneck.

Hysteria only makes sense on a server you control, since masquerade means the machine has to serve real content under your own domain. A small VPS is enough for the traffic most people push through it.

The honest summary

Hysteria 2 is three disguises in a trench coat, and that is a compliment. QUIC mimicking HTTP/3 by default, obfuscation for the narrow case where QUIC specifically is blocked but UDP is not, and masquerade so the server survives being visited rather than merely observed.

Match the layer to the adversary you actually have. The documentation itself tells you to skip masquerade if censorship is not a concern, and taking that advice literally will give you a simpler config that fails in fewer places.

The transport description, the statement that the protocol mimics HTTP/3 by default, the obfuscation condition regarding QUIC or HTTP/3 being blocked but not UDP in general, the Salamander and Gecko options, the masquerade behaviour and its stated purpose of appearing authentic to potential censors, the permission to omit masquerade when censorship is not a concern, and the bandwidth semantics including the upload and download inversion, are taken from the Hysteria 2 server configuration documentation, checked at the time of writing. Configuration options change between releases; verify against the version you deploy. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.