Hysteria2

QUIC to a server you already run. The password is the credential.

tunelly is a client. A hysteria2:// or hy2:// link, or a subscription that lists one, is enough. The app opens one QUIC connection to that server and carries streams on it. We operate no servers and sell no access.

What a link carries

There is no separate transport or security section. The handshake is QUIC; the only choices left are how the certificate is judged.

auth

The password. A panel usually issues one per user. Empty is an incomplete record, and import stops.

sni

The name presented in the handshake, when the profile sets one.

alpn

h3 unless the operator picked something else.

pinSHA256

SHA-256 of the leaf certificate, when the profile publishes it. Self-signed deployments use this as the check.

What the engine does with it

The QUIC connection is kept between streams and dialled again if it has died — a server restart, or the phone changing network. The first use of the tunnel opens it; fifty simultaneous handshakes to the same address are not started at once.

A latency figure for Hysteria2 is a request through that tunnel, not a ping of the address.

What is not carried

Obfuscation on the UDP payload is refused. Port hopping is refused. Both change what is on the wire before QUIC starts; a tunnel built without them would reach a server listening for something else, and look like a dead node. The app names the feature and stops.

Hysteria 1 is a different protocol and is refused.

Putting it in the app

Paste the link, or add the subscription address that lists it. How to add a configuration covers the clipboard and a link that does not open the app.

The same engine also speaks VLESS and WireGuard. If you do not have a configuration yet, where to get servers explains how one reaches you, without naming anyone to buy from.