TUIC v5 Protocol: Clients, Server Panels and VPNs That Support It
Searching "tuic" leads to a protocol, not a subscription. TUIC relays TCP and UDP inside a single QUIC connection, and the things around it come in four kinds: client apps that need a server you already have, cores that power those apps, panels that turn a rented VPS into a server, and one provider that ships ready servers. Of the 14 entries on the ranking page, two (StelsVPN and Stash) publish enough data to make the main ranking, and nowhere on the list has an outside party verified the no-logs promises. Read more
Sorted by this page’s weighting: Censorship bypass weighs 40% on this page. Each row also shows the overall score.
Ready-made lists
- Works under heavy blocking
- Anonymous
- Honest free
- Trial without a card
- No price rise at renewal
- Netflix and streaming
- Gaming
- For business
All filters by topic: Price and payment · Anonymity and privacy · VPN security · VPN protocols · VPNs by platform · VPNs by use case · Travel and restrictions · VPN jurisdictions · VPN servers by country · VPN customer support · VPN segments
| # | Service | Page score | Protocols | Clients and configs | Obfuscation | From | |
|---|---|---|---|---|---|---|---|
| 1 | StelsVPN | 4.79overall 3.81 | WireGuard, OpenVPN, IKEv2, VLESS / Reality… | — | — | Protocols: WireGuard, OpenVPN, IKEv2, VLESS / Reality… | €3.99per month |
| 2 | L×Box | 4.38overall 2.64 | WireGuard, VLESS / Reality, VMess, Trojan… | subscription links; Base64; Xray… | Yes DPI bypass: REALITY, XHTTP,… | Protocols: WireGuard, VLESS / Reality, VMess, Trojan…; Clients and configs: subscription links; Base64; Xray…; Obfuscation: yes (DPI bypass: REALITY, XHTTP,… | — |
| 3 | Hiddify | 4.18overall 3.15 | VLESS / Reality, VMess, Trojan, Hysteria2… | subscription links (multiple… | Yes Reality, ECH etc. | Protocols: VLESS / Reality, VMess, Trojan, Hysteria2…; Clients and configs: subscription links (multiple…; Obfuscation: yes (Reality, ECH etc.) | — |
| 4 | 3X-UI | 4.09overall 2.42 | WireGuard, VLESS / Reality, VMess, Trojan… | subscription links; QR codes; … | Yes REALITY, XTLS, fallbacks on… | Protocols: WireGuard, VLESS / Reality, VMess, Trojan…; Clients and configs: subscription links; QR codes; …; Obfuscation: yes (REALITY, XTLS, fallbacks on… | — |
| 5 | Hiddify Manager | 4.02overall 2.52 | WireGuard, VLESS / Reality, VMess, Trojan… | user pages with configs /… | Yes Reality, CDN, ShadowTLS | Protocols: WireGuard, VLESS / Reality, VMess, Trojan…; Clients and configs: user pages with configs /…; Obfuscation: yes (Reality, CDN, ShadowTLS) | — |
| 6 | Stash | 3.95overall 2.62 | WireGuard, VLESS / Reality, VMess, Trojan… | YAML profile import | — | Protocols: WireGuard, VLESS / Reality, VMess, Trojan…; Clients and configs: YAML profile import | €1.15per month |
| 7 | Exclave | 3.69overall 2.05 | WireGuard, VLESS / Reality, VMess, Trojan… | subscriptions; groups; routing; … | — | Protocols: WireGuard, VLESS / Reality, VMess, Trojan…; Clients and configs: subscriptions; groups; routing; … | — |
| 8 | Shadowrocket | 3.60overall 2.13 | WireGuard, VLESS / Reality, VMess, Trojan… | user-supplied… | — | Protocols: WireGuard, VLESS / Reality, VMess, Trojan…; Clients and configs: user-supplied… | — |
| 9 | sing-box | 3.50overall 2.37 | WireGuard, OpenVPN, VLESS / Reality, VMess… | JSON config / user-provided… | Yes | Protocols: WireGuard, OpenVPN, VLESS / Reality, VMess…; Clients and configs: JSON config / user-provided…; Obfuscation: yes… | — |
| 10 | NekoBox | 3.39overall 2.02 | WireGuard, VLESS / Reality, VMess, Trojan… | subscription links (Shadowsocks,… | Yes via obfuscated protocols | Protocols: WireGuard, VLESS / Reality, VMess, Trojan…; Clients and configs: subscription links (Shadowsocks,…; Obfuscation: yes (via obfuscated protocols) | — |
| 11 | NekoBox for Android | 3.39overall 2.02 | WireGuard, VLESS / Reality, VMess, Trojan… | subscription links (Shadowsocks,… | Yes via obfuscated protocols | Protocols: WireGuard, VLESS / Reality, VMess, Trojan…; Clients and configs: subscription links (Shadowsocks,…; Obfuscation: yes (via obfuscated protocols) | — |
| 12 | S-UI | 3.36overall 1.99 | VLESS / Reality, VMess, Trojan, Shadowsocks… | subscription link (link, JSON,… | Yes ShadowTLS/XTLS/naive | Protocols: VLESS / Reality, VMess, Trojan, Shadowsocks…; Clients and configs: subscription link (link, JSON,…; Obfuscation: yes (ShadowTLS/XTLS/naive) | — |
| 13 | mihomo (Clash Meta) | 3.36overall 1.78 | WireGuard, OpenVPN, VLESS / Reality, VMess… | YAML config, rule/proxy providers… | Yes via supported obfuscated… | Protocols: WireGuard, OpenVPN, VLESS / Reality, VMess…; Clients and configs: YAML config, rule/proxy providers…; Obfuscation: yes (via supported obfuscated… | — |
| 14 | Karing | 3.06overall 1.95 | WireGuard, VLESS / Reality, VMess, Trojan… | subscription link / Clash config… | — | Protocols: WireGuard, VLESS / Reality, VMess, Trojan…; Clients and configs: subscription link / Clash config… | — |
Provider, app, core or panel
StelsVPN alone runs its own network: 700+ servers across 12 countries and apps for all major platforms. The eight client apps bring no servers; they dial whatever a share link or subscription points to. The cores, sing-box and mihomo, are the engines inside most of these apps, and the three panels (3X-UI, Hiddify Manager, S-UI) set up a server on your own VPS.
Version compatibility is where newcomers fall. Version 5 authenticates with a UUID plus a password; v4 used a single token. A v4 profile will not log in to a v5 server, so an old config dies silently. The official repo names the implementations.
How TUIC differs from Hysteria2
Both run over QUIC on top of UDP, and every one of the 14 entries also supports Hysteria2. TUIC stays lean: standard congestion control, no obfuscation layer of its own, and it counts on looking like ordinary QUIC traffic. Hysteria2 stacks Brutal congestion control, Salamander obfuscation and an HTTP/3 masquerade for hostile networks. TUIC's advantages are protocol-side: one multiplexed connection survives a switch from Wi-Fi to mobile data, and it gets full-cone NAT for UDP, which matters for games and calls. Networks that inspect QUIC closely call for the heavier option, covered on the Hysteria2 page.
What the top three scores show
| Entry | Role | Page score | Jurisdiction | Cheapest paid | Devices | Platforms |
|---|---|---|---|---|---|---|
| StelsVPN | provider with servers | 4.79 (overall 3.81) | Cyprus | €3.99/mo | 10 | Windows, macOS, Linux, iOS, Android |
| L×Box | free Android client | 4.38 (overall 2.64) | not stated | free | n/a | Android 7.0+ |
| Hiddify | free client | 4.18 (overall 3.15) | not stated | free | self-hosted | Windows, macOS, Linux, iOS, Android |
Censorship bypass carries 40% of the score, and its sub-scores range from 6.7 to 8.6 across the trio. Privacy sits at 1.0–3.3: no entry anywhere has an independent audit, StelsVPN's no-logs claim rests on its own word, and sign-up demands an email. The two free clients score zero on network because they ship no servers of their own.
Choosing a client for your device
| Platform | Clients from this list | Cost |
|---|---|---|
| Android | L×Box, Exclave, NekoBox for Android, Hiddify, sing-box, Karing | free |
| iPhone / iPad | Hiddify, sing-box, Karing, Shadowrocket, Stash | free; two paid |
| Mac | Hiddify, sing-box, Karing, Shadowrocket, Stash | free; two paid |
| Windows, Linux | Hiddify, sing-box, Karing | free |
NekoBox for Android distributes builds through GitHub releases and states the Google Play version is a third-party build. Shadowrocket is a $2.99 one-time purchase on the US App Store; Stash is a one-time App Store purchase on iPhone and iPad, and from £12 a year on macOS.
Hosting a TUIC v5 server on a VPS
All three panels are free and GPL-3.0. 3X-UI (44.5k GitHub stars) has a native TUIC v5 server, Hiddify Manager handles multi-user setups on Ubuntu 22.04, and S-UI is built on sing-box. One trap: the S-UI default login is admin/admin. Change it before anything else.
Four settings decide how the profile behaves. A valid TLS certificate is mandatory, since everything rides TLS. Keep UDP relay at its native mode unless a call or game loses packets; quic mode delivers losslessly at the cost of overhead. Cubic is the sing-box default for congestion control, with bbr and new_reno as alternatives. The optional 0-RTT handshake speeds up setup but, per the mihomo docs, raises replay risk, which makes it a poor fit for anything sensitive.
When the network cuts UDP or QUIC
TUIC has no TCP mode. On hotel Wi-Fi, corporate firewalls or carrier networks that filter UDP, it stalls at "connecting" with no useful error. Quick test: run the same profile on another network. If it connects there, the first network is filtering. Keep a TCP fallback ready: VLESS with Reality (9 of the 14 entries) or Trojan (all 14). The VLESS ranking lists providers that carry it.
TUIC FAQ
Is TUIC free?
The protocol is licence-free and 12 of the 14 entries cost nothing; you pay for a server or provider.
Does a v4 config work on a v5 server?
No. Build the profile anew with a UUID and password.
Can I use TUIC on an iPhone?
Yes, through Hiddify, sing-box, Karing, Shadowrocket or Stash.
Which route to take
Without a server and without plans to run one, StelsVPN is the only entry handing out ready TUIC servers, from €3.99 a month on the yearly plan (€5.99 month to month). Already holding a server: Hiddify on any platform, L×Box if it is Android. Want your own endpoint: install a panel on a VPS and generate v5 inbounds. The cheapest paid option on the page is Stash at €1.15 a month, and that buys only a client, no servers. Whichever path you pick, keep a TCP fallback next to TUIC, because a filtered UDP network will stall it every time.