VPN glossary: the key terms worth knowing

An Xray technique that makes VPN traffic look like a genuine TLS connection — ordinary HTTPS — to a real, well-known website, without needing its own certificate. That describes how it works; TUKTUKVPN makes no claim about networks that block VPNs.

A modern VPN protocol with a lean codebase and up-to-date cryptography, delivering high speed and low battery drain — today's most popular standard. Its limitation: the packet format is quite distinctive, so DPI can identify and block it on strictly filtered networks.

A modified WireGuard fork that changes WireGuard's packet pattern so packets carry none of its usual signatures, while keeping WireGuard's speed. TUKTUKVPN runs WireGuard/AmneziaWG as one of its protocols.

A protocol built on QUIC/UDP, designed to withstand lossy or high-latency networks using aggressive congestion control — so it often delivers better throughput on poor connections or long international routes.

An open-source encrypted proxy that originated in China in response to the Great Firewall. Modern DPI systems increasingly fingerprint its traffic, so plain Shadowsocks gets detected and blocked far more often than it once did. TUKTUKVPN runs VLESS+Reality instead, whose traffic looks like ordinary HTTPS. We make no claim about networks that block VPNs.

A long-established open-source VPN protocol — secure, thoroughly battle-tested, and supported on almost every device and router. Its trade-offs come with age: a heavier codebase, noticeably lower throughput than WireGuard, and a traffic pattern DPI can fingerprint fairly easily. TUKTUKVPN runs WireGuard/AmneziaWG, VLESS+Reality, and Hysteria2 instead. Worth knowing because many older VPN services still default to it.

The field in a TLS handshake that tells a server which website you want — sent in plain text, so anyone on the network path can read the destination even though everything else is encrypted. Censors use exactly this: they drop any handshake whose SNI names a forbidden site. Reality presents the SNI of a real website, so its handshake looks like ordinary HTTPS. That describes the design; TUKTUKVPN makes no claim about networks that block VPNs.

A modern transport protocol that runs over UDP instead of TCP — designed at Google, standardised by the IETF, and the foundation of HTTP/3. It sets up connections faster, recovers from packet loss more gracefully, and avoids TCP's head-of-line blocking. Hysteria2, one of TUKTUKVPN's protocols, builds on QUIC — which is why it connects quickly and holds up on lossy hotel or mobile networks. For VPN users, QUIC is the reason speed survives bad connections.

The newest version of HTTP, running over QUIC (UDP) instead of TCP, and already served by major platforms such as Google and Cloudflare. Hysteria2 runs over the same QUIC transport, which is why it handles lossy connections well.

China's internet censorship system, combining DPI, DNS poisoning, connection resets, and active probing of suspected servers to block both websites and VPNs. Widely considered one of the most sophisticated internet filtering systems in the world.

Techniques that make VPN traffic look like something else — ordinary HTTPS or QUIC — or that strip a protocol's signatures. VLESS + Reality traffic, for example, looks like ordinary HTTPS. Obfuscation describes how traffic looks; it is not a guarantee of connecting, and TUKTUKVPN makes no claim about networks that block VPNs.

A censorship technique — used most notably by China's Great Firewall — where the censor doesn't just watch traffic but connects back to a suspected VPN or proxy server, posing as a client, to confirm what it really is before blocking it. Older protocols such as Shadowsocks have been unmasked this way. A probe that reaches a Reality server gets a response from the real website it imitates; we make no claim about how any protocol fares against active probing.

A function that cuts internet access the instant the VPN drops, so real traffic and your real IP never leak outside the tunnel during the gap. An essential safeguard for anyone who needs continuous privacy.

The industry shorthand for a provider's data-retention posture — what it stores, for how long, and what a court could compel it to hand over. TUKTUKVPN keeps what the service needs to run: your account, how much data you have used against your plan, and your devices. Where Thai law requires us to retain data, we retain it and say so.

The country where a VPN company is registered and whose laws it answers to — determining how far a state can compel it to hand over or retain user data. TUKTUKVPN operates under Thai law, which obliges service providers to retain certain traffic data; weigh that alongside the retention policy itself.

When an internet provider deliberately limits throughput for particular traffic or a whole connection. A VPN can obscure some application details, but the ISP can still see VPN traffic and may limit it or all traffic. A slow app alone does not establish throttling: congestion and routing can also be involved. Compare the actual connection with the VPN on and off rather than assuming a VPN will fix it.

Making voice and video calls over the internet instead of the phone network, as WhatsApp, FaceTime, and Zoom do. Some countries restrict it: the UAE, notably, blocks many calling apps to protect licensed telecom services. We make no claim about calls over a VPN on such networks, and local rules still apply. It matters most to travellers and expats who rely on free calls home.