What Is OBFS TLS?
OBFS TLS is a plugin for Shadowsocks that disguises your traffic as a normal HTTPS session. The name "TLS" refers to Transport Layer Security, the encryption protocol behind HTTPS. By mimicking a TLS handshake and encrypted payload, the plugin makes your proxy traffic indistinguishable from ordinary secure web browsing.
This is especially useful on networks that allow HTTPS but block unknown or suspicious traffic. Because OBFS TLS traffic looks exactly like the HTTPS connections used by banks, email services, and popular websites, it is very difficult for network filters to single it out for blocking.
How OBFS TLS Works with Shadowsocks-Libev
Shadowsocks-Libev supports the SIP003 plugin system, which allows plugins like OBFS TLS to run alongside the core protocol. When you enable OBFS TLS on both the client and server, every packet is wrapped to resemble a TLS record before being sent over the network.
On the server side, the plugin unwraps the TLS-like envelope, decrypts the Shadowsocks payload, and forwards the request to its intended destination. To an external observer, the entire exchange looks like a standard HTTPS connection between your device and a web server.
OBFS TLS vs OBFS HTTP
Both OBFS HTTP and OBFS TLS are obfuscation plugins, but they mimic different types of traffic. OBFS HTTP makes your connection look like plain HTTP, which is unencrypted and easily identifiable. OBFS TLS makes your connection look like HTTPS, which is encrypted and far more common on modern networks.
In most cases, OBFS TLS is the safer choice because HTTPS is universally allowed and harder to distinguish from real traffic. OBFS HTTP may still be useful on older networks where HTTP is more common, but for modern environments OBFS TLS is usually the better option.
How to Get Started
First, select a country from the list above. Then click the Create button to generate your server credentials, including the address, port, password, encryption method, and OBFS TLS plugin settings.
Next, install a Shadowsocks client that supports SIP003 plugins — for example, Shadowsocks-Android, Shadowsocks-Windows, or Shadowsocks-Libev on Linux. Import the configuration, enable the OBFS TLS plugin, and connect. You can verify the connection by checking your public IP address.
Frequently Asked Questions
Is OBFS TLS the same as HTTPS?
No. OBFS TLS only makes your traffic resemble HTTPS. The actual encryption is still handled by Shadowsocks. The purpose of the plugin is disguise, not to replace the encryption layer.
Which is better, OBFS TLS or OBFS HTTP?
For most modern networks, OBFS TLS is more effective because HTTPS is widely allowed and its encrypted nature makes the traffic harder to inspect. OBFS HTTP may be sufficient on networks that only inspect unencrypted traffic.
Do I need a special client for OBFS TLS?
Yes. Your Shadowsocks client must support the SIP003 plugin system. Most modern clients include this by default, but older or simplified clients may not.
Does OBFS TLS slow down my connection?
The overhead is small. While there is extra processing to wrap and unwrap each packet, in practice the speed difference is negligible for browsing, streaming, or gaming.