AnyTLS.cc民间说明站 · 不是官方项目Unofficial field guide

只讲公开格式 · 不提供接入Public format only · no access service

01 定义01 Definition

加密交给 TLS，协议只管复用和包长。TLS does the encryption. The protocol handles reuse and packet length.

AnyTLS 是 2025 年公开的一种代理协议。名字的意思是 Any in TLS：它自己不加密，加密靠外面那层 TLS，和打开 https 网站是同一类。它负责两件事：一条加密连接可以接着用，以及前几个数据包按一份方案补齐长度。AnyTLS is a proxy protocol published in 2025. The name means Any in TLS: it does not encrypt. Encryption is the outer TLS, the same kind used when you open an https site. It does two jobs: an encrypted connection can be reused, and the first few packets are padded to lengths from a scheme.

协议原文在 anytls.wiki，参考实现在 anytls-go。sing-box、mihomo、Shadowrocket 的文档里已经能看到它。The spec is on anytls.wiki. The reference implementation is anytls-go. sing-box, mihomo, and Shadowrocket already document it.

02 链路02 Path

一次连接里的五步Five steps in one connection

顺序来自公开的协议说明，用来看每个字段发生在哪一步。The order comes from the public spec, so you can see where each field is used.

  1. 01
    先建立 TLSTLS first软件和服务器做一次普通的 TLS 握手。服务器地址、端口、证书名称（SNI）都在这一步。The client and server do an ordinary TLS handshake. Address, port, and certificate name (SNI) belong here.
  2. 02
    核对密码指纹Password fingerprint握手完成后发送密码的 SHA-256，32 字节，不发送密码原文。这一步连同后面的填充，固定还有 2 字节的长度。After the handshake the client sends SHA-256 of the password, 32 bytes, not the password itself. Together with the padding that follows, this step also sends a fixed 2-byte length.
  3. 03
    按方案补长度Pad to the scheme前几个包的长度由填充方案决定。第 0 个包和密码指纹一起发出，不能再拆开。方案可以之后由服务器发给软件，下一条新连接再用。The first packets take their lengths from a padding scheme. Packet 0 goes out with the fingerprint and cannot be split. The server can send a new scheme later; the next new connection uses it.
  4. 04
    打开要去的地址Open the destination同一条 TLS 里用帧对话。软件告诉服务器这次要去哪里，然后两边转发。UDP 走一条名叫 UDP-over-TCP 的流。Frames run inside the same TLS session. The client tells the server where this visit goes, then both sides relay. UDP rides a stream called UDP-over-TCP.
  5. 05
    连接先留着Keep the connection这次访问结束后，整条 TLS 可以先空着。下次优先用最近这一条，少做一次握手。空太久再关掉。When the visit ends, the TLS session can stay idle. The next visit prefers the newest one and skips a handshake. Sessions that stay idle too long are closed.

03 兼容03 Support

谁能读写这个协议Who can speak this protocol

按 2026 年 11 月的公开文档整理。软件更新很快，以各家当前手册为准。本站不提供这些软件的下载包。Compiled from public docs in November 2026. Software moves quickly; check the current manual. This site does not host those downloads.

软件Software 公开资料里写了什么What the public docs say 出处Source
sing-box 1.12.0 起有 AnyTLS 出站文档，必填服务器、端口、密码和 TLS。同一文档体系里有对应入站。空闲会话检查间隔默认约 30 秒。Outbound docs exist since 1.12.0. Server, port, password, and TLS are required. The same docs include an inbound. The idle-session check defaults to about 30 seconds. 出站文档Outbound docs
mihomo 代理项可以写 type: anytls，放在 proxies。入站放在 listeners，类型同名。是否支持以你安装的版本说明为准。A proxy entry can use type: anytls under proxies. An inbound uses the same type under listeners. Whether your build supports it depends on that version’s notes. mihomo 仓库mihomo repo
Shadowrocket 协议介绍页写明已内置 AnyTLS。从哪个版本开始、能导入哪种链接，以软件内的更新说明为准。The protocol introduction says AnyTLS is built in. The version, and which links it imports, are in the app’s own release notes. AnyTLS 简介AnyTLS intro
anytls-go 协议作者的参考实现，带示例客户端和服务端。作者声明它用来演示协议，不是功能齐全的日常客户端。The author’s reference implementation, with a sample client and server. The author says it demonstrates the protocol and is not a full everyday client. GitHub
anytls-rs 社区的 Rust 实现，有自己的客户端和服务端。它多出来的参数，不要假定 anytls-go 的链接格式也认识。A community Rust implementation with its own client and server. Extra parameters it adds should not be assumed to work in the anytls-go link format. GitHub

两边要说同一版Both ends use the same version

协议在 2025 年 4 月有过版本 2，增加了连接是否打开的回执和心跳。两边都支持时才启用；有一边较旧，就按版本 1 工作。Protocol version 2, from April 2025, added a reply that the connection opened, plus heartbeats. Both sides must support it. If either side is older, they stay on version 1.

链接里没有的字段Fields the link does not carry

anytls:// 只带密码、地址、SNI 和是否校验证书。空闲连接保留几条、填充方案全文，写在各软件自己的配置里。An anytls:// link carries only the password, address, SNI, and whether to verify the certificate. How many idle connections to keep, and the full padding scheme, belong in each app’s own config.

04 工具04 Tools

拼链接，读填充方案Build a link, read a padding scheme

两件事都在这台设备的浏览器里完成，不会把密码或方案文本发出去。字段来自 anytls-go 公开的 URI 说明和协议说明。Both run in this browser. The password and the scheme text are not uploaded. The fields come from the public anytls-go URI and protocol notes.

拆开一条已有链接Split an existing link

位置Part 含义Meaning
anytls://协议名，软件靠它认出这是 AnyTLS。Protocol name. Apps recognize AnyTLS from it.
密码Password写在 @ 前面。有特殊符号时要做百分号编码，生成器会处理。Before @. Special characters are percent-encoded. The generator does that.
服务器和端口Server and port@ 后面。端口省略等于 443。IPv6 地址放在方括号里。After @. Omitting the port means 443. Wrap an IPv6 address in brackets.
sniTLS 里报给服务器的名称。值如果是 IP，客户端不发送 SNI。The name sent in TLS. If the value is an IP, the client sends no SNI.
insecure1 表示不校验证书，0 表示要校验。不写等于校验。1 skips certificate checks, 0 requires them. Omitting it means check.
#名称name显示用的备注。A display label.

这份 URI 故意只放连接所需的基本项。别的软件额外加的参数，不能假定每家都认识。来源：anytls-go URI 格式。The URI is deliberately limited to the basics needed to connect. Extra parameters added by one app should not be assumed to work in another. Source: anytls-go URI scheme.

填充方案Padding scheme

每一包Each packet

MD5（对文本框里的原文计算，含最后有没有换行）。软件用它判断自己的方案和服务器是不是同一份。MD5 of the exact text in the box, including whether the last line has a newline. Apps use it to see whether their scheme matches the server’s.

—

stop=8 表示只处理第 0 到第 7 个包。第 0 个包在认证里。文档示例里，第 1 个包带着会话设置和第一个目标地址，第 2 个包是后面跟着的第一段用户数据。长度指 TLS 明文记录的大小。出处：anytls-go 协议说明。stop=8 handles packets 0 through 7. Packet 0 is part of authentication. In the documented example, packet 1 carries the session settings and the first destination, and packet 2 is the first chunk of user data after that. Lengths are the TLS plaintext record size. Source: anytls-go protocol notes.

05 认证失败05 Auth failure

密码对不上时，连接有两个去向When the password does not match, the connection goes one of two ways

指纹对不上，服务器不会进入后面的会话。公开说明里写了两种结果，由服务器自己的配置决定。If the fingerprint does not match, the server does not start the session. The public spec describes two outcomes. The server’s own configuration chooses which one.

密码指纹对不上Password fingerprint does not match

关掉这条连接Close the connection

服务器直接结束。软件这边看到的是连接被关闭。The server ends it. The app sees a closed connection.

交给一个普通网页Hand it to an ordinary web page

协议说明把这叫做 fallback：这次访问被交给一个正常的网页服务，而不是进入 AnyTLS 会话。The spec calls this fallback: the visit is given to a normal web service instead of an AnyTLS session.

这里只说明有这两种结果。怎么在服务器上配置、配到哪一个网页，要看各软件自己的手册。原文：anytls-go 协议说明。This section only names the two outcomes. How to configure that on a server, and which page receives the visit, is in each app’s manual. Source: anytls-go protocol notes.