TROJAN

Trojan disguises proxy traffic as normal HTTPS: the client performs a standard TLS handshake with a certificate that looks like any website's, then authenticates with a password inside the encrypted channel. There is no recognizable handshake fingerprint, which was its original advantage against protocol detection. Trojan supports TLS, WebSocket and gRPC transports and accepts SNI camouflage hosts. Because it always expects TLS, plain-text Trojan links do not exist in practice.