Skip to main content

Protocol guide

What is Trojan proxy? TLS, configuration and safety

Trojan is a TLS-oriented proxy protocol. A usable public profile needs more than an open port: the server address, port, password and TLS hostname must agree, and a compatible client must complete the encrypted session.

Checked Trojan servers Compare all protocols Verification method
Padlock and encrypted light trails over a laptop, illustrating Trojan transport security

Quick facts

TCP with TLSTransport
PasswordAuthentication
trojan:// linkConfiguration

Trojan in plain English

A Trojan client opens a TLS connection to the server and authenticates inside that protected session. The protocol is commonly used as a proxy transport; whether all device traffic follows it depends on the client routing mode. A valid certificate and the correct server name are important parts of the connection.

Important: encryption protects traffic between the client and endpoint, but it does not make an unknown public operator trustworthy.

How Trojan works

  1. The client resolves the host and opens the configured TCP port.
  2. TLS validates the configured server name and establishes encryption.
  3. The client sends the password and requests a proxied destination.
  4. The client routes selected apps or the whole device through the local proxy or TUN mode.

Configuration fields that must be complete

FieldWhy it matters
Server and portNetwork destination of the Trojan service.
PasswordShared credential; treat private values as secrets.
SNI/server nameHostname used during TLS validation.
Transport optionsOptional WebSocket or other wrapper settings must match the server.

PublicVPNList publishes a download only when the exact configuration is still present in an allowed, publication-compatible source and its fresh full-tunnel check succeeds.

Strengths

  • Uses standard TLS security when certificate validation is enabled.
  • Compact share links are widely supported by modern proxy clients.
  • Can provide a full-device path when the client enables TUN or VPN mode.

Limits and risks

  • It is normally a proxy protocol, not automatically a system-wide VPN.
  • A wrong SNI, expired certificate or mismatched transport causes handshake failure.
  • A successful tunnel does not establish who operates a public server or what it logs.

Safe setup and verification

  1. Use a maintained client that explicitly supports Trojan.
  2. Inspect the server, transport, identity and authentication fields before importing.
  3. Keep certificate and server-identity validation enabled where the protocol supports it.
  4. Connect without opening sensitive accounts, then verify the visible IP and DNS path.
  5. Disconnect and remove stale public profiles after low-risk testing.
Check public IPRead public VPN risks

Common connection problems

  • Confirm the host, port, password and SNI were imported without changes.
  • Keep certificate validation enabled and check the device clock.
  • If a wrapped transport is used, verify its host and path.
  • After connecting, verify both the public IP and DNS path.

A client “connected” indicator is not enough. A valid test must send real HTTPS traffic through the protocol and confirm that the public exit IP changed.

Official technical reference

For field semantics and protocol behavior, consult the Trojan protocol documentation. PublicVPNList adds operational testing and publication policy; it does not replace the specification.

Related protocol guides

Frequently asked questions

Is Trojan a VPN?
Trojan is primarily a proxy protocol. It becomes a full-device path only when a compatible client routes all traffic through a TUN or VPN interface.
What does a usable Trojan profile need?
It needs all endpoint, authentication, transport and security fields required by the server. A hostname and open port alone are not a downloadable working configuration.
How does PublicVPNList verify Trojan endpoints?
The checker starts the real protocol client in an isolated VM, sends HTTPS through the tunnel and requires the observed public exit IP to differ from the direct checker IP.
Is a checked public endpoint safe for sensitive accounts?
No technical connectivity test can verify the operator, logging policy or jurisdiction. Avoid banking, private work and identity-sensitive sessions on unknown public infrastructure.

Page history

  • 2026-08-31 — Published the protocol overview, configuration requirements, troubleshooting guidance, safety notes and PublicVPNList verification policy.