HTTP/3 and QUIC vs a VPN in Plain English

Picture two UDP conversations. The first is your browser speaking HTTP/3 to a site. QUIC wraps that session. Streams are encrypted. A waiter with Wireshark does not get the HTML. They get datagrams to an address, often on UDP 443. That is a map. The second conversation is WireGuard to a VPN node. Also UDP. Also encrypted. The cafe's interesting packet becomes 'talked to that node.' Inner HTTP/3, if the site still speaks it after the hop, happens on the far side of the node. Those are different sockets.

People mash them because both say UDP and both say encrypt. HTTP/3 did not invent privacy as a product. It invented a faster, always-encrypted web transport. A VPN did not invent HTTP/3. It invented a wrap you choose. Mixing the jobs is how affiliate pages rank 'QUIC vs VPN winner' until the cookie dies. There is no winner. There is a ride to the site and a truck to a node. You can use one, both, or neither. Neither is how 2012 coffee-shop HTTP felt. Both is how a careful person sits on a network they do not run.

The cafe still sees that you used the AP. Volume remains. A four-hour fat blob is still a four-hour fat blob through a VPN too. The tunnel changes who they think you talked to. It does not make you look idle. Do not write 'HTTP/3 so the shop is blind.' Do not write 'UDP is unsafe so HTTP/3 is fake.' Split the leftover from the lock.

Klox is the truck when you connect it. WireGuard first. OpenVPN when the AP hates UDP, including when it hates WireGuard's UDP and also hates QUIC's UDP. Protocol hopping is not an HTTP/3 off switch. I will not invent a consumer UI that disables QUIC inside the tunnel. The site and the browser still negotiate that.

RFC 8446 is how a lot of the public web encrypts the session. QUIC folds that TLS into the transport so you do not get a clear TCP handshake sitting in front of a later padlock. Streams multiplex without TCP head-of-line blocking. Lossy cafe Wi-Fi often feels better. That is why browsers pushed it. That is not why you buy Klox.

The waiter is not reading your password from those QUIC records if the certificate matches the host you meant. That fight is mostly over, same as it was for HTTPS on TCP. Farm copy still writes as if 2012 HTTP were the default. It is not. If your scare is the page body on cafe Wi-Fi, check the lock first. HTTP/3 is one way that lock travels.

The leftover after you grant QUIC is quieter. Destination IP. A UDP flow to that IP. DNS if names never entered another wrap. Often a server name during start if ECH is not actually running on that path. That is a map of who you talked to. It is not the inbox. People who say 'I have HTTP/3 so I do not need a VPN' are talking about the inbox and forgetting the map. People who say 'QUIC is fake privacy' are often selling a tunnel with a scare that the padlock already retired. Both pitches skip the datagram.

Certificate warnings are still your job. A tunnel encrypts a mistake as happily as a real bank. The lock on a host you did not intend is not the lock you wanted. QUIC to a lookalike is still encrypted QUIC. Phishing is a lie you believed. Encryption of a lie is still a lie. Trust the browser's name match. Do not install a cafe's extra root because a PDF said Wi-Fi required it.

Without a tunnel, the interesting hop is the site. The cafe radio, the hotel concentrator, your ISP, a bored roommate with a capture: they see you spoke to that address. HTTP/3 does not camouflage the number. A small site on a dedicated IP is a name in all but spelling. A huge CDN anycast IP is quieter. Many names share the number, so the number is a neighborhood, not a doorbell. Do not pretend every IP is a neighborhood. Do not pretend every IP is a doorbell. Reality is mixed. Plan for mixed.

UDP 443 to a known CDN is still a session to that CDN. Encrypted Client Hello, when it actually runs, can quiet a name inside the TLS that QUIC carries. It does not delete the UDP session. Volume remains. Timing remains. Do not claim the shop sees nothing because the version column in DevTools says h3.

DNS can still leak earlier. You asked a resolver for a name. Off a VPN, that someone is often the ISP or the cafe router. HTTP/3 starts after you already have an IP. Hiding streams does not hide a clear question that already happened. On Klox, if the client is doing the job we document, DNS rides the tunnel. That leftover lives in the DNS essays. Here: QUIC is not a resolver wrap.

Browsers often learn HTTP/3 from an Alt-Svc hint after a TCP visit. First connection can be HTTP/2. Later connections jump to UDP. A capture that shows TCP 443 then UDP 443 to the same IP is not a mystery. It is discovery. A tunnel still wraps both if you connected first. If you connected after the tab was already chatting, you wrapped the rest, not the start. Background apps will not wait. Connect before the interesting request, not after DevTools made you proud.

IPv6 can sneak. WebRTC can ask STUN for a public IP while the UI says you are modern. Features lists protections for a connected session. Quote them for Connect. Do not quote them for 'the site supports HTTP/3.' The site never claimed your NIC.

Klox's default is WireGuard. WireGuard is UDP to a VPN server. HTTP/3 is UDP to a website. Same transport class. Different job. If a farm said 'WireGuard is just QUIC,' they sold a rhyme. WireGuard wraps a hop you chose. QUIC wraps a web session the browser negotiated. You can run HTTP/3 inside a WireGuard tunnel. You can run HTTP/3 with no tunnel. You can run WireGuard and still hit HTTP/2 on a site that never offered h3. Those combinations are normal. They are not a product matrix we toggle.

When the cafe graphs WireGuard, they see UDP to the node. Inner QUIC, inner TCP, inner DNS: blob. That is the hop job. When they graph HTTP/3 without a tunnel, they see UDP to the site. Inner HTML: wrapped. Outer map: visible. Say both sentences.

Rude access points block UDP. Captive portals, hotel filters, some campus kits. Then WireGuard fails and QUIC may fail too. OpenVPN over TCP is the spare tire in the Klox family. Same hop story. Different wrapper so a TCP-only path can still move. Switching to OpenVPN is not 'turning HTTP/3 off.' The browser may still speak h3 to the site after the node, or fall back to TCP HTTP/2, depending on the site. You do not pick that in our app.

Five devices: phone plus laptop is two seats if both tunnels are up. HTTP/3 on one gadget does not cover the other gadget. A tunneled phone does not hide the laptop's clear QUIC to a site. Count. Smart Connect, if the app shows the row, starts the hop on untrusted Wi-Fi. It does not negotiate h3. If the row is missing, you have a Connect button. Use the button.

OpenVPN in this product family is a protocol choice. TCP mode exists so a path that only allows TCP can still carry a tunnel. People ticket us asking to 'disable QUIC' because a listicle said HTTP/3 breaks VPNs. Sometimes a broken middlebox treats UDP 443 as a problem. Sometimes the listicle wanted a browser flag. Klox does not ship a browser flag. We ship WireGuard, OpenVPN, OpenConnect, and Shadowsocks.

If HTTP/3 feels broken through a tunnel, the cause is usually the path, not a missing SKU. Packet loss. An MTU fight. A filter that likes TCP. Try OpenVPN. Try a nearby server you actually have in the list. Do not invent city counts so the map sounds fancier. Nearby is usually enough when the job is 'hide this hop from the shop,' not 'pretend I live in a catalog.'

I will not walk a chrome://flags ritual. Those flags rotate. They are not support. If you came here to force HTTP/2 for a work app, that is a browser or admin problem. If you came here because cafe Wi-Fi still sees your next hop, Connect. If you came here because a farm said HTTPS-versus-VPN had a winner, NordVPN's specimen is linked as a specimen. Use it as a specimen. Do not import their winner. There is no winner. There is a datagram and a truck.

DNS through the tunnel stays the default I want on both protocols. Do not paste a public resolver into the adapter 'for HTTP/3 speed.' That leftover can undo tunnel DNS. We are not selling a custom-DNS picker in this sentence.

ECH has no consumer toggle here. HTTP/3 has no consumer toggle here. Custom DNS has no picker here. I am repeating the absences because tickets invent SKUs from competitor screenshots. Our Connect button starts WireGuard or OpenVPN. Inner websites still do TLS, still do QUIC when they offer it, still do HTTP/2 when they do not. That negotiation is the browser and the origin. Cloudflare's HTTP/3 page is how a CDN talks about enabling it on a zone. You are not configuring our zone. You are wrapping your NIC.

The VPN node is not the website. After the tunnel, you still speak to the site. That inner session may be HTTP/3. The cafe does not sit on that inner hop when you are connected. The path from the node to the site still looks like a normal client, plus an exit IP that is not your house. The website still sees you logged in. A tunnel is not a new identity. It is a new first hop.

I will not claim we 'optimize HTTP/3.' I will not claim we block it. I will not claim we need it for the padlock to work. TCP HTTP/2 with TLS is still a lock. QUIC HTTP/3 is still a lock. The hop wrap is the product you pay $2.83 a month yearly for, on five devices, with seven-day money-back on first purchase.

SOC 2 is not in this article because a buyer likes logos. City counts are not in this article because a catalog is a different pitch. Cookies on klox.app live at /cookie and are not a QUIC parameter.

With Klox up, the interesting hop for the cafe and the ISP becomes the VPN server. They still know you used the AP. They still see volume. They see a destination you chose when you picked a node. They do not get the inner map of HTTP/3 sites unless something leaked around the tunnel: DNS, IPv6, WebRTC, an excepted app, a second NIC. Features lists tunnel DNS, IPv6 leak protection, WebRTC leak blocking. Confirm after connect if you like labs. Then stop collecting testers.

A QUIC-only scare is still a hop scare. Moving the hop does not shrink a 4K stream into a blink. If your threat watches sizes, plan for that. Most cafe threats do not. Most ISP graphs still like IPs and names more than byte counts.

Per device, not per cafe. Each gadget that joins the shop SSID needs its own tunnel if you care about that gadget's map. HTTP/3 will be there anyway on modern browsers. The hop lock is per NIC. A Chrome extension that claims to be a VPN is not this product. The system app is how you wrap more than one tab.

Work tunnels first if work already owns the path. A personal hop on a managed laptop can fight a mandatory client. This essay will not pick that fight. Cafe Wi-Fi on your own phone is the chair this page assumes.

If you want proof the hop moved, use the Leak Test After You Connect a VPN article. IP, DNS, WebRTC, IPv6 as a procedure. This page will not become that procedure. Leak sites do not print 'HTTP/3.' They print an IP and a resolver. If the IP is the VPN and DNS is the tunnel, the cafe's interesting hop moved. That is the check that pays rent. QUIC trivia will not show up as a row. Do not demand it.

Do it once on a network you control. Then stop. Daily labs are how people forget to live. If a test fails, fix the leftover: IPv6, WebRTC, a browser DoH override, an excepted app. Then test once more. Then drink the coffee.

Yearly from $2.83 a month is not a reason to skip the padlock. It is a reason you can afford the hop without a farm's lifetime coupon. Seven days on first purchase if the product is not the hop you wanted. Refunds live on /refund. Store purchases follow the store. This page will not turn into a billing sermon.

If you only needed the English, stop here. If you needed two locks as a pair, the HTTPS essay is next door. If you needed the leftover name, SNI owns it. If you needed the first-flight wrap, ECH owns it. If you needed why WireGuard feels quick, that speed post exists. If you needed a cape, you wanted a farm. If you needed the cafe to see a node instead of a site IP, download the apps. Connect on networks you do not run. Leave HTTP/3 on. The datagram was never the page.