HTTP/3 (RFC 9114) replaces TCP with QUIC (UDP-based) as the transport layer. The main benefit is eliminating TCP head-of-line blocking, which means a single lost packet no longer stalls all streams.
| Feature | HTTP/2 | HTTP/3 |
|---|---|---|
| Transport | TCP | QUIC (UDP-based) |
| Connection setup | TCP handshake + TLS handshake (2-3 RTT) | QUIC handshake with integrated TLS (1 RTT, 0-RTT for resumption) |
| Head-of-line blocking | Yes, at the TCP layer. One lost packet blocks all streams. | No. Each stream is independent. A lost packet only affects its own stream. |
| Multiplexing | Multiple streams over one TCP connection | Multiple streams over one QUIC connection, independently delivered |
| Header compression | HPACK | QPACK (adapted for out-of-order delivery) |
| Server push | Supported (rarely used in practice) | Supported (also rarely used) |
| TLS | TLS 1.2 or 1.3 (separate layer) | TLS 1.3 only (built into QUIC) |
| Connection migration | No. New IP means new TCP connection. | Yes. Connections survive network changes via connection IDs. |
| Browser support | All modern browsers | All modern browsers (Chrome 87+, Firefox 88+, Safari 14+, Edge 87+) |
HTTP/2 was a major improvement over HTTP/1.1. It introduced multiplexing (multiple requests and responses over a single TCP connection), header compression with HPACK, and stream prioritization. This eliminated the need for workarounds like domain sharding and CSS spriting that were common in the HTTP/1.1 era.
However, HTTP/2 inherits a fundamental limitation from TCP. TCP guarantees in-order delivery of bytes. When multiple HTTP/2 streams share a single TCP connection and a packet is lost, TCP must retransmit that packet before delivering any subsequent data to any stream. This is TCP-level head-of-line blocking. Even though the lost packet might belong to stream 3, streams 1, 2, and 4 are all stalled waiting for it.
On reliable, low-latency connections (wired networks, data centers), this rarely matters. On lossy or high-latency networks (cellular, WiFi, satellite), it can significantly degrade performance, sometimes making HTTP/2 slower than HTTP/1.1 with multiple connections.
HTTP/3 solves the head-of-line blocking problem by replacing TCP with QUIC. QUIC is a transport protocol built on UDP that provides reliable, ordered delivery per stream, but streams are independent of each other. If a packet belonging to stream 3 is lost, only stream 3 waits for the retransmission. All other streams continue unaffected.
QUIC integrates TLS 1.3 directly into its handshake. A new QUIC connection completes both transport and cryptographic setup in a single round trip. For repeat connections, QUIC supports 0-RTT resumption, allowing the client to send application data in the very first packet.
Connection migration is another significant feature. QUIC connections are identified by connection IDs rather than the IP/port tuple used by TCP. When a mobile device switches from WiFi to cellular, the QUIC connection can continue without interruption. With TCP, this transition requires establishing a new connection and a new TLS handshake.
QPACK replaces HPACK for header compression, adapted to work correctly with QUIC's out-of-order delivery model. The compression efficiency is similar, but QPACK avoids the head-of-line blocking that would occur if header table updates were strictly ordered.
HTTP/3 is widely deployed. Major CDN providers including Cloudflare, Fastly, Google Cloud CDN, and Amazon CloudFront support HTTP/3. Google's services (Search, YouTube, Gmail) have used QUIC since before it was standardized.
Browser support is universal among current versions. Browsers discover HTTP/3 support through the Alt-Svc response header. The first connection to a new origin typically uses HTTP/2 over TCP. The server includes an Alt-Svc: h3=":443" header, and subsequent connections use HTTP/3 over QUIC. This fallback mechanism means enabling HTTP/3 is safe. Clients that do not support it simply continue using HTTP/2.
Some networks and firewalls block UDP traffic on port 443, which prevents QUIC connections. Browsers handle this gracefully by falling back to HTTP/2 over TCP. In corporate environments with aggressive firewalls, HTTP/3 may not be usable, but the fallback is transparent to the user.
Check what protocol version an endpoint negotiates.
Probe an endpoint