Design philosophy · Current DPI landscape · Technical architecture · Real-world results — how WEB-Proxy moves from "disguise" to "blending in".
On August 21, 2026, Telegram officially launched a new experimental anti-censorship technology called WEB-Proxy, followed by official client support in Telegram Desktop 7.1.0. Unlike traditional MTProxy, WEB-Proxy no longer tries to "disguise" itself as web traffic. Instead, it makes Telegram's proxy traffic actually run inside a WebView, initiating standard HTTPS or WebSocket connections through the browser engine, making it indistinguishable from normal web browsing to censorship systems.
This article breaks down the technology across four dimensions: design philosophy, the current DPI landscape, technical architecture, and real-world results.
The core design philosophy of WEB-Proxy can be summed up in four words: blend in, don't disguise.
Traditional MTProxy's strategy is "disguise" — it tries to make its traffic look like ordinary HTTPS traffic. But no matter how well it disguises itself, the connection behavior of an MTProto proxy still has identifiable characteristics. The old MTProxy tried to "look like" normal web traffic, while WEB-Proxy uses a real web technology stack. Network filters face standard TLS and HTTPS traffic generated by a browser engine.
The essence of this shift: instead of trying to trick DPI into thinking "I look like a web page", the traffic is fundamentally web traffic.
Telegram continues to deepen its MTProxy路线 rather than launching a general-purpose VPN or global proxy. This reflects a clear strategic consideration: prioritize solving Telegram's own accessibility while deliberately not providing global proxy capabilities. If WEB-Proxy became a general circumvention infrastructure, it would immediately attract targeted blocking from censorship systems, potentially implicating the ordinary websites used as camouflage. Serving only Telegram traffic means blocking it looks more like blocking a communication app than blocking a general circumvention service, reducing the risk of being "over-targeted".
Another core design principle of WEB-Proxy is the zero-knowledge relay. The server-side tproxy-server treats DATA frames as opaque bytes — it cannot choose a Telegram destination, nor can it decrypt the MTProxy stream. The client derives the bridge capability locally, and the raw secret is never exposed to JavaScript. This means even the proxy operator cannot peek into the user's communications.
2026 was the year Telegram faced its most severe blocking in Russia and other regions. The blocking unfolded in several stages:
The core detection method of the current DPI system is JA4 TLS fingerprinting. The official Telegram client uses a static JA4 fingerprint in its ClientHello. Once the DPI system identifies it, it immediately injects RST packets to terminate the connection. Even with Fake TLS, the client's TLS stack still differs from a real browser, so it can also be detected.
The community has verified this is a client-side issue: community forks with dynamic JA4 rotation work immediately on the same proxy and network.
Beyond TLS fingerprints, the 2026 DPI systems also analyze behavioral characteristics of traffic. Analyzers check packet sizes, inter-packet timing, TLS connection structure, and other indirect features. If the traffic behaves like a proxy, disguising it as HTTPS is no longer enough. A typical scenario is the "16KB problem": after a connection is successfully established and transmits initial data, it is suddenly throttled or disconnected.
The WEB-Proxy architecture can be summarized as follows:
Telegram App
→ MTProto connection (keeps normal MTProxy framing and encryption)
→ Local WEB proxy adapter (one logical stream per app connection)
→ One WebView transport + authenticated relay session
→ Multiplexed frames (HTTPS or WebSocket carrier)
→ tproxy-server
→ One local TCP connection per stream → Official MTProxyThe client configures only two values: hostname and MTProxy secret. It derives the bridge capability locally, and the raw secret is never exposed to JavaScript. The WebView opens the bridge page, exchanges a short-lived bootstrap token for a relay session, and then runs the carrier mode selected by the matching server profile. OPEN, DATA, WINDOW, and CLOSE frames multiplex all Telegram connections.
WEB-Proxy supports four transport carrier modes, selected by the secret/profile, with no additional client settings required:
WEB-Proxy has several key security features:
GET /?bridge=<valid capability> reveals the bridge.token.key). A missing or improperly permissioned key prevents startup; no ephemeral key is silently generated.max_sessions_global 128, max_streams_global 4096, max_backend_dials_in_flight 256.The reference deployment architecture is:
Internet :80/:443 → Caddy → 127.0.0.1:8080 tproxy-server → Operator Site
→ 127.0.0.1:2398 Official MTProxyOnly Caddy listens on external interfaces. The relay, admin endpoints, MTProxy client port, and statistics remain local. The relay never receives a client-selected backend address and never decrypts the MTProxy stream. Caddy proxies all paths to the relay, with no separate public path for unauthenticated probers to compare.
As of August 2026, client support is as follows:
In the client, users only need to fill in the hostname and secret; no port or protocol configuration is required. The shareable link format is:
https://t.me/webproxy?server=proxy.example.com&secret=000102030405060708090a0b0c0d0e0fCompared to traditional MTProxy or ordinary proxies, WEB-Proxy's deployment threshold, technical difficulty, and cost are significantly higher. It is no longer a lightweight solution where you "fill in an IP and port and go". It requires the operator to have full server operations capabilities: owning a domain and a public server, configuring DNS, Caddy reverse proxy, systemd services, nftables firewall rules, and understanding the basics of WebView carriers and frame protocols. Although the official installer provides some automation, it is still aimed at "clean servers where Caddy owns ports 80/443"; servers already hosting other sites require manual integration. For ordinary users, this means moving from "using a public proxy" to "operating a small web service", with significantly higher time, technical, and ongoing maintenance costs. As a result, WEB-Proxy is more likely to be adopted in the short term by technical communities, organizational users, and advanced users willing to tinker, rather than becoming as widespread as public MTProxy.
Advantages:
Limitations:
tproxy-server is still marked by the official as proof-of-concept, not yet a stable release.websocket-lanes mode; in this case, switch to websocket mode.Encrypted but has traffic fingerprint, easily JA4-identified
Indistinguishable from real web traffic, browser engine traffic
Borrows real site certificates, medium deployment complexity
WEB-Proxy represents a major evolution in Telegram's anti-censorship technology. By actually running proxy traffic inside a WebView, it moves from "disguised as web traffic" to "is web traffic", providing a new survival path in the increasingly harsh DPI environment of 2026. Its design philosophy — Telegram-specific, zero-knowledge relay, no global proxy — reflects the official's delicate balance between "usability" and "not attracting over-targeting".
It is important to note that WEB-Proxy's deployment threshold, technical difficulty, and cost are all higher than traditional MTProxy. It is not a one-click solution for ordinary users, but requires operators to have domain, server, and web service operations capabilities. Currently, WEB-Proxy is still in the proof-of-concept stage, but with official support in Telegram Desktop and Android clients, and active community participation, this technology is expected to become one of the core solutions for accessing Telegram in restricted network environments in the future.
If you are struggling in a restricted network, or want to verify how Telegram's official WEB-Proxy route performs in a real environment, you can claim a 3-day free trial from TGV.