HTTP/3 and QUIC: Moving HTTP Onto UDP

A lost packet in HTTP/2 stalls every stream; QUIC gives each stream its own ordering, so only one waits.

HTTP/3 runs HTTP over QUIC, a transport built on UDP that provides reliable streams, each ordered on its own, with TLS 1.3 built in. Because QUIC knows which stream every packet belongs to, a lost packet delays only that stream, where under HTTP/2 on TCP it stalls them all. QUIC also sets up a connection in fewer round trips and can keep a connection alive when the client's address changes.

Picture a phone downloading a large file and loading a page at the same time, on Wi-Fi, as its owner walks out of the house. The phone switches to mobile data. Over TCP, every connection is tied to the old address and breaks; the download restarts. Over QUIC, the connection carries on.

One lost packet under HTTP/2 and under HTTP/3

HTTP/2 on TCPone ordered byte stream

A packet carrying part of the image is lost. TCP holds every byte after it, so the script and stylesheet, already received, wait too. All three streams stall for one retransmission.

HTTP/3 on QUICordering per stream

The same packet is lost. QUIC delivers the script and stylesheet at once, because their data is complete, and only the image waits for the resend.

Four changes come together.

Streams in the transport. QUIC numbers data per stream, so the transport, not just HTTP, knows which request a packet belongs to. Head-of-line blocking is confined to one stream.

One handshake. QUIC's handshake includes TLS 1.3, so a new connection needs one round trip before the first request, where TCP and TLS need two. A returning client can send its request in the first packet.

Connection IDs. A QUIC connection is identified by an ID chosen by the endpoints rather than by the five-tuple, so it survives a change of address, the phone's move from Wi-Fi to mobile data.

Encryption of the transport itself. Almost all of QUIC's own header is encrypted, so routers and middleboxes cannot read or tamper with it.

UDP is the base for a practical reason, not a technical one. TCP lives in operating system kernels and is handled by countless firewalls and routers that expect it to look a certain way, so changing TCP takes decades. UDP passes through almost every network, and QUIC builds everything above it inside the application, where it can be updated with a browser release.

The cost is that some networks block or slow UDP, so clients keep HTTP/2 over TCP as a fallback, and QUIC's encryption makes it harder for network operators to inspect.

So HTTP/3 is HTTP/2's meaning on a transport that waits only for what was lost.

← → move through sections and cards