# HTTP/3 and QUIC

> The newest version of the web's protocol, running on QUIC instead of TCP.

- Level: Advanced
- Topics: Networks
- URL: https://tidbit.legios.com.ar/http3-and-quic/
- In Spanish: [HTTP/3 y QUIC](https://tidbit.legios.com.ar/es/http3-and-quic/)

For thirty years, HTTP traffic traveled over TCP, the protocol that guarantees bytes arrive complete and in order. **QUIC** replaces TCP for the web. Started at Google around 2012 and standardized by the IETF in 2021 (RFC 9000), it runs on top of UDP and rebuilds reliability, ordering and congestion control itself, in software that browsers and servers can update quickly. **HTTP/3** (RFC 9114, 2022) is simply HTTP carried over QUIC.

The first win is **head-of-line blocking**. HTTP/2 already sent many files at once over a single TCP connection, but TCP sees only one stream of bytes: if one packet is lost, everything behind it waits, even data for unrelated images. QUIC knows about the separate streams, so a lost packet only stalls the one it belongs to. On lossy mobile and Wi-Fi networks that makes a visible difference.

The second is setup time. TCP plus TLS needs a couple of round trips before the first useful byte; QUIC builds encryption (TLS 1.3) into its own handshake, so a new connection usually takes one round trip, and a returning client can sometimes send data immediately (0-RTT, with some replay-attack caveats). Almost everything in QUIC is encrypted, including much of the header that middleboxes used to inspect.

Third, a QUIC connection is identified by a **connection ID**, not by IP address and port, so it survives your phone hopping from Wi-Fi to 5G. Today Chrome, Firefox and Safari speak HTTP/3, and Google, Meta and Cloudflare serve a large share of traffic with it. Browsers learn a site supports it through an `Alt-Svc` header or a DNS record, and fall back to HTTP/2 over TCP when UDP is blocked by a firewall.

## An analogy

A single conveyor belt versus a row of separate belts. On TCP, if one box falls off the belt, the whole line stops until it is put back. QUIC gives each order its own belt, so a dropped box only delays that order.

## Keep in mind

- HTTP/3 is HTTP over QUIC; QUIC runs over UDP and replaces TCP plus TLS.
- Independent streams avoid head-of-line blocking when packets are lost.
- Faster setup: one round trip for new connections, 0-RTT for repeat visits.
- Connection IDs let a session survive switching networks; browsers fall back to HTTP/2 if UDP is blocked.

## Go deeper

- [RFC 9000, QUIC](https://www.rfc-editor.org/rfc/rfc9000)
- [RFC 9114, HTTP/3](https://www.rfc-editor.org/rfc/rfc9114)
- [HTTP/3 on Wikipedia](https://en.wikipedia.org/wiki/HTTP/3)

## Related terms

- [HTTP](https://tidbit.legios.com.ar/http/): The request-and-response language browsers and websites speak.
- [TCP and UDP](https://tidbit.legios.com.ar/tcp-and-udp/): Two ways to send packets: TCP checks everything arrives, UDP just sends and moves on.
- [Bit and byte](https://tidbit.legios.com.ar/bit-and-byte/): The smallest unit of digital information, and the group of eight that computers count in.
- [Google](https://tidbit.legios.com.ar/google/): The search company that gives most products away and makes its money on ads.
- [Web browser](https://tidbit.legios.com.ar/web-browser/): The app that fetches web pages from the internet and draws them on your screen.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [Packet](https://tidbit.legios.com.ar/packet/): The small chunk every piece of internet data is cut into before it travels.
- [Wi-Fi](https://tidbit.legios.com.ar/wi-fi/): Networking over radio waves: the internet without the cable, within a few rooms.