Most web pages now travel over a protocol most users have never heard of. HTTP/3, and the transport called QUIC underneath it, change how browsers and servers exchange data, and roughly one in five web requests to a major network already uses them.
What HTTP/3 and QUIC actually are
HTTP, the HyperText Transfer Protocol, is the set of rules a browser uses to ask a server for pages, images and data. Over the years it has appeared in several versions. HTTP/1.1 and HTTP/2 ran on top of TCP, the Transmission Control Protocol, the long-standing transport that breaks data into packets and makes sure they arrive complete and in order.
HTTP/3 keeps the familiar meaning of HTTP, such as requests, responses and headers, but changes how it is carried. Instead of TCP, it runs over QUIC, a newer transport that the Internet Engineering Task Force (IETF), the main standards body for internet protocols, standardized as RFC 9000. The IETF published HTTP/3 itself as RFC 9114 on June 6, 2022, alongside refreshed specifications for HTTP semantics (RFC 9110), caching (RFC 9111), HTTP/1.1 (RFC 9112) and HTTP/2 (RFC 9113), according to an IETF blog post of June 24, 2022.
The IETF describes HTTP/3 as “focused on fixing some issues with HTTP/2.” To see which issues, it helps to look at where HTTP/2 ran into a wall.
Why was HTTP/2 not enough?
HTTP/2 let a browser send many requests at once over a single connection, mixing the pieces of different files together, a technique called multiplexing. That removed a bottleneck in how applications used the connection. The IETF notes, however, that solving head-of-line blocking at the application layer exposed the same problem in TCP underneath.
Head-of-line blocking means that one stalled item holds up everything behind it. TCP treats a connection as a single ordered stream of bytes and has no idea which bytes belong to which web request. If one packet is lost, TCP holds back all later data until the missing piece is resent, even if that later data belongs to an unrelated file. Cloudflare, the network and security company, describes the problem in the same terms in its technical write-up of HTTP/3.
A simple illustration
Take a page that loads ten files at once over one connection, and suppose a single packet carrying part of one file is lost. Under TCP, the other nine files may wait for the retransmission, even though their own data arrived intact. Under QUIC, each file travels on its own stream, so in the usual case only the affected stream pauses. This is illustrative arithmetic, not a measurement, and real pages and networks vary widely.
How QUIC works differently
QUIC changes several things at once.
- Independent streams. Stream handling moves into the transport itself, so loss on one stream usually does not delay the others.
- A combined handshake. QUIC merges the transport handshake with the TLS 1.3 handshake, the security step that sets up encryption. Encryption and authentication are built into the protocol rather than added on top, and data can begin flowing sooner than with TCP plus TLS as separate stages, according to Cloudflare.
- Built on UDP. QUIC packets travel inside UDP datagrams. UDP is a minimal transport that does not itself provide ordering or retransmission; QUIC supplies those features on its own. Cloudflare explains the reason: TCP lives in operating system kernels, so changing it means waiting for operating system updates, while QUIC can be updated like any other application software.
- Connection migration. QUIC is designed so that a live connection can move between networks, for example from home Wi-Fi to a mobile carrier, without starting over. Cloudflare presented this as a feature requiring infrastructure changes when it first described its deployment.
Because QUIC is encrypted by design and implemented outside the operating system kernel, it is easier for browser and server makers to improve it quickly. The trade-off is that it is also harder for some network equipment to inspect, a point network operators have raised about encrypted transports generally.
How does a browser know to use HTTP/3?
A browser cannot assume a site supports HTTP/3, so it typically starts with an established method and learns about the newer one from the server. Cloudflare’s technical write-up shows a server response carrying an alt-svc header, short for alternative service, that advertises HTTP/3 on port 443 for a stated period. The company notes that, in practice, HTTP/3 may not be used for the first few connections to a domain. Browsers and servers generally negotiate the highest HTTP version both support, so HTTP/3 takes precedence over HTTP/2 when available.
This fallback design is deliberate. Some networks block or throttle UDP traffic, and a connection that fails over QUIC can simply continue over TCP.
Who supports it, and how common is it?
Cloudflare reported in a review of May 2021 to May 2022 data that it enabled QUIC version 1 and HTTP/3 for all customers on May 28, 2021. It also said Chrome and Edge added stable HTTP/3 support in November 2020 and Firefox in April 2021, while Safari at that time required an experimental setting. The company found that HTTP/3 passed HTTP/1.1 in request share in early July 2021 and roughly doubled over that year.
More recent figures come from the same company. In its 2025 Radar Year in Review, Cloudflare reports the following global split of requests by HTTP version:
| HTTP version | Share of requests, 2025 |
|---|---|
| HTTP/2 | 50% |
| HTTP/1.x | 29% |
| HTTP/3 | 21% |
The three shares add up to 100%. Cloudflare says these were largely unchanged from 2024, with HTTP/2 and HTTP/3 each gaining only fractions of a percentage point. By country, it reports Georgia at 38% of requests over HTTP/3 and Armenia at 37%, up from 25% the year before, and says 15 countries or regions sent more than a third of requests over HTTP/3, compared with eight the previous year.
These numbers describe traffic to one company’s network. Cloudflare serves a large share of the web, but its mix of sites, devices and automated bots is not the same as the internet as a whole, and no independent measure is cited here. Cloudflare’s own earlier analysis found that automated traffic often stays on older HTTP versions, which affects the totals.
Does HTTP/3 make everything faster?
Not necessarily. The protocol’s design aims to reduce delays caused by lost packets and connection setup, and the benefit is largest on unreliable links such as mobile networks, where packet loss and network changes are common. On a fast, stable connection to a nearby server, the difference may be small. Page speed also depends on server performance, file sizes, caching and how a site is built, none of which HTTP/3 changes.
The practical gains therefore vary by situation, and claims of a fixed speed-up should be treated with caution unless they come from measurements on comparable conditions.
What it means for sites and users
For ordinary users, nothing needs to be done. Current browsers handle the negotiation, and the experience is the same pages loading over a different road. For site operators, HTTP/3 is typically a setting offered by hosting or content delivery providers rather than something to build from scratch, and the fallback to HTTP/2 means older clients keep working.
The change also fits a broader pattern in internet infrastructure. Shared, standardized building blocks are quietly replaced while the visible web stays the same, much as with the name system we explain in our guide to how DNS works. Because so much traffic now flows through a few large networks, a fault in one provider can ripple widely, a theme in our piece on cloud outages. Web apps that rely on fast, reliable connections, including the progressive web apps that behave like installed software, benefit indirectly from the transport underneath. And the specifications themselves are open standards, developed in public, in keeping with the principles described in our explainer on open source software.
What remains uncertain
Several questions are still open. Adoption looks to have plateaued globally at around a fifth of requests on Cloudflare’s network, and the company links low-adoption countries to heavy bot traffic on older HTTP versions, though the reasons differ by region. Independent, cross-provider measurements of real-world performance gains are harder to find than vendor figures. And because QUIC traffic is encrypted and travels over UDP, organizations that rely on inspecting network traffic have had to adapt their tools and policies.
The takeaway on a quiet upgrade
HTTP/3 is best understood as a repair to the plumbing rather than a new web. It keeps HTTP’s meaning, replaces TCP with QUIC to avoid a blocking problem that HTTP/2 could not fix on its own, and falls back gracefully when a network does not cooperate. About one request in five on Cloudflare’s network used it in 2025, and the gains are real but depend on conditions.
This article is general information about internet standards, not a substitute for professional network or security advice.
Sources: Internet Engineering Task Force; Cloudflare
