HTTP/3: Browser Support, Features, Known Issues

What is HTTP/3?

HTTP/3 is the third major version of the Hypertext Transfer Protocol, defined by the IETF QUIC Working Group in RFC 9114 as a Proposed Standard. Unlike HTTP/1.1 and HTTP/2, which run on TCP, HTTP/3 runs on QUIC, a UDP-based transport defined in RFC 9000. QUIC bundles stream multiplexing, TLS 1.3 encryption, and congestion control into one layer, which lets HTTP/3 set up a connection in one round trip and avoid the head-of-line blocking that slowed HTTP/2 on lossy networks.

Which browsers does HTTP/3 support?

HTTP/3 works in every modern desktop and mobile browser. Chrome 87, Edge 87, Firefox 88, Opera 74, Samsung Internet 14, and Safari 16 on macOS, iOS, and iPadOS all enable it by default, while Internet Explorer never received QUIC.

What are the key features of HTTP/3?

HTTP/3 keeps every HTTP/2 feature that web developers already use and adds five transport-layer wins delivered by QUIC.

• Faster connection setup: QUIC merges the transport handshake and the TLS 1.3 handshake, so a fresh HTTP/3 connection completes in one round trip and a return visit completes in zero round trips with 0-RTT resumption.
• Independent streams: Each HTTP/3 request and response runs on its own QUIC stream. A dropped packet on one stream does not block the other streams, which removes the head-of-line blocking HTTP/2 inherited from TCP.
• Always-encrypted transport: TLS 1.3 is mandatory in QUIC. HTTP/3 cannot run in clear text, which raises the security floor and removes the option of plain http://.
• Connection migration: A QUIC connection ID is independent of the IP address. A phone moving from Wi-Fi to cellular keeps the same HTTP/3 connection alive instead of restarting it.
• Better congestion control: QUIC ships with modern congestion controllers in user space, so browsers and servers can ship CUBIC, BBR, or new algorithms without waiting on operating system kernel updates.

How do you check if a browser supports HTTP/3?

The fastest check is the DevTools Network panel. Right-click the column headers, enable the Protocol column, and reload the page. Resources served over HTTP/3 list h3 in that column. For automated testing, the PerformanceResourceTiming API exposes nextHopProtocol with the same value.

Paste this snippet into any browser DevTools console after the page finishes loading to count how many resources used HTTP/3, HTTP/2, or HTTP/1.1.

// Run in any browser DevTools console while on a site you want to test.
// The PerformanceResourceTiming API reports the protocol the browser used.

const entries = performance.getEntriesByType("resource");
const protocols = {};

entries.forEach((entry) => {
    const proto = entry.nextHopProtocol || "unknown";
    protocols[proto] = (protocols[proto] || 0) + 1;
});

console.log("Protocols seen on this page:", protocols);
// HTTP/3 reports as "h3" in nextHopProtocol when QUIC was negotiated.
// HTTP/2 reports as "h2", HTTP/1.1 as "http/1.1".

If every resource reports h2 instead of h3, the server, the network, or a corporate firewall is blocking UDP port 443. Sites also need to advertise HTTP/3 with an Alt-Svc header before browsers will try it on a return visit.

What are the known issues with HTTP/3?

HTTP/3 is stable and standardized, but the UDP-based transport hits real-world friction that HTTP/1.1 and HTTP/2 do not. Plan for these before you turn it on for production traffic.

• Corporate firewalls block UDP port 443: Many enterprise firewalls and middleboxes drop UDP 443 by default, so users on those networks fall back to HTTP/2 over TCP. Test from real corporate networks before claiming an HTTP/3 win.
• Higher CPU cost on servers: QUIC moves work that the kernel used to do for TCP into user space, which raises CPU use on busy servers. Cloudflare and Google have published numbers showing 2x to 4x CPU cost compared to HTTP/2 for the same traffic.
• Internet Explorer is out: Internet Explorer never supported HTTP/3. Sites that still need IE 11 compatibility cannot drop HTTP/2 yet.
• Open-source tooling lags: NGINX added HTTP/3 in stable 1.25, Apache HTTP Server still has no native HTTP/3 module, and curl needs a build with HTTP/3 enabled. Operators on stock distro packages may not have HTTP/3 yet.
• Debugging is harder: QUIC encrypts almost the entire transport, so legacy packet captures from tcpdump or Wireshark are useless without TLS keylog files. Plan for qlog and qvis, the QUIC-specific debugging tools.
• In my experience: the loudest HTTP/3 production issue is silent fallback. A site advertises HTTP/3, the firewall drops UDP, and users get HTTP/2 with extra latency from the failed QUIC probe. Always measure actual nextHopProtocol from real browsers, not just origin support.

Citations

All HTTP/3 version numbers and platform notes in this guide come from these primary sources:

• IETF RFC 9114 (HTTP/3): datatracker.ietf.org/doc/html/rfc9114
• IETF RFC 9000 (QUIC transport): datatracker.ietf.org/doc/html/rfc9000
• MDN HTTP/3 Glossary: developer.mozilla.org/en-US/docs/Glossary/HTTP_3
• MDN HTTP resources and specifications: developer.mozilla.org/en-US/docs/Web/HTTP/Resources_and_specifications
• Wikipedia HTTP/3: en.wikipedia.org/wiki/HTTP/3
• Cloudflare blog, HTTP/3 the past, present, and future: blog.cloudflare.com/http3-the-past-present-and-future
• Cloudflare blog, examining HTTP/3 usage one year on: blog.cloudflare.com/http3-usage-one-year-on
• Mozilla Firefox 88 release notes: mozilla.org/en-US/firefox/88.0/releasenotes