QUIC + HTTP/3, in pure Zig

Proven on the wire, not just in unit tests

quicz’s handshake and stream paths are exercised by real UDP probes: loopback in-process, separate-process Zig, and certificate-verified peers in Go and Rust.

$ examples/interop/run_external_interop.sh all
# certificate-verified interop against quic-go (Go), quiche (Rust),
# and s2n-quic (Rust): handshake + transfer, FIN-terminated echoes on
# streams 0 and 4 — certificate verification enabled the whole way.

What quicz ships today

• Pure-Zig TLS 1.3 + 0-RTT — no C crypto; ECDSA P-256, X25519, X25519Kyber768 (post-quantum), AES-128/256-GCM, ChaCha20-Poly1305, session resumption.
• QUIC v1 & v2 transport — streams, flow control, connection migration, path validation, Retry, stateless reset, key update, version negotiation, DATAGRAM, multipath, ECN, PMTUD, GSO/GRO, connection pool, qlog.
• Loss recovery + NewReno / CUBIC — packet pacing, HyStart++, PTO jitter, fast retransmit, app-limited detection.
• Async I/O runtime — event-driven std.Io server/client with per-connection handlers (std.http model).
• HTTP/3 — full connection management, SETTINGS, GOAWAY, stream state machine, QPACK static + dynamic table.
• WebTransport (full session management) + HTTP Datagrams (RFC 9297) + stream reset partial delivery.
• Wire-verified interop with quic-go, quiche, and s2n-quic.

const std = @import("std");
const quicz = @import("quicz");
const Client = quicz.runtime.client.Client;

pub fn main() !void {
    var gpa: std.heap.DebugAllocator(.{}) = .init;
    defer _ = gpa.deinit();
    var io_ = std.Io.Threaded.init(gpa.allocator(), .{});
    defer io_.deinit();
    const io = io_.io();

    var client = try Client.init(gpa.allocator(), io, .{
        .server_port = 4433,
        .server_name = "localhost",
        .alpn = &.{"hq-interop"},
    });
    defer client.deinit();
    _ = try client.runEchoSession("hello");
}

The async std.Io runtime (quicz.runtime) is the recommended production API — event-driven server with per-connection handlers, async client sessions. The low-level Connection packet API is available for fine-grained control. See the quick start.

Interop matrix

Peer	Language / stack	Probe
quic-go	Go	certificate-verified echo client/server + run_external_interop.sh
quiche	Rust	certificate-verified handshake + transfer
s2n-quic	Rust	certificate-verified handshake + transfer
QUIC-Interop-Runner	—	handshake, transfer, retry self-test

Run it yourself: examples guide.

How quicz compares

The authoritative feature matrix tracks 41 capabilities across four stacks. Headline coverage:

Metric	quic-go	quiche	s2n-quic	quicz
Transport (19 items)	19/19	14/19	14/19	19/19
Congestion (8 items)	6/8	6/8	7/8	7/8
Cipher suites (5 items)	5/5	5/5	5/5	5/5
Application layer (6 items)	6/6	3/6	0/6	6/6
Platform (3 items)	2/3	0/3	1/3	1/3
Total (41 items)	38/41	28/41	27/41	40/41

quicz ships every transport, cipher-suite, and application-layer feature; the open items are BBR (deliberately removed) plus the platform-only FIPS / XDP rows. See the full feature-by-feature comparison.

Performance

~390 MB/s

single-stream · real handshake

21.7 μs

echo latency · P50

~304 MB/s

4-stream aggregate

A secnetperf-style loopback micro-benchmark on macOS with a real TLS 1.3 handshake (no GSO / XDP); the cross-implementation numbers are indicative only; the installed-keys (bypassed-handshake) ceiling is ~1.94 GB/s. The full throughput chart, latency percentiles, loss recovery, and methodology live on the Performance page.

Out of scope

• BBR — deliberately removed in favor of CUBIC (2026-08).
• FIPS 140-3 — quic-go only (Go 1.26+).
• XDP zero-copy I/O — s2n-quic only.

The authoritative status and acceptance evidence live in the transport task matrix. The API is stabilizing but still evolving.

Where next?

• Quick start — add quicz via zig fetch and run your first endpoint.
• Feature comparison — quicz vs quic-go / quiche / s2n-quic, 41 rows.
• Performance — throughput, latency, loss recovery, CPU cost.
• Architecture — how the endpoint, connection, and TLS layers fit together.
• Spec coverage — RFC 9000/9001/9002 section-by-section status.
• Examples — echo, DATAGRAM, post-quantum, 0-RTT, and interop probes.
• Security — trust boundary and defenses against in-scope attacks.