Quick answer: TCP is reliable and ordered but slower. UDP is fast but may lose packets. TCP is used for web browsing, email, and file transfers. UDP is used for video calls, live streaming, and gaming. Modern protocols like WebRTC and QUIC blur the line by building reliability on top of UDP. Read on for the full comparison.
If you've ever wondered why a webpage loads flawlessly every time but a video call occasionally glitches, the answer lies in two transport layer protocols: TCP and UDP. They're the backbone of almost everything that happens on the internet, and understanding how they work helps you make better decisions about the technology you build and use.
This article covers what TCP and UDP are, how they differ, when to use each one, and how modern protocols like QUIC and WebRTC are changing the picture in 2026.
Table of contents
- What is TCP protocol?
- What is the UDP protocol?
- QUIC: the protocol that blurs the line
- How WebRTC uses both TCP and UDP
- When to use TCP vs UDP
- Security considerations
- Frequently asked questions
What is TCP?
The Transmission Control Protocol (TCP) is a connection-oriented protocol in the transport layer. Before any data is sent, TCP establishes a connection between sender and receiver through a process called the three-way handshake (SYN, SYN-ACK, ACK). Only after this handshake is complete does data start flowing.
Think of TCP as a tracked parcel delivery. Every packet is numbered, the receiver confirms each one, and if anything goes missing, it gets resent. This makes TCP highly reliable but adds overhead.
Key features of TCP
- Connection-oriented – A dedicated connection is established before data transfer begins, ensuring both sides are ready.
- Reliable delivery – Every packet is acknowledged. If a packet is lost, TCP automatically retransmits it.
- In-order delivery – Packets arrive in the sequence they were sent, regardless of the route they took through the network.
- Flow control – TCP adjusts the data transmission rate based on the receiver's capacity, preventing it from being overwhelmed.
- Congestion control – Mechanisms like slow start and congestion avoidance adapt to network conditions, reducing the risk of bottlenecks.
- Error checking – TCP uses checksums to verify data integrity, detecting corrupted packets.
Common TCP use cases
- Web browsing (HTTP/HTTPS) – Every webpage you load uses TCP (via HTTP/1.1 or HTTP/2) to ensure all elements arrive correctly and in order.
- Email (SMTP, IMAP, POP3) – Reliability matters for email. You need every character of every message to arrive intact.
- File transfers (FTP, SFTP) – Transferring files requires perfect accuracy. A single missing byte can corrupt an entire file.
- Online banking – Financial transactions demand both reliability and security. TCP, combined with TLS encryption, provides both.
- Database operations – Queries and transactions need guaranteed delivery and correct ordering.
Understanding RTMP Protocol: A Comprehensive Guide
Read the blog
What is UDP?
The User Datagram Protocol (UDP) is a connectionless protocol in the transport layer. Unlike TCP, there's no handshake, no connection setup, and no acknowledgement of received packets. UDP simply sends data and moves on.
Think of UDP as shouting across a room. It's fast and direct, but if someone doesn't hear a word, you don't go back and repeat it. For many real-time applications, this trade-off is worth it.
Key features of UDP
- Connectionless – No handshake required. Data is sent immediately, reducing startup delay.
- Low overhead – Minimal protocol headers mean less wasted bandwidth.
- Low latency – Without acknowledgements and retransmissions, data moves faster.
- No guaranteed delivery – Packets may be lost, duplicated, or arrive out of order. The application must handle this if needed.
- No congestion control – UDP sends data at whatever rate the application chooses, regardless of network conditions.
- Supports broadcasting and multicasting – UDP can send the same data to multiple recipients simultaneously, which TCP cannot do.
Common UDP use cases
- Video conferencing and VoIP – Real-time voice and video prioritise speed over perfection. A dropped frame is better than a delayed one. This is why platforms like Digital Samba, Zoom, and Google Meet use UDP-based protocols for media streams.
- Live streaming – Whether it's a sports broadcast or a live webinar, viewers need content in real time. UDP's low latency keeps the stream flowing.
- Online gaming – Player positions, actions, and game state need to update instantly. The latest data always matters more than resending old data.
- DNS lookups – When your browser resolves a domain name, it sends a quick UDP query. Speed is essential; if the response doesn't come back, it simply tries again.
- IoT and sensor data – Many Internet of Things devices send frequent, small data packets where occasional loss is acceptable.
Understanding Latency and Bandwidth: Unveiling the Key Differences
Read the blog
TCP vs UDP: comparison table
Here's a side-by-side breakdown of the key differences.
| Feature | TCP | UDP |
|---|---|---|
| Connection | Connection-oriented (three-way handshake) | Connectionless (no handshake) |
| Reliability | Guaranteed delivery with acknowledgements | No delivery guarantee |
| Ordering | In-order delivery guaranteed | No ordering guarantee |
| Speed | Slower (connection setup + acknowledgements) | Faster (no overhead) |
| Overhead | Higher (headers, handshake, acknowledgements) | Lower (minimal headers) |
| Error checking | Yes (checksums + retransmission) | Checksum only (no retransmission) |
| Congestion control | Yes (adapts to network conditions) | No (application-controlled) |
| Broadcasting | Not supported | Supported |
| Data retransmission | Yes (lost packets are resent) | No |
| Best for | Web, email, file transfer, banking | Video calls, streaming, gaming, DNS |
| Used by | HTTP/1.1, HTTP/2, FTP, SMTP, SSH | WebRTC, QUIC/HTTP/3, DNS, VoIP, DHCP |
The key trade-off: TCP sacrifices speed for reliability. UDP sacrifices reliability for speed. Your choice depends on whether your application needs every byte to arrive perfectly (TCP) or needs data to arrive as fast as possible (UDP).
QUIC: the protocol that blurs the line
If TCP vs UDP were the only story, networking would be simpler. But modern protocols have evolved beyond this binary choice.
QUIC (originally "Quick UDP Internet Connections") is a transport protocol developed by Google and now standardised by the IETF. It's built on top of UDP but adds many of TCP's reliability features – ordered delivery, congestion control, and encryption – without TCP's performance penalties.
Why QUIC matters
- HTTP/3 runs on QUIC. The latest version of HTTP, which powers the modern web, uses QUIC instead of TCP. This means a significant portion of web traffic is now UDP-based at the transport layer, even though it behaves reliably like TCP at the application layer.
- Faster connection setup. QUIC combines the transport handshake and TLS encryption handshake into a single round trip (or zero round trips for repeat connections). TCP + TLS requires two or three round trips before data can flow.
- Multiplexed streams without head-of-line blocking. In TCP, if one packet is lost, all subsequent packets are delayed until the lost one is retransmitted (head-of-line blocking). QUIC handles each stream independently, so a lost packet in one stream doesn't block others.
- Built-in encryption. QUIC encrypts everything by default using TLS 1.3. There's no unencrypted version.
The takeaway: the old "TCP = reliable, UDP = fast" framework still holds at the transport layer, but application-layer protocols like QUIC are increasingly building TCP-like reliability on top of UDP's speed. The boundary between the two is becoming less rigid.
How WebRTC uses both TCP and UDP
WebRTC (Web Real-Time Communication) is the technology behind browser-based video calls, voice chat, and real-time data sharing. It's what powers platforms like Digital Samba, Google Meet, and many other video conferencing tools.
WebRTC doesn't choose between TCP and UDP – it uses both, each for what they do best:
- Media streams (video and audio) travel over UDP, using protocols like RTP (Real-time Transport Protocol) and SRTP (Secure RTP). Speed and low latency are critical here. If a video frame is lost, resending it would arrive too late to be useful – it's better to skip ahead to the next frame.
- Signalling (session setup and negotiation) typically uses TCP-based protocols like WebSocket or HTTPS. These messages need to arrive reliably and in order because they establish the connection parameters.
- Data channels can use either TCP or UDP semantics via SCTP (Stream Control Transmission Protocol), which itself runs over DTLS/UDP in WebRTC. Developers can choose reliable-ordered delivery (TCP-like) or unreliable-unordered delivery (UDP-like) depending on the use case.
- ICE connectivity checks use STUN/TURN over UDP by default, falling back to TCP when UDP is blocked by firewalls or network policies.
This hybrid approach is why modern video conferencing works so well. You get the real-time performance of UDP for the media that matters most, with the reliability of TCP for the control messages that set everything up.
Digital Samba's video conferencing platform is built on WebRTC, taking advantage of this dual-protocol architecture. Combined with end-to-end encryption, EU-only hosting, and GDPR compliance by design, it delivers both performance and privacy for real-time communication.
Bandwidth: the meaning and how to measure it
Read the blog
When to use TCP vs UDP
The right protocol depends on what your application needs. Here's a practical decision framework.
Choose TCP when:
- Every byte matters. File transfers, database transactions, and financial data can't tolerate lost or reordered packets.
- Order is critical. Web pages need elements to load in the right sequence. Emails need to arrive as sent.
- Security layers depend on it. Many security protocols (TLS over TCP) are designed for connection-oriented transport.
- The application isn't time-sensitive. If it's OK to wait a fraction of a second for retransmission, TCP's reliability is worth it.
Choose UDP when:
- Speed is more important than completeness. Video calls, gaming, and live streams need the latest data now, not yesterday's retransmitted packet.
- The application handles its own reliability. Protocols like QUIC and WebRTC build their own error handling on top of UDP.
- Broadcasting or multicasting is needed. UDP can send to multiple recipients simultaneously.
- Overhead must be minimal. IoT devices, DNS lookups, and sensor networks benefit from UDP's lightweight design.
The hybrid approach
In practice, many modern applications don't pick one protocol exclusively. WebRTC uses both. QUIC builds on UDP with TCP-like features. HTTP/3 runs on QUIC while older HTTP versions run on TCP.
If you're building a real-time application – especially anything involving video, voice, or live interaction – a hybrid approach using WebRTC gives you the best of both worlds without having to manage the protocol complexity yourself.
Understanding and Preventing Packet Loss in WebRTC
Read the blog
Security considerations
Both protocols have security strengths and vulnerabilities worth understanding.
TCP security
TCP's three-way handshake provides a basic level of connection verification – both sides confirm they're ready before data flows. Combined with TLS (Transport Layer Security), TCP connections can be encrypted and authenticated.
However, TCP is vulnerable to:
- SYN flood attacks – Attackers send massive numbers of SYN requests without completing the handshake, exhausting server resources.
- TCP hijacking – If an attacker can predict sequence numbers, they may inject data into an active connection.
- Reset attacks – Forged RST packets can terminate legitimate connections.
UDP security
UDP lacks built-in security mechanisms. There's no handshake to verify the sender, and packets can be easily spoofed. This makes UDP susceptible to:
- DDoS amplification attacks – Attackers send small requests with spoofed source addresses to UDP services (like DNS), which respond with much larger replies directed at the victim.
- Packet spoofing – Without connection state, it's easier to forge the source of UDP packets.
DTLS (Datagram Transport Layer Security) can add encryption and authentication to UDP communications. WebRTC, for example, mandates DTLS for all peer connections, ensuring that UDP-based media streams are encrypted.
Optimising Real-Time Communications with Jitter Buffers
Read the blog
Frequently asked questions
Building a real-time application that needs both speed and reliability? Digital Samba's WebRTC-based video API gives you the best of both protocols – UDP for media performance, TCP for signalling reliability – with end-to-end encryption, EU-only hosting, and full GDPR compliance built in. Start for free with 10,000 participation minutes, or explore our API documentation.
Share this
A Deep Dive into the Network Performance Monitoring Metrics
Understanding Network Speed, Bandwidth, and Throughput
