Connection & SecurityIntermediate12 min read

Encrypted Solo Mining: TLS and Stratum V2 Setup on mkpool (2026)

Published July 24, 2026

By default a miner talks to a pool in the clear. Plain Stratum V1 sends your payout address, the work you are given and the shares you return as unencrypted text, so anyone able to watch the network path can read them. On a trusted home network that is usually fine. When the path is not fully trusted, mkpool offers two encrypted options on every SHA-256 chain, and this guide sets up both.

Two ways to encrypt

Stratum V1 over TLS wraps the ordinary protocol in an encrypted tunnel, the same technology that puts the padlock on a website. Everything about your setup stays the same; the traffic is just no longer readable in transit.
Stratum V2 is a newer protocol that encrypts the link over the Noise framework and authenticates the pool with a published key. Your miner verifies it is really talking to mkpool, which is what stops a man-in-the-middle from impersonating the pool and diverting your hashrate.

What each one protects

TLS hides your address and work from anyone watching the network. Stratum V2 does the same and adds authenticated pool identity, so the connection cannot be silently redirected. If your firmware supports V2, it is the stronger choice; TLS is the simpler drop-in where it does not.

The ports

Both live alongside the plain ports on the same host. This table is read from the pool config, so the TLS and Stratum V2 ports and the V2 URL are exactly what the pool is serving for Bitcoin:

Host: btc.mkpool.com

Port	Difficulty	Encryption	Rented hashrate
3333	vardiff [1024 to 1M]	Plain	Owned miners
3334	vardiff [1024 to 1M] · TLS	TLS	Owned miners
3335	fixed 1,000,000 · TLS	TLS	Owned miners
3336	fixed 10,000,000 · TLS	TLS	Owned miners
3342	fixed 50,000,000 · TLS	TLS	Owned miners
3337	fixed 1,000,000	Plain	NiceHash · Braiins
3338	fixed 10,000,000	Plain	NiceHash · Braiins
3339	fixed 50,000,000	Plain	NiceHash · Braiins
3340	vardiff [1024 to 1M]	Stratum V2	Owned miners · Braiins
3380	fixed 1,000,000	Stratum V2	Owned miners · Braiins
3381	fixed 10,000,000	Stratum V2	Owned miners · Braiins
3382	fixed 50,000,000	Stratum V2	Owned miners · Braiins

Stratum V2 URL: stratum2+tcp://btc.mkpool.com:3340/9c9aZWzETaiJyqGGUSCn8GqFgTpxs96ert4d4jGeRnvxqRqhZar

Notice that TLS and V2 come in the same vardiff and fixed tiers as the plain ports, encryption and difficulty are independent choices. Pick the difficulty that suits your hardware (see choosing a difficulty tier), then pick the encrypted port at that difficulty.

Does your firmware support it?

Encryption is a firmware feature, not a pool setting, so what you can use depends on what your miner runs:

Stock Antminer / Whatsminer, plain Stratum V1 only.
Braiins OS, Stratum V2 on compatible Antminers; see Braiins OS and Stratum V2.
AxeOS (Bitaxe, NerdQAxe), recent builds add Stratum V2; see Bitaxe on Stratum V2.

If your firmware only offers plain stratum, use a plain port; you can revisit encryption after a firmware update.

Setting up TLS

In your miner's pool configuration, use the stratum+ssl:// scheme with a TLS port from the table, keeping your address and password exactly as before:

URL: stratum+ssl://btc.mkpool.com:<tls-port>
Worker: your address, e.g. bc1qyouraddress.rig
Password: x

That is the whole change, the tunnel is transparent to everything else about your setup.

Setting up Stratum V2

Stratum V2 uses its own URL scheme that carries the pool's authority key after the port:

stratum2+tcp://btc.mkpool.com:<v2-port>/9c9aZWzETaiJyqGGUSCn8GqFgTpxs96ert4d4jGeRnvxqRqhZar

The exact ready-to-copy URL for the vardiff V2 port is shown under the table above. The long string is mkpool's authority public key: it is the same on every chain and safe to publish. Your miner uses it in the encrypted handshake to confirm the pool's identity.

Enter the key exactly

The authority key is what authenticates the pool. Copy it in full, with no spaces or line breaks. If your firmware has a separate field for the authority or certificate key rather than putting it in the URL, paste it there instead. Check your firmware's Stratum V2 documentation for which form it expects.

Your address goes in the worker field and the password is x, exactly as on a plain connection.

Verify it connected

An encrypted connection is invisible once it works: you will not see a difference in your shares or hashrate, which is the point. Confirm it the usual way: accepted shares climbing on the miner, and your address showing a live hashrate on the mkpool miners page. If it fails to connect, the most common causes are the wrong scheme or port for the tier, a firmware that does not actually support the protocol, or an authority key that was truncated on paste.

Disclaimer

Firmware support for TLS and Stratum V2 changes over time and the field layout differs between firmwares; follow your miner's documentation for the exact form it expects. Ports and the authority key are read live from the pool config and are current at the time of reading. Nothing here is financial advice.

Frequently asked questions

What is the difference between TLS and Stratum V2?

TLS wraps the ordinary Stratum V1 protocol in an encrypted tunnel, the same technology that secures websites. Stratum V2 is a newer protocol that encrypts the link over the Noise framework and also authenticates the pool with a published key, so your miner verifies it is talking to the real mkpool and not an impostor. Both hide your address and work from anyone watching the network; V2 adds authenticated pool identity.

Do I need to encrypt my mining connection?

On a trusted home network, plain stratum is usually fine. Encryption matters when the path is not fully trusted, shared or hosted networks, connections that cross the public internet, or anywhere you would rather your payout address and hashrate not be readable in transit. If in doubt and your firmware supports it, there is little downside to using it.

Which firmware supports Stratum V2?

Stock Antminer and Whatsminer firmware speaks plain Stratum V1 only. Braiins OS supports Stratum V2 on compatible Antminers, and recent AxeOS builds add Stratum V2 for Bitaxe and NerdQAxe boards. If your firmware only offers plain stratum, use a plain or, where available, a TLS port instead.

What is the authority key in the Stratum V2 URL?

It is mkpool's public authority key, and it is the same on every chain and safe to publish. Your miner uses it during the encrypted handshake to confirm the pool's identity, which is what stops a man-in-the-middle from impersonating the pool and stealing your hashrate. You include it in the connection URL after the port.

Does encryption slow mining down or change my odds?

No. The encryption overhead on stratum traffic is negligible, and it does not change your share difficulty or your probability of finding a block. Choosing to encrypt is independent of choosing a difficulty tier, the TLS and Stratum V2 ports are offered in the same vardiff and fixed flavours as the plain ports.

Newsletter

Mining insights in your inbox

New guides, hardware reviews, and pool updates. No spam, unsubscribe anytime.

Keep reading

Connection & SecurityIntermediate10 min read

Which Stratum Port and Difficulty Should You Use? (2026)

mkpool offers vardiff and fixed-difficulty ports on every chain. Here is what share difficulty actually is, why it does not change your block odds, and exactly which port to use for a Bitaxe, an owned ASIC, or rented NiceHash hashrate.

Mecanik1337Read →

Setup & First ShareBeginner11 min read

Connect Any Miner to mkpool: The Universal Setup Guide (2026)

One pattern connects every miner to mkpool: a stratum URL, your own wallet address as the username, and the password x. Match your hardware's algorithm to a chain, pick a port, and mine straight to your wallet, no account, no custody.

Mecanik1337Read →

Setup & First ShareIntermediate12 min read

Antminer S21 Series: Solo Mining Setup on mkpool (2026)

Point an Antminer S21, S21 Pro, S21 XP or S21 Hydro at mkpool and solo mine straight to your own wallet. Web UI access, exact stratum ports, difficulty tiers, TLS and Stratum V2, AsicBoost, fleet naming and how to verify the connection.

Mecanik1337Read →

← back to all guides