VLESS Explained: What It Is, How Reality and Vision Work, and Where Xray Fits In

What is VLESS in simple terms

VLESS is the protocol your phone app uses to communicate with the VPN server. It answers two questions: who is connecting, and where to send the data. It does almost nothing else, and that's the point: less overhead means more speed.

Think of it like a courier service. You are sending a letter to an online store, but you don't want your local post office to see the destination. So, the letter first goes to the courier's warehouse (the VPN server), and from there to the store. In this scenario, VLESS is the waybill on the package: it contains your personal pass and the recipient's address. The warehouse checks the pass, and if it's valid, forwards the package.

The waybill itself doesn't seal the package. To stop anyone from peeking inside during transit, the package rides in a locked van. This van is TLS (the same tech that secures websites with the padlock icon) or its variant, Reality. Xray's documentation requires this outer layer of protection everywhere except in trusted local networks, unless the new built-in encryption is enabled (more on that below). That's why VLESS almost always works in tandem with TLS or Reality on the internet.

For the curious: what's inside a VLESS header

The VLESS request header is incredibly short: the protocol version number, a 16-byte user ID (UUID), the command (TCP, UDP, or mux), the port, and the destination address. The server checks the UUID on every connection. The protocol doesn't store state between connections and doesn't rely on system time. Its predecessor, VMess, required a system clock that was off by no more than two minutes.

In links, you'll almost always see encryption=none. This means VLESS's own encryption is off, and TLS or Reality is doing the work. Newer Xray versions introduced optional built-in VLESS Encryption with post-quantum key exchange (ML-KEM-768 paired with X25519). But if your link says none, that is the standard setup, and you don't need to change it.

How VLESS differs from a regular VPN

Classic VPN protocols like WireGuard, OpenVPN, and IPsec were built to securely connect a computer to an office network or link two networks together. They operate at the network packet level: your device gets a virtual network card, and all traffic routes through it. Hiding the VPN connection wasn't a priority, making them easy to spot from the very first data packets.

VLESS works like a proxy. It forwards specific app connections rather than raw network packets. To make your phone treat it like a VPN, the client app creates a virtual network interface (called TUN) and routes all traffic into the Xray engine. That's why you see the VPN icon in your status bar and a VPN profile in your iPhone settings, even though it's technically a proxy protocol running underneath.

You'll notice the difference in three main areas.

• A VLESS connection with TLS or Reality looks like standard encrypted web browsing from the outside. Classic protocols can't do this, and according to media reports, they have been heavily restricted in Russia since 2023. Read more in our VPN protocol comparison.
• There are more parameters that need to match between your phone and the server. Instead of manual entry, they are shared as a ready-made link or subscription. We break down how this works in our article on VLESS keys and subscriptions.
• The Xray engine can route traffic based on rules. For example, it can send local websites and banking apps directly, while routing everything else through the server. This is called split tunneling.

If you want to step back and understand what a VPN actually does and what it protects you from, start with our guide on what a VPN is in simple terms.

What VLESS Reality is and why you need it

Standard TLS requires its own domain and a corresponding certificate, just like any website. A server built solely to run a VPN has to pretend to be a website: host a dummy page and renew certificates. Even then, its TLS handshake might contain subtle clues that distinguish it from real websites.

Reality (stylized as REALITY in documentation) solves this differently. The server borrows the identity of a major, real website running TLS 1.3. When connecting, the client requests this specific website, and the server checks if the client has the right key. If it does, the standard VLESS connection begins. If not (for instance, if someone is probing the server to see what it is), the connection transparently forwards to that actual website. The person probing sees the real site and its genuine certificate.

Imagine a business center reception desk with a famous company's logo on the door. Guests with your specific pass are escorted to your hidden office, while everyone else goes to the famous company, which actually operates there. From the outside, it just looks like people walking through a well-known door.

The server doesn't need its own domain or certificate. The client also adapts: the app mimics the greeting of a popular browser, usually Chrome, using the uTLS library. In the link, this is controlled by the fp (fingerprint) parameter.

Reality doesn't work with all transports. It only supports TCP (called RAW in newer Xray versions), XHTTP, and gRPC. You can find the source code and details in the XTLS/REALITY repository on GitHub.

For the curious: Reality parameters in the link

• sni — the name of the website the server is impersonating;
• pbk — the server's public key (called password in newer Xray configs), used by the client and server to recognize each other;
• sid — a short identifier (shortId), a hexadecimal string up to 16 characters long;
• fp — which browser the app impersonates during the handshake;
• spx — the fallback path if the client acts like a normal browser when forwarded to the real website.

What xtls-rprx-vision is and why it's in the link

You'll often see flow=xtls-rprx-vision in links and settings. This is a data transfer mode, commonly called Vision. The letters rprx stand for the nickname of the creator of VLESS and Vision.

To understand why it's needed, imagine an envelope inside an envelope. Almost all websites load via HTTPS today, meaning the browser encrypts the data itself. The VPN connection then encrypts it a second time. This creates TLS inside TLS: double the work for the processor and a recognizable pattern. While the browser and website negotiate encryption, they exchange several messages of specific sizes, and this rhythm shows through the outer envelope.

In 2024, researchers at the USENIX Security conference demonstrated how these nested handshakes can be identified by packet sizes and timing, without decrypting the traffic (read the paper). Xray's documentation on the Trojan protocol also warns that "TLS inside TLS" is easily detected.

Vision does two things. First, it pads the initial handshake packets with random bytes so their sizes don't form a recognizable pattern. Second, once the internal TLS 1.3 handshake finishes, Vision stops encrypting the already-encrypted data a second time and passes it through as is. On Linux servers, this data can route directly through the system kernel, bypassing Xray's memory and saving resources.

Vision only works over TCP with TLS or Reality, and with the new VLESS Encryption. If your link uses XHTTP, gRPC, or WebSocket, the flow field is usually empty, which is completely normal.

Sometimes you'll see xtls-rprx-vision-udp443. By default, standard Vision blocks UDP traffic on port 443, which is used by QUIC (the foundation of HTTP/3). The browser then falls back to standard HTTPS over TCP. The udp443 variant leaves this traffic alone.

What tcp, ws, grpc, and xhttp mean in a VLESS link

A transport is the physical method data uses to travel between the app and the server. Going back to our courier analogy, the waybill and the van are the same, but the route varies: a direct highway or via sorting facilities. In the link, the transport is listed under the type parameter.

• tcp (called raw in newer Xray versions) — a direct connection without extra wrappers. Vision only works with this transport, and it's most commonly paired with Reality.
• ws (WebSocket) and httpupgrade — the connection starts as a standard web request and turns into a persistent channel. These are handy when the server sits behind a web server or CDN.
• grpc — data travels inside the gRPC protocol over HTTP/2. Works with both TLS and Reality.
• xhttp — Xray's custom transport. Data moves via standard HTTP requests, sending and receiving can happen separately, and the connection easily passes through most CDNs and web servers. It works with TLS and Reality, and when paired with TLS, can even use HTTP/3.
• kcp (mKCP) — operates over UDP, using more bandwidth to lower latency on poor connections. Rarely used today.

The service provider decides which transport to put in the link, and you shouldn't change it manually: the server must be configured with the exact same option. Providers often offer multiple transport options for a single location because different networks handle different transports better.

What Xray-core is and how protocols, engines, and apps connect

The word Xray always pops up next to VLESS, and they are often confused. It's easiest to break things down into three levels, like a car: traffic rules, the engine, and the car itself with its steering wheel and dashboard.

• Protocol (VLESS, VMess, Trojan, Shadowsocks) — the rules: how to format data and authenticate users.
• Engine (Xray-core or sing-box) — the engine: the program that knows these rules, encrypts data, picks a route, and sends traffic.
• App (Incy, Happ, Hiddify, v2rayNG, Streisand) — the whole car: the power button, server list, subscription updater, and system permissions for the VPN.

Xray-core is the open-source engine from Project X. The code is available on GitHub under the MPL-2.0 license. The first version in 2020 was a fork of V2Ray, and since then, Xray is where Reality, Vision, and XHTTP were introduced. Besides VLESS, the engine understands VMess, Trojan, Shadowsocks, WireGuard, SOCKS, and HTTP. Versions are named by their release date: for example, 26.10.21 was released on October 21, 2026.

The second popular engine is sing-box, which powers Hiddify and NekoBox. It also supports VLESS, Reality, and Vision, so the same subscription usually works on both. Sometimes a new setting appears in one engine before the other, causing an app using the older or different engine to fail to connect. We compare these clients in our review of VLESS apps.

You don't need to install Xray separately on your phone or computer. The engine is built into the app and updates with it. It's only installed separately on the server.

What happens when you open a website

1. The app has already created a virtual network interface on your phone, and the browser sends a request to it.
2. The engine checks its routing rules: send this address directly or through the server.
3. If via the server, the engine packages the request using VLESS rules, wraps it in TLS or Reality, and sends it.
4. Xray on the server verifies the UUID, extracts the destination address, and opens the website itself.
5. The response returns via the same route in reverse.

The engine also handles DNS requests (which turn a website name into an IP address) based on its own rules. That's why a DNS misconfiguration sometimes looks like a total VPN failure, even if the server connection is fine.

For the curious: inside an Xray configuration

If you open an Xray configuration in JSON format, you'll find a few main blocks:

• inbounds — where the engine receives traffic: from a virtual interface, a local SOCKS port, or (on the server) from VLESS clients;
• outbounds — where it sends traffic: to a remote server, directly to the web, or into a "black hole" where unwanted requests vanish;
• routing — rules for choosing the outbound, based on domain, IP address, or port;
• dns — which DNS servers to use and for which domains.

You'll never have to edit this manually: the app builds the config itself from your link or subscription.

How VLESS differs from VMess and Trojan

All three protocols live in the same ecosystem and are supported by Xray, but they were created at different times for different needs.

VLESS vs VMess. VMess was born when mandatory internal protocol encryption was the standard. Today, it almost always sits behind TLS, meaning data is encrypted twice. VLESS removed this redundant layer and the time dependency, making it lighter. VMess still works, but all new Xray features like Vision are built for VLESS.

VLESS vs Trojan. The concept is similar: both hide inside TLS. Trojan is simpler, verifies the client via password, and sends everyone else to a normal website. It doesn't have a Vision mode, and Xray documentation recommends enabling multiplexing (Mux) for Trojan to avoid obvious "TLS inside TLS" patterns. Vision for VLESS was created specifically to solve this issue.

Average users rarely have to choose between them: the protocol is already baked into the link or subscription from the provider.

How secure is VLESS?

When VLESS runs with TLS or Reality, your ISP and the people on your cafe's Wi-Fi only see an encrypted connection to a server. They cannot see which websites you visit or what data you send. The encryption strength matches standard HTTPS websites. Reality also maintains forward secrecy: even if the server's key is leaked in the future, previously recorded traffic cannot be decrypted.

The protocol only secures the path to the VPN server. The server itself knows which addresses you're visiting, which is why it matters who runs it. For this exact reason, you shouldn't connect via random free keys. We explained how these providers make money in our article on the real cost of free VPNs.

VLESS does not protect against phishing, viruses, or app leaks. That requires personal vigilance, system updates, and antivirus software. And if both security and encryption are set to none in the link, your data travels completely unencrypted. That's a terrible setup for a server on the public internet.

Why VLESS stopped working and what to check

Protocols don't just break overnight. If it worked yesterday but doesn't today, the cause is almost always the network, the server, or the app.

Common causes

• Server address is blocked on your network. The IP might be restricted, or the hosting provider is having issues. Sign: one location fails while others work, or it works on Wi-Fi but not on mobile data.
• ISP filtering rules changed. According to RBC, in late 2025, Roskomnadzor (Russia's communications regulator) updated its TSPU equipment to restrict SOCKS5, VLESS, and L2TP protocols. This happens unevenly depending on the carrier, region, and specific server settings. Providers update server configs to bypass this, pushing new parameters through your subscription.
• Mobile internet whitelisting is active. During severe restrictions in certain regions, only government-approved services are allowed to connect, blocking all VPNs. We explain this mode in our article on internet whitelists.
• Outdated app or subscription. An older client might not understand newer transports like XHTTP or updated Reality parameters. If you haven't updated your subscription recently, your app is trying to connect using old settings.
• Routine issues. Your payment lapsed, another VPN is active simultaneously, or your device date/time is heavily out of sync, causing certificate verification to fail.

Step-by-step troubleshooting

1. Update your subscription in the app. This is usually a circular arrow button next to your profile or an "Update" option in the menu.
2. Update the app itself from the App Store, Google Play, or the developer's official site.
3. Choose a different location from the server list.
4. Switch from mobile data to Wi-Fi (or vice versa) to see if it's network-specific.
5. Check your balance or subscription duration in the provider's dashboard.
6. Contact support: mention the app, its version, your network, and the exact error text. Do not send them the actual link or your UUID.

Byte VPN, for example, runs on VLESS with Reality via XHTTP/TLS, and all available locations are delivered through a single subscription, so you can switch servers right in the app. For a detailed breakdown of errors like timeout, read VPN won't connect: what to do.