VMess vs. VLESS: What to Know Before Adding a Server in Shadowrocket

1. Key differences between VMess and VLESS

Choose the protocol your provider actually runs—don’t assume one is faster based on its name. VMess has its own authentication and data-encryption mechanisms. VLESS does not encrypt data at the protocol level, so assess connection security based on the transport and security layers in use. Both commonly use a UUID, but that does not mean a server port can accept both protocols.

Modern VMess authentication typically uses AEAD. Don’t guess an AlterId value for older settings. If older documentation differs from the current imported configuration, ask your provider to confirm the current settings. In VLESS, encryption=none describes the protocol layer. It does not mean you should disable TLS or ignore certificate errors.

There’s no universal answer to “How much faster is VLESS than VMess?” Server load, network latency, packet loss, transport method, and the destination site all affect performance. Changing only the protocol name without controlling these variables won’t produce a reliable speed comparison.

2. Understand UUID, transport, and TLS separately

Before adding a server, sort the details into three groups: where to connect, how to authenticate, and how the connection is carried. Address and Port specify the destination; UUID is used for authentication. Transport methods such as WebSocket and TLS determine how the connection is established. Mixing up these settings is a common reason a configuration looks complete but won’t connect.

• UUID: A common text format uses hexadecimal characters in 8-4-4-4-12 groups, for example 123e4567-e89b-42d3-a456-426614174000. This is a format example, not a usable credential. When entering your UUID, don’t include spaces, quotation marks, or line breaks.
• Port: Enter the number provided by your service provider. Using TLS does not mean the port must be 443; don’t change another port to 443 on your own.
• WebSocket Path: This is the request path, usually starting with /. Keep the original capitalization, path segments, and query parameters. Don’t enter only the domain.
• Host: For WebSocket connections, this is the Host information in the HTTP request. It may or may not match the connection address.
• SNI: This is the server name sent during the TLS handshake. It must also match the certificate configuration. If your provider specifies a TLS server name, enter it even if you’ve already filled in Host.

3. Add a server in Add Server

This example covers manual setup from Home. Button locations may vary by platform, so use the fields shown in your current version. If you already have a subscription, importing the complete subscription provided by your service provider can help prevent errors from manual entry. Subscription import and manual Add Server are two ways to add configuration—not two different protocols.

1. Keep the original details. Confirm whether they’re for VMess or VLESS, and note the Address, Port, UUID, transport method, and TLS settings. Don’t combine the port or Path from a different entry.
2. Open Home → Add Server. Set Type to VMess or VLESS as specified in your details, then enter Address and Port. Choosing the wrong type may change which fields appear next.
3. Enter the UUID and protocol options. Set the VMess encryption option as specified. For VLESS, match any additional settings, such as Flow, to the server configuration; don’t copy them from another entry. If a required setting isn’t available in the current interface, first confirm that the configuration is supported.
4. Set the transport. If your provider specifies WebSocket, enter the corresponding Host and Path. If not, don’t enable it just to follow a tutorial. Check that the transport name in the imported details matches the client option.
5. Configure TLS. Enable or disable it as specified, and check the server name. Keep certificate verification enabled. If you see a certificate error, check the domain, system time, and server configuration instead of bypassing verification.
6. Save and select the entry. Return to Home and make sure the newly saved entry is selected before testing the connection. A successful save only confirms that the configuration was stored; it doesn’t mean the remote server authenticated the connection.

4. Why check settings after importing a subscription?

A subscription is a way to deliver a set of configurations; the protocol determines how each entry connects. A subscription can contain entries using different protocols. Successfully downloading a subscription only confirms that its details were retrieved and parsed—it doesn’t prove that every entry can currently connect.

• Check the source and validity period first. Get subscription links from your provider. A link may contain an access token, so don’t share the full URL in public screenshots, comments, or logs.
• Check the selected entry after updating. Your provider may change the Address, Port, or transport settings. After an update, return to Home and inspect the current entry. Don’t assume the settings are unchanged just because the entry name is familiar.
• An update does not convert protocols. If your provider hasn’t issued a VLESS configuration, refreshing a VMess subscription again won’t create a working VLESS entry.
• Keep imported entries separate from manual copies. Subscription entries may change when updated. Keep the original entry before experimenting with fields, so temporary changes aren’t mistaken for your provider’s latest settings.

When contacting your provider, include the protocol, transport method, stage where the error occurs, and the fields you’ve checked. Redact your UUID, subscription token, and full share link; they don’t need to be exposed in a troubleshooting report.

5. Connection failures: protocol or routing?

A connected status on Home doesn’t mean a particular website is using the selected entry. Global Routing determines how traffic is routed. If no rule sends a request through a proxy, it may go Direct even when the entry is configured correctly. Check the current routing mode before assuming the VMess or VLESS settings are wrong.

If you’re using Scene, also check which policy that scene actually uses; the name alone doesn’t tell you the route. In Config, DOMAIN-SUFFIX, GEOIP, IP-CIDR, and FINAL are routing-rule keywords, not protocol options. When troubleshooting, first confirm that traffic is being sent to the proxy, then check whether the proxy handshake succeeds.

1. Consistent timeouts: Check that Address resolves correctly, Port matches the details you were given, and the current network can reach the server. A timeout by itself doesn’t prove the UUID is wrong.
2. TLS error: Check the system time, SNI, and certificate name. Confirm that the server provides the expected TLS service on that port.
3. WebSocket handshake error: Check Path, Host, and the transport type. An HTTP rejection and a UUID authentication failure occur at different stages.
4. Disconnects immediately after the handshake: Recheck Type, UUID, and any protocol-specific settings. For VMess, also check whether the device clock is significantly off, since its authentication is time-sensitive.
5. Only some websites fail: Check DNS, rule matching, and whether the destination is reachable. Don’t immediately switch the entire entry from VMess to VLESS.

6. Common questions before and after setup