VMess and VLESS are not interchangeable names. Both commonly use a UUID to identify the user, but VMess can encrypt data at the protocol layer, while VLESS does not encrypt data on its own. Check whether an additional security layer, such as TLS, is configured. For users who already have a provider and subscription, this guide explains the differences across protocol, transport, and security layers, then walks through the Shadowrocket fields to check and a troubleshooting sequence.
1. Understand the protocol, transport, and TLS layers
In Shadowrocket, selecting VMess or VLESS only sets the proxy protocol used for the connection. It does not determine the transport method or security settings. A VLESS label does not mean the connection uses WebSocket, and VMess does not mean TLS is enabled.
Break a connection into three questions: which protocol identifies the user, how proxy data is encapsulated and transmitted, and whether TLS protects the connection between the client and server. Match each layer to the server settings. Don’t enter only the address, port, and UUID while overlooking the rest.
| Layer | Examples | What to check |
|---|---|---|
| Proxy protocol | VMess / VLESS | Type must match the server, and the UUID must belong to the same account. |
| Transport | TCP / WebSocket | Choose the method specified by the server. For WebSocket, also check Host and Path. |
| Security layer | TLS | Check whether it is enabled and verify the server name used for the handshake and certificate validation. |
TCP and WebSocket are two common configurations used here as examples; they are not a complete list of supported options. Use the options currently shown in the app. If an existing subscription provides specific transport parameters, follow that configuration rather than inferring values from the protocol name.
2. Compare VMess and VLESS encryption and UUIDs
VMess includes authentication and data encryption mechanisms in its protocol design; common configurations use AEAD. VLESS has a simpler protocol design and does not encrypt proxy payloads on its own. So encryption=none in a VLESS configuration does not, by itself, mean the entire connection is unencrypted. Check whether TLS is used as an outer security layer.
| Field | VMess | VLESS |
|---|---|---|
| User identifier | Usually a UUID. | Usually a UUID. |
| Protocol-layer encryption | Includes data encryption mechanisms; retain the options specified by the server. | Does not provide data encryption on its own; don’t reuse VMess encryption algorithm settings. |
| Role of TLS | Can provide additional outer-layer protection; it is not enabled automatically by choosing VMess. | Commonly protects the connection between client and server; verify the actual security settings. |
| Legacy field | Older configurations may include AlterId; modern AEAD configurations typically use 0. | Does not use the VMess AlterId authentication mechanism. |
| Can you convert it by renaming? | No. Changing Type does not change the server listener or account configuration. | |
A UUID is an identity credential, not a server address or TLS certificate. Even if two configurations happen to show the same UUID, they are still different connections if the protocol, port, or transport differs. Don’t include UUIDs in public screenshots, troubleshooting posts, or messages.
How to tell: check TLS before interpreting none
If you see encryption=none in VLESS, open the configuration and check TLS and the server name first. Don’t switch to VMess just to remove the word none, and don’t assume TLS is enabled just because the port is 443.
3. Enter fields in Home → Add Server
To add a server manually, go to Add Server from Home. The fields that follow vary by Type and transport options, and the interface may change as the app is updated. The table below explains what to check; it does not mean every connection will show exactly the same form.
- Choose Type first. Select VMess or VLESS based on the information from your provider, then fill in the remaining fields. This helps avoid missing options that may reset when you switch types.
- Enter Address and Port. Enter only the specified hostname or IP address in Address and the specified number in Port. Don’t paste the entire share link into the address field.
- Enter the UUID. Copy the full user identifier. Check for leading or trailing spaces, missing characters, and accidental line breaks. Don’t generate a replacement value.
- Check the transport settings. If you use WebSocket, also verify Host and Path. Preserve the leading slash and capitalization in the path.
- Check the security settings. Set TLS and the server name to match the original configuration. Fill in additional fields only if your provider explicitly supplies those parameters and the app shows the corresponding options.
- Save and return to Home. Select the entry you just saved, then run a connection test. Saving confirms that the form was recorded; it does not mean the server accepted the connection.
| Field or concept | What to use | Common mistake |
|---|---|---|
| Address / Port | The connection address and port provided by your existing service provider. | Assuming 443 is the default and replacing the port in the original configuration. |
| UUID | The full user identifier for the current server account. | Using the UUID from another configuration or copying it with extra spaces. |
| VMess encryption option | Keep the setting from the imported configuration or follow your provider’s requirements. | Reusing a password or algorithm from another protocol. |
| Host / Path | The server settings for WebSocket or the specified transport. | Dropping the / from Path or assuming Host must match Address. |
| TLS / SNI | Security layer settings and server name requirements. | When connecting by IP, mistaking the IP address for the domain name on the certificate. |
Address, WebSocket Host, and TLS SNI may match, but they may also differ depending on the server setup. Address specifies the connection target, Host is part of the relevant application-layer request, and SNI indicates the server name during the TLS handshake. Don’t change all three to the same domain just for consistency.
4. Identify VMess and VLESS in a subscription
A subscription distributes configurations; it is not a third proxy protocol. An existing subscription can include multiple types. A “VMess” or “VLESS” label in the name may just be a note, so don’t rely on it to identify the actual type. Open the specific entry from Home and check its Type and parameters.
- Check the actual type: The
vmess://andvless://prefixes in a share link can help identify it at a glance. After importing, use the Type shown in the app as the source of truth. - Check where the parameters appear: VMess share details often encode the configuration in the link body. VLESS share links commonly put the UUID before the address and use query parameters for transport and security settings. Don’t rely only on a readable label.
- Distinguish a subscription URL from a single link: A subscription URL retrieves a set of configurations, while a single share link describes one connection. Use the appropriate import method for each.
- Check again after updating: Update the relevant subscription from Home, then check whether the target entry is still there and whether its Type, address, or transport changed. Confirm which entry is selected.
For example, https://example.com/sub?token=xxxx illustrates the format of a subscription URL; it is not a working service. Treat tokens and UUIDs in actual subscriptions as sensitive information. When reporting an issue, you can record the Type, transport, port, and error symptoms without including credentials.
5. Troubleshoot connections: preserve the configuration, then check routing
VMess and VLESS can both fail if the address, authentication, transport, or TLS settings don’t match. Change one variable at a time: confirm the selected server, check the protocol and fields, then verify that traffic actually passes through that connection. Don’t change Type, port, TLS, and Global Routing all at once, or you won’t know which change affected the result.
Preserve the original protocol and settings
RecommendedCompare each field with the existing subscription or provider settings, then test one change at a time. If the configuration explicitly requires TLS, keep certificate validation enabled; don’t disable it as a way to diagnose the error.
Best for: first-time imports, manual setup, or an unknown protocol type
Global Routing → Proxy
To isolate the effect of rules, you can temporarily use Proxy to test a web request. This does not guarantee that all system traffic will be routed through the proxy, and it cannot fix incorrect server settings.
Best for: the server test responds, but you suspect rules are sending web requests to another policy
Global Routing → Config
Traffic is handled according to the rules in the current Config. After testing, restore the previous routing mode and check which rule and policy matched the request. Don’t mistake a rule outcome for protocol performance.
Best for: checking everyday rule-based routing and rule matches after confirming the connection works
- Select the target entry in Home and check its label and actual Type to avoid testing a different server.
- Run Connectivity Test and note whether the entry shows a response or a failure. The result reflects only that specific test; it does not guarantee access to every website or app.
- Complete the VPN configuration authorization prompt and turn on the connection, then test an actual webpage. If Global Routing is set to Direct, a direct connection result does not prove the proxy protocol works.
- For certificate errors, first check the system date and time, TLS server name, and domain on the certificate. For timeouts, also check the address, port, and network reachability. An error is a clue, not a definitive diagnosis.
- If you use Config, check the rule order and the target policies for
DOMAIN-SUFFIX,IP-CIDR,GEOIP, andFINAL. These determine how requests are routed; they do not automatically convert VMess to VLESS.
Troubleshooting order: reachability, authentication, transport, security layer, routing
Save the original configuration and record one failure before troubleshooting. Check each layer in order. If changing one setting doesn’t help, revert it before moving on; don’t stack unverified changes.
6. VMess and VLESS FAQs
If the UUID is the same, can I change VMess directly to VLESS?
No. A matching UUID does not convert the configuration. Open the entry in Home to check its Type, and ask your existing provider which protocol the port accepts. Even with the same user identifier, the server must be configured for the matching protocol, transport, and security settings. If you need the other protocol, use the corresponding entry provided by your provider.
If VLESS shows none, should I select an encryption algorithm manually?
Don’t reuse a VMess algorithm. VLESS does not encrypt data at the protocol layer, so check the TLS and other security settings. If the original configuration specifies TLS, verify TLS and the server name in the entry’s edit screen. If the security parameters are unclear, check with your existing provider before connecting.
Why do I get a TLS error when the port is set to 443?
443 is just a port number. Check that TLS is enabled as required, SNI matches the certificate, the device date and time are correct, and Address points to the right server. Don’t hide a name mismatch by disabling certificate validation.
Which protocol is always faster or has lower latency?
You can’t tell from the protocol name alone. For a fair comparison, keep the access network, server location, transport, TLS, and test target as consistent as possible. Run Connectivity Test repeatedly from Home, then check actual requests. A single response from a different server cannot be attributed to VMess or VLESS alone.
What should I do if a subscription update changes fields I corrected manually?
First check whether the changed entry is managed by the subscription or is a separately saved test entry. Then verify its updated Type, address, and security settings. Share the differences before and after the update, without credentials, with your existing provider. Don’t keep overwriting the UUID or share the full subscription URL publicly.