VMess vs. VLESS: Key Differences for Shadowrocket Users

1. VMess and VLESS: Authentication vs. encryption

Both VMess and VLESS can use a UUID to identify a user, but their protocol formats differ. VMess provides authentication and data encryption at the protocol layer. The base VLESS protocol does not encrypt data, so it is typically paired with a secure transport such as TLS. A UUID in both configurations does not make them interchangeable.

Encryption here refers to the proxy connection between the client and server. HTTPS on a website is a separate layer: visiting a site over HTTPS does not mean the entire proxy connection has the same protection, and enabling TLS for the proxy does not make every website you visit use HTTPS. Check these two layers separately when troubleshooting.

Modern VMess configurations commonly use AEAD authentication. If an older configuration includes Alter ID, don’t confuse it with a UUID or carry its settings over mechanically to another configuration. If imported settings don’t match your provider’s current instructions, confirm they’re still supported before changing any fields.

2. UUIDs and ports: Same format, different connections

A UUID is commonly written as five groups of hexadecimal characters, for example 123e4567-e89b-42d3-a456-426614174000. This example is for recognizing the format only; it is not a usable credential. Enter the full value without spaces. Don’t put a configuration name, subscription name, or account password in the UUID field.

Address specifies where to connect, Port specifies which service endpoint to use, and UUID specifies which user identity to authenticate. All three must match. Ports 443 and 8443 on the same address can point to different endpoints; don’t replace one with the other just because one is more common.

• Check Address: enter only the domain name or IP address specified in the configuration, not the full subscription URL.
• Check Port: enter the number from the original configuration without a protocol prefix or path.
• Check UUID: make sure no characters were missed at either end and that no line breaks were copied.
• Check that the credentials are valid: expired, disabled, or restricted credentials may fail authentication even when formatted correctly.

3. TLS, Server Name, and WebSocket: Check each layer

It’s easier to check a connection as four layers: connect to Address and Port, establish TLS if enabled, set up a transport such as WebSocket, then authenticate with VMess or VLESS. This is a simplified model for understanding the configuration. If one layer fails, changing the UUID in a later layer usually won’t fix it.

Server Name is generally used for TLS SNI and certificate name verification. WebSocket Host is an HTTP request header, while Path is the request path. They may use the same domain, or differ depending on the server setup. Don’t automatically copy Host into Address, or treat Path as part of a subscription URL.

For example, if an existing configuration specifies TLS, Port 443, and WebSocket Path /proxy, keep each value as specified. Changing Path to / may prevent you from reaching the same service, even if Address, Port, and UUID are unchanged. Follow the original configuration for case sensitivity and query parameters.

4. Enter settings in Add Server, step by step

In Home, tap the add button to open Add Server. Whenever possible, import an existing provider configuration and review the entry. Enter settings manually only if you have the complete set of parameters. Available fields vary by Type; don’t switch protocols just to force in a setting that isn’t shown.

1. Choose Type. Select VMess for a VMess configuration or VLESS for a VLESS configuration. Similar names don’t mean their authentication formats are compatible.
2. Enter the connection endpoint. Enter Address and Port separately, and make sure you haven’t included a path after the domain in Address.
3. Enter the authentication details. Put the UUID in the corresponding authentication field. For VMess, use the encryption settings from the original configuration; don’t change them based on assumptions.
4. Set the transport. Select TCP, WebSocket, or another supported method as specified in the original configuration. For WebSocket, also check Host and Path.
5. Check TLS. Set TLS and Server Name as specified in the original configuration. Match any other required security settings too; the words “VLESS + TLS” alone don’t tell you the full configuration.
6. Save and select the entry. Return to Home, make sure the server you just saved is selected, then test the same destination.

When importing from a subscription, server entry settings and Config rules are separate. A subscription update may overwrite server settings. Save the original details before troubleshooting so temporary edits aren’t lost on the next update. Subscription URLs may contain access credentials; redact the full URL and UUID before sharing a screenshot or asking for help.

5. Connection failures: Separate protocol issues from routing issues

Turning on the switch in Home only shows that the connection process has started. It doesn’t confirm that the selected server authenticated successfully or that the current webpage is using it. Global Routing controls how traffic is routed; the server’s Type controls how it communicates with the server. These are separate layers.

Direct connects without a proxy, so it can’t be used to test whether a proxy server works. Scene applies settings for a particular scenario; it isn’t a fixed protocol. If the connection status changes automatically, also check Settings → On Demand and note the existing triggers. Don’t switch them repeatedly without understanding what they do.

• Connection timed out: Start by checking address resolution, port reachability, the current network, and server status. A timeout alone doesn’t mean the UUID is wrong.
• Certificate error: Check Server Name, the device’s date and time, certificate validity, and the trust chain. Don’t bypass verification.
• WebSocket handshake failed: Check that the transport matches, that Host and Path are complete, and that the reverse proxy still serves the specified path.
• Disconnected immediately after authentication: Check the protocol type, UUID, and server restrictions. For VMess, also make sure the device’s clock is accurate.
• Only some websites fail: Note the domain, Global Routing mode, and matched rule, then determine whether the issue is DNS, a rule, or the destination service.

6. Frequently asked questions: Check these before changing protocols

Follow this order: confirm what complete configuration your existing service provides, check that Shadowrocket supports that combination, then test under consistent conditions. A protocol name is only a starting point; a connection depends on all the settings matching. For basic instructions on Home, Config, and Settings, use the tutorials below.