VMess vs. VLESS: Key Differences in Shadowrocket

1. The key difference: protocol-level encryption

The short version: VMess has its own authentication and encryption mechanisms; VLESS separates authentication from transport protection and does not encrypt payloads at the protocol level. Assess a VLESS connection’s security based on the protections actually in use, such as TLS. “VLESS does not encrypt by itself” does not mean that every VLESS connection sends data in plaintext.

Conversely, VMess’s protocol-level encryption does not mean you can turn off TLS at will. If the server requires TLS, the client must still establish a TLS connection as specified. These two settings address different concerns and must match the server configuration.

Protocol names are not speed ratings. Latency, bandwidth, network congestion, server load, and transport configuration all affect performance. Two similarly named entries may connect to entirely different servers, so you cannot assume one protocol is faster.

2. Check Address, Port, and UUID in Add Server

In Home, find the entry you want to check and open its edit screen. To add one manually, use the add option in Home to open Add Server, then choose the matching Type. Available fields and options vary by type, so refer to the current interface and the complete parameters from your provider.

1. Type: Confirm whether it is VMess or VLESS. Don’t guess from the entry name or treat changing Type as an upgrade.
2. Address: Enter the actual domain name or IP address to connect to. It may differ from the TLS verification name, and should not include the protocol prefix from a share link.
3. Port: Enter the server’s listening port. For example, if your provider specifies 443, enter 443. Don’t change the port to this value just because you enabled TLS.
4. UUID: Preserve the credential exactly as provided. Check for accidental spaces or line breaks when copying it. If you edit, truncate, or regenerate it, authentication with the original server will usually fail.
5. Additional parameters: If the interface shows settings such as VMess encryption options or VLESS Flow, configure them as required by the server. Don’t reuse values from another entry.

UUIDs are commonly written as hexadecimal strings with hyphens. The example below shows only the format; it is not a usable credential and is not associated with any service. Even if two entries have the same UUID, their ports, transport, and security settings may differ, so don’t check this field alone.

00000000-0000-0000-0000-000000000000

3. Distinguish protocol, transport, and TLS—don’t guess from the port

A connection can use VLESS, WebSocket, and TLS at the same time: VLESS handles the proxy protocol, WebSocket provides the transport, and TLS encrypts and authenticates the relevant connection. These terms are not interchangeable. Switching WebSocket to TCP or turning off TLS may prevent the client and server from completing the same handshake.

When TLS is enabled, also check the SNI or corresponding server-name field in the interface. Address may be an entry-point IP while the certificate is issued to a domain name; don’t simply copy the IP into the name field. With WebSocket, Host and Path are separate settings: Host is used for request routing, while Path specifies the request path. Don’t put them in the SNI field just because they look like a domain or address.

• TLS: Match the server’s required toggle and verification settings exactly. If you see a certificate error, first check the name, certificate validity, and device time.
• SNI: Enter the name provided by your provider. Don’t infer it from the entry name or replace it with the domain of the website you’re visiting.
• Host: If the transport configuration requires this field, preserve its original value. It may match SNI, but the two serve different purposes.
• Path: Preserve the value exactly, including the leading /, following characters, and any query string.

4. If a subscription includes both types, keep the imported settings

Get the subscription link from your provider. After import, Shadowrocket creates entries based on the subscription contents. A subscription containing both VMess and VLESS does not need to be converted to one type. The entry name is just a label; check Type in the edit screen to confirm the actual protocol.

1. In Home, use the add option, choose Subscribe, paste the complete subscription link, and save. Don’t mistake a single node’s share link for a subscription URL.
2. Update the subscription and confirm that entries appear in the list. Then open one VMess entry and one VLESS entry to check their types and key fields.
3. Test the parameters as imported first. If you need to make changes, record the original values or keep a restorable copy, and avoid changing multiple fields at once.
4. A later update may overwrite entries managed by the subscription. If you need a lasting change, confirm the source parameters with your provider instead of repeatedly overwriting the updated entries.

Manual entry is best when you have the complete parameters and need to check them individually. If you only have Address and UUID but lack transport or TLS settings, get the missing information first. Don’t assume a particular security setup just because the protocol is VLESS, or choose a VMess encryption option at random.

5. Check Global Routing, then troubleshoot one variable at a time

Node parameters and routing mode are separate. Even if an entry is configured correctly, you can’t judge whether it works from a webpage if traffic isn’t routed through it. Global Routing in Home controls how traffic is handled; configuration files managed in Config provide rules and other settings.

If you’re using Scene, check the routing and policy actually applied by that scene; Scene is not another proxy protocol. Rules such as DOMAIN-SUFFIX, GEOIP, IP-CIDR, and FINAL in Config affect where requests go, but they don’t convert VMess to VLESS or fix an incorrect UUID.

1. First confirm that the device has a working network connection, then select the entry to test in Home. If you use a policy group, confirm which entry the group has actually selected.
2. Note the current Global Routing mode, then temporarily use Proxy to test the same destination. Check whether the issue is a connection timeout, a TLS error, or a failure to access the destination after connecting.
3. Change one setting at a time and retry: check Address and Port first, then UUID, followed by transport, TLS, and name fields.
4. If you’re troubleshooting automatic reconnection after disconnects, check the relevant conditions under Settings → On Demand. This helps distinguish On Demand behavior from a protocol-switching issue.
5. When testing is complete, restore the original routing mode and On Demand settings, and keep notes that make the issue reproducible.

6. FAQs: matching UUIDs, TLS errors, and failed protocol switches

The definitive way to tell whether either entry is configured correctly is to verify that its complete parameters match the server—not to compare which protocol is newer or has fewer fields. Keep the imported subscription settings, then check credentials, transport, and TLS one by one. This is usually more effective than repeatedly switching Type.