VMess vs. VLESS: Key Differences for Shadowrocket Setup

Start here: The protocol must match the server

When choosing VMess or VLESS in Shadowrocket, follow the protocol specified in your existing connection details—not the one with the newer name. If the server accepts VMess, use the matching VMess settings; if it accepts VLESS, use the matching VLESS settings. Even when the address, port, and UUID look the same, changing Type can cause authentication or handshake failures.

Protocol selection and traffic routing are separate. The server selected in Home determines the parameters used for the proxy connection; Global Routing determines how requests are routed. Config is where you manage configuration files and rules, while Settings contains app preferences. When troubleshooting a protocol, avoid changing rules, switching servers, and modifying TLS at the same time, or it will be difficult to identify what caused the result.

Encryption differences: VMess encryption vs. VLESS with external protection

VMess defines its own authentication and data encryption mechanisms. Common VMess AEAD configurations use the corresponding authentication design, and the data encryption method must also match what the server supports. TLS can be added to VMess as well: protocol-level encryption and TLS protection operate at different layers, so one setting cannot replace the other.

VLESS does not encrypt payloads itself and typically relies on an outer layer such as TLS to protect traffic. So if your connection details show none for VLESS encryption, that alone does not mean the entire connection is unencrypted. Nor does selecting VLESS enable TLS automatically. Check the required outer protection in your connection details and make sure the client is configured accordingly.

Allow Insecure affects TLS certificate verification. It is not a speed setting and cannot fix an incorrect UUID or transport path. If you encounter a certificate error, check the device’s date and time, the server certificate, and the domain used for TLS. Do not skip verification instead of addressing these issues. Which fields appear depends on the selected type and transport settings.

UUIDs: Same format does not mean the same credentials work everywhere

A UUID is an identity parameter, not a server address or subscription URL. The standard text format typically consists of hexadecimal characters and hyphens, for example 123e4567-e89b-42d3-a456-426614174000. This is only an example of the format and cannot be used to connect. When pasting an actual UUID, check for extra spaces, line breaks, quotation marks, or an entire share link entered by mistake.

Both protocols use UUIDs, but that does not mean the same UUID will work on every server. The server must be configured for the corresponding user and inbound protocol. If your subscription contains two entries with similar addresses but different types, keep each entry’s full set of parameters intact. Don’t combine the UUID from one entry with the port from another and the transport settings from a third.

1. In Home, find the entry you want to check and open its edit screen. First confirm whether Type is VMess or VLESS.
2. Check the address and Port against your connection details. Enter only the specified hostname or IP in the address field—do not add a protocol prefix or path.
3. Check the entire UUID, not just its beginning and end. Do not share an actual UUID when troubleshooting with others.
4. If your VMess details include AlterId, enter it as specified. Common VMess AEAD configurations use 0, but don’t change other fields based on assumptions.
5. Make sure the device’s date and time are correct. VMess authentication involves time, so a significantly incorrect system clock may affect the connection.

Transport settings: TLS, WebSocket, and Host each serve a different purpose

VMess and VLESS are proxy protocols. TCP and WebSocket describe transport methods, while TLS provides an outer secure channel. These settings work together, but they are not interchangeable. If your details specify WebSocket, entering only Type and UUID is not enough—you also need to check Path, Host, and the TLS requirements.

Here’s a hypothetical configuration: if your connection details specify port 443, WebSocket path /connect, and TLS enabled, keep those settings together. Port 443 is commonly used for HTTPS, but that does not mean you can skip checking TLS. And seeing WebSocket does not mean you should change the port to 80. Both are just port numbers; the server determines how each is used.

Other transport methods, such as gRPC, also require server support and have their own additional parameters. A WebSocket Path is not a universal path for every transport. If your connection details are incomplete, ask your configuration provider for the missing fields instead of repeatedly guessing. Check any advanced options against the complete configuration too; “VLESS + TLS” does not cover every deployment detail.

Import or enter manually: Keep the full configuration intact

An existing subscription can include multiple entries and their parameters, reducing manual copying. After importing, check each entry’s type and key settings in Home; don’t identify the protocol by its display name alone. Names can include descriptive text, but connection behavior depends on the parameters inside the entry. Updating a subscription retrieves its contents again, so local changes to subscription entries may be overwritten by a later update.

To compare behavior before and after a change, keep the original parameters, make one change at a time in a separate entry, and note what you changed. Troubleshoot subscription update failures separately from authentication failures for a VMess or VLESS entry. The former involves retrieving subscription contents; the latter involves using existing parameters to establish a proxy connection. They may have different causes.

• Expected entry missing after import: Check that the subscription was retrieved successfully and that its response included the entry.
• Parameters changed after an update: Compare them with the latest subscription contents instead of relying on an old screenshot.
• Only the manually edited entry fails: Restore and test the original entry first, then check the specific change.

Troubleshooting connections: Separate authentication, transport, and routing

A latency test returning a number does not mean websites will work. Port reachability, protocol authentication, TLS, DNS, and whether a request matches the expected policy are separate checks. Test with the same device, network, and destination request. Without controlling these conditions, a single speed result cannot tell you which protocol is inherently faster.

In Global Routing, Proxy, Direct, Config, and Scene describe routing modes; they do not convert protocols. Config processes requests using the active configuration. Direct is not suitable for checking whether a proxy entry works, and Scene requires checking the relevant scene settings. To rule out routing as a factor, temporarily use Proxy to test the selected proxy connection, then restore the previous mode. Check the in-app request logs as well to confirm the route actually used.

In practice, first get one entry that exactly matches the server working, then restore your usual rules. The protocol name alone says nothing about connection quality, server load, or performance on a particular network. VLESS has fewer encryption responsibilities at the protocol level, but that does not mean it will always be faster than VMess. For most users, keeping the full configuration and checking each layer is more useful than choosing by protocol name alone.

• View the protocol glossary →
• Read the Config reference →
• Read the DNS settings guide →