VMess vs. VLESS: What to Know Before Adding a Server in Shadowrocket

At a glance

This guide is for users who already have server settings or a subscription and want to import them into Shadowrocket. Learn how authentication, transport, and TLS differ, then check the corresponding fields in Add Server. You’ll see which settings must be entered as provided, why you can’t simply switch protocols, and what to check first when a connection fails. This site does not provide, sell, or recommend servers or subscription services.

1. VMess and VLESS: Authentication, Encryption, and Transport

VMess and VLESS are both used for proxy communication between a client and a server, but they are not simply two speed settings for the same protocol. VMess supports encryption at the protocol layer, and common configurations include an alterId field. VLESS simplifies the protocol itself and does not provide the same built-in data encryption; deployments typically use TLS or another secure transport to protect the connection. The client must use the protocol enabled on the server.

Setting	VMess	VLESS
Credentials	Usually a UUID, which must match the server configuration.	Usually a UUID. The same format does not mean it can be reused across protocols.
Built-in protocol encryption	Supports encryption at the protocol layer; enter the method specified in the existing configuration.	Does not provide built-in data encryption; check the security mechanism used by the outer transport.
alterId	A legacy compatibility setting; typically 0 with VMess AEAD configurations.	No corresponding alterId setting; don’t copy it from a VMess entry.
Transport settings	May use TCP, WebSocket, or another transport, depending on the server setup.	Must also match the transport and related settings used by the server.
TLS	Can be used together with protocol-layer encryption.	Often used to secure the outer connection, but the protocol name alone does not confirm that it is enabled.

It helps to think of the settings in three layers: credentials such as a UUID identify the user, TCP or WebSocket carries the data, and TLS encrypts the connection and verifies the server’s identity. WebSocket is not encryption by itself, and VLESS does not mean TLS is automatically enabled. Conversely, VMess protocol-layer encryption and outer TLS can both be used; they are not mutually exclusive.

Bottom line: Match the existing configuration before choosing a protocol

Open the details for the existing entry and check its protocol, UUID, transport, and TLS settings. Don’t change a VMess entry to VLESS to try to improve speed. Unless the server also provides a matching VLESS configuration, authentication and the handshake will usually fail.

2. Add Server: Check Each Field, Don’t Guess from the Protocol Name

To add a server manually, go to the add option from Home, open Add Server, choose the protocol, then enter the server address, port, and credentials. Field layouts may vary by platform, but the relationship between these settings remains the same. The ports and paths below illustrate field meanings only; they are not working server settings.

443

Example of a commonly used TLS port; use the port in your existing configuration

A commonly used alterId value in VMess AEAD configurations

/ws

Example WebSocket Path; match the exact capitalization and full path

Check the server address and port. Enter the domain or IP from your existing settings in the address field, and enter the port separately. Don’t paste a full share link into the server address field, or automatically change the port to 443 just because TLS is enabled.
Check the UUID. Copy the entire string without omitting hyphens or adding spaces. The display name is just a label; matching names do not mean the credentials match.
Check the VMess encryption method and alterId. Enter the values from the original configuration. alterId is not a network latency setting, and increasing it won’t make the connection faster. If an older configuration uses a different value, confirm what the server requires rather than applying a one-size-fits-all value.
Check the transport. If you select WebSocket, also check Host and Path. For other transports, enter the corresponding settings. Changing the transport option alone, without changing the server configuration, does not convert the protocol.
Check TLS and Server Name. Server Name is used for the server name indication in the TLS handshake and related certificate verification. It may differ from the connection address. Don’t replace the original domain with the server’s IP address.
Check additional settings. If an existing VLESS configuration includes fields such as flow, confirm that the current client supports them and keep their values as provided. They are not universal options that every VLESS entry needs.

Suppose the existing settings specify an IP as the connection address and a domain as the TLS Server Name. This is not necessarily an error: the former determines where to connect, while the latter is used in the TLS handshake. WebSocket Host belongs to the HTTP layer; don’t swap these values just because they all look like domain names. If you see a certificate error, first check the name, certificate validity period, and device date and time rather than disabling verification.

3. Share Links and Subscribe: Choose the Right Import Method

A share link usually describes one server entry, while a subscription URL retrieves and updates a set of entries. VMess share links commonly start with vmess://, and VLESS share links with vless://. Don’t manually change the prefix: the encoding, field meanings, and server requirements may differ too. Treat share links containing a UUID and subscription URLs containing a token as credentials.

Import options: Distinguish a single entry from a subscription URL

You have a single share link

Use Shadowrocket’s link import option, then return to Home to find the entry.
Open the entry details and check the protocol, address, port, TLS, and transport settings.
If the settings change, import the updated link or edit the existing entry as instructed.

You have a Subscribe URL

During the add process, select Subscribe, enter your existing subscription URL, and save it.
Update the subscription, wait for the server list to appear on Home, then select an entry.
When settings change, update the subscription first. Manual edits may be overwritten during the next update.

A failed subscription import and a failed server connection are problems at different stages. First confirm that the list was retrieved successfully, then check the connection for the selected entry.

This example URL illustrates the format only: https://example.com/sub?token=xxxx. It does not provide a working service. Paste the real URL in full, including the query parameters after the question mark. A missing token, expired subscription, or login page response can prevent the list from being parsed. A successful subscription update only confirms that the list was retrieved; it does not mean every server is available.

4. Global Routing: Separate Connection Issues from Rule Issues

After importing, select an entry on Home and connect, then check Global Routing. The protocol determines how to connect to the proxy server; Global Routing determines which traffic uses that connection. If the current mode is Direct, a webpage loading does not prove that VMess or VLESS is working. Likewise, if a target matches DIRECT in Config, it can’t be used to test the proxy server.

Config: Match Rules in the Current Configuration

Recommended

Rules in the current Config are checked in order, and the matching policy is applied. Connections that match none of the earlier rules are handled by FINAL, not automatically sent direct.

Best for: everyday use and routing by domain or IP

Proxy: Temporarily Bypass Rule-Based Routing

Routes traffic handled by Shadowrocket through the proxy, making it easier to tell whether an issue comes from a Config rule or policy selection.

Best for: briefly testing the selected server; restore your usual settings when you’re done

Direct: Compare with a Direct Connection

Connects traffic handled by Shadowrocket directly to the destination without going through the proxy server, so it can’t verify whether proxy authentication succeeded.

Best for: comparing how a destination performs over your current network without a proxy

The following is a rule syntax example, not a complete Config file. Before using it, confirm that your configuration includes a policy named PROXY and understand that rules are matched from top to bottom. DOMAIN-SUFFIX matches domain suffixes, GEOIP uses an IP geolocation database, IP-CIDR matches IP ranges, and FINAL handles connections that didn’t match earlier rules.

DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
GEOIP,CN,DIRECT
FINAL,PROXY

If the same entry reaches a destination in Proxy mode but fails in Config mode, check which rule matched in Config and where its policy points instead of immediately switching protocols. Scene in Global Routing selects a scenario; it is not a fourth proxy protocol. For troubleshooting, keep one mode and the same entry selected to avoid differences caused by switching scenes.

5. Connection Failures: Troubleshoot Step by Step Based on What You See

Change one setting at a time and keep the original entry so you can restore it. Note whether the failure occurs during subscription update, connection setup, or access to a specific destination; this is more useful than simply noting that something won’t open. A reachable port does not prove authentication succeeded, and a successful latency test does not guarantee that every app request will work.

I changed VMess to VLESS and now it won’t connect. What’s wrong?

First restore the original entry’s VMess type and settings. Only add a VLESS entry if the server provides a matching VLESS configuration, and enter its UUID, transport, and TLS settings. Don’t keep changing the protocol on the old entry.

The port is reachable, but the TLS handshake fails. What should I do?

Open the entry details and compare TLS, Server Name, and port with the original settings, then check the device’s date and time. If the connection address is an IP, be sure to keep the original Server Name. Verify any certificate mismatch against the configuration; disabling certificate verification is not a routine fix.

My WebSocket entry keeps failing. Should I change the Path?

First confirm that the transport is set to WebSocket, then compare Host and Path character by character, including the leading slash, capitalization, and query parameters. An incorrect path may return HTTP 404, and a rejected handshake may be caused by reverse proxy settings. Don’t assume every failure is caused by the UUID.

Why does the connection turn back on after I switch it off?

Check whether On Demand is enabled under Settings → On Demand and review its conditions. For troubleshooting, temporarily disable On Demand, keep the connection switch in a known state, and test again. Restore your original settings when finished. On Demand triggers connections based on conditions; it does not convert VMess to VLESS.

Is VLESS always faster than VMess?

You can’t tell from the protocol name alone. If you already have working configurations for both, test them on the same network, against the same destination, and at similar times. Record the transport, whether TLS is enabled, and any failure symptoms. Server load, packet loss, and network routing can all affect the results.

After comparing, restore Global Routing to Config for everyday use and confirm that the selected server hasn’t changed after a subscription update. If the issue persists, give the maintainer of your existing service the failure stage, transport type, and redacted logs. Don’t include UUIDs, subscription tokens, or complete share links in public screenshots. For basic Home, Config, and connection switch instructions, see the other guides on this site.