At a glance

VMess and VLESS are proxy protocols, not client apps. Start with the one-minute comparison, then check the settings you need: VMess has its own encryption and uses time-based authentication; common VLESS setups rely on TLS or REALITY to protect the connection. Keep the full set of settings provided in your subscription—don’t just switch the protocol dropdown from VMess to VLESS. The sections below cover encryption, time checks, transports, importing, and troubleshooting.

The One-Minute Comparison: Protocol, Transport, and Connection Security

Node editor → “Protocol,” “Transport,” and “TLS”: check these separately. VMess and VLESS define the proxy communication format and authentication; TCP and WebSocket carry the data; TLS or REALITY provide a separate layer of connection security. A long string of subscription parameters describes how these layers fit together.

What to check VMess VLESS
Credentials Usually a UUID; also check authentication-related fields Usually a UUID; some combinations also require fields such as flow
Protocol-level encryption Can encrypt data at the protocol level; the exact behavior depends on the security setting Commonly uses encryption=none, with connection security handled by an outer layer
Time requirements Authentication has a time window, so the client and server need accurate clocks No VMess-style time-based authentication, but certificates and other settings can still depend on the date
Common combinations VMess + WebSocket + TLS VLESS + WebSocket + TLS, or VLESS + TCP + REALITY
Can they be swapped directly? No. The server protocol, credentials, transport, and security settings must all match.

Bottom line: Check the full configuration before comparing protocol names

If a connection fails after import, compare the port, transport, and TLS/REALITY settings with the provider’s instructions, one by one. Matching protocol names confirm only one setting—not that the configuration is complete.

Encryption: VLESS with none doesn’t mean an unencrypted connection

Node editor → “Encryption”: first check which layer this setting applies to. VMess security and VLESS encryption are not TLS toggles. In a common VLESS link, encryption=none means VLESS itself doesn’t encrypt the data; it does not mean that outer-layer TLS is disabled.

Port 443 alone doesn’t prove that TLS is enabled. A port is just the service’s entry point; the actual behavior depends on both sides’ settings. TLS can also use other ports, so don’t change every subscription port to 443.

Time Checks: Sync Your Clock First if VMess Won’t Connect

Windows: Settings → Time & language → Date & time → Sync now. Android: Settings → System → Date & time → turn on automatic time. Menu names vary by manufacturer; search your system settings for “Date & time.” Make sure your device clock is accurate, then reconnect.

VMess authentication depends on a time window. Clock drift after sleep, a manually changed date, or an inaccurate server clock can all cause authentication to fail. Logs may not explicitly say “time error,” so syncing the clock is an easy first check when all your nodes suddenly stop working.

  1. Make sure automatic time is enabled, then sync over the network. Changing only the displayed time zone may not correct the system clock.
  2. Reconnect to the same node and check the logs. Don’t change the UUID, transport, and encryption settings all at once, or you won’t know what fixed the connection.
  3. If the same node works on other devices, check this device’s clock, network, and client settings first. If it fails on every device, ask your provider to check the server status.

VLESS doesn’t rely on VMess-style time-based authentication, but the system date still matters. TLS certificates have validity periods, and an incorrect date can make a certificate appear not yet valid or expired. Switching protocols won’t correct the system clock.

Transport Options: Understanding WebSocket, TLS, and REALITY

Node editor → “Transport” → the corresponding host name, path, or service name: these fields must match the server configuration. Both VMess and VLESS support multiple transports, but whether a combination works depends on the core the client actually uses, its version, and the server setup—not just the client’s name.

Subscription combination Fields to check Common mistakes
VMess / VLESS + WebSocket + TLS Port, WebSocket path, Host, TLS serverName Assuming Host and serverName must match and forcing them to be identical
VLESS + TCP + REALITY Server name, public key, short ID, and any flow required by the provider Leaving out the public key or copying a short ID from another node
gRPC configuration serviceName, TLS settings, and core compatibility Entering serviceName as a WebSocket path

For example, if your provider specifies the WebSocket path /proxy, keep it exactly as given. This is an example field value, not a path that works on every server. Domains and paths usually serve specific purposes, and some fields are case-sensitive. A successful import only means the link was parsed; it doesn’t confirm that the server accepts those values.

REALITY and Vision aren’t the same setting. REALITY is a connection security option; Vision is usually specified by a flow value such as xtls-rprx-vision, and is required only for certain combinations. Don’t add Vision to every VLESS node, or treat REALITY as a type of WebSocket path.

Importing a Subscription: Keep Its Settings and Choose a Compatible Core

In v2rayN, open “Subscription group” from the main window, add the subscription URL from your provider in the group settings, and update it. To import a single share link, use the clipboard import option under “Servers.” In v2rayNG, tap “+” → “Import from clipboard” on the main screen to import a single config; add subscriptions under “Subscription group settings” in the sidebar. Labels may vary slightly by version—look for the option that matches what you want to do.

Import Workflow: Check the Same Configuration on Each Device

Desktop: v2rayN
  • After importing, open the node editor and check that the protocol and transport are present.
  • For REALITY, confirm that the client is actually using a compatible Xray core.
  • After connecting, enable the system proxy and test it in a browser.
Android: v2rayNG
  • Import the same subscription and check that all node settings are present.
  • On the first connection, approve the system VPN permission and make sure the service starts.
  • If per-app proxying is enabled, make sure the browser you’re testing is included.

You can use the same subscription on different devices, but you need to update it on each one. Local edits, routing rules, and system permissions don’t sync automatically.

v2rayNG uses the Xray core; v2flyNG uses the v2fly core. Don’t assume they have identical features just because their names are similar. For REALITY or specific flow fields, check core compatibility. Recognizing VLESS doesn’t mean a client supports every VLESS combination.

Keep the complete configuration from your subscription

Recommended

Use a client and core explicitly supported by your provider, and keep the protocol, transport, security, and authentication settings intact. Start with a working baseline before changing local routing.

Best for: Using an existing subscription and importing it reliably for everyday connections

Configure the server manually

Enter the UUID, port, transport settings, and security options one by one. Change the protocol or test a new combination only if you know the server’s actual configuration.

Best for: Managing your own server or troubleshooting with your provider’s instructions

FAQ: Switching Protocols, Speed Tests, and Connection Checks

Can I change a VMess node directly to VLESS?

Not by changing the client’s protocol dropdown alone. Get a separate VLESS configuration from your provider, or set up the matching inbound on a server you manage, then import the corresponding settings. Even if the address, port, and UUID look the same, the server won’t switch protocols automatically.

Is VLESS always faster than VMess?

There’s no way to tell just from the protocol. Compare real-world access to the same destination over the same network and at the same time, then check sustained downloads and connection stability. Network congestion, server load, and transport settings can all affect performance. A single latency result from different servers doesn’t prove one protocol is better.

Why can’t I open websites even though the node shows a latency?

First check whether the test measures TCP reachability or an actual proxy request. An open TCP port doesn’t mean authentication succeeded. On desktop, check whether the system proxy is enabled; on Android, check the VPN service and per-app scope. Then look in the logs for authentication, handshake, or DNS errors.

What should I set alterId to for VMess?

Modern VMess AEAD configurations typically use alterId=0. If an older link has a non-zero value, don’t keep trying different numbers to fix it. Ask your provider to confirm the current server authentication method and provide a matching configuration. Values from old guides may not apply to a new subscription.

Finally, check “node connects” and “apps use the proxy” separately. First make sure the core reports no configuration errors, then confirm that the target app’s traffic is being routed through it. The protocol handles only part of the connection; system proxy settings, VPN permissions, DNS, and routing rules each determine how traffic reaches it.