VMess and VLESS are different protocols, not two speed settings for the same server. Both commonly use a UUID to identify a user, but their encryption mechanisms and server configurations differ. This guide is for users who already have connection details from their provider and are ready to enter them manually in Shadowrocket’s Add Server screen or verify an imported server. First, distinguish the protocol, transport and TLS layers; then check each field and test under consistent conditions to avoid mistaking a configuration error for a protocol performance issue.
1. Key Differences Between VMess and VLESS
The protocol type must match the server. A VMess server won’t connect if you change the client Type to VLESS, and vice versa. Even with the same address, port and UUID, the different handshake formats will cause the connection to fail. Get existing subscriptions from your provider. For manual setup, use the same complete set of connection details.
| Field to check | VMess | VLESS |
|---|---|---|
| User identifier | Typically a UUID that must match the user configured on the server | Typically a UUID that must match the user configured on the server |
| Protocol-level encryption | Includes protocol-level authentication and data encryption; the details depend on the selected encryption method | The base protocol does not provide data encryption; assess security together with the outer secure transport |
| Transport | Use TCP, WebSocket or another transport supported by the server configuration | Use TCP, WebSocket or another transport supported by the server configuration |
| TLS | A separate setting from the protocol’s encryption options | Often provides outer transport protection; using a UUID does not make it optional |
| Changing the protocol type | Requires matching server support; changing only the client Type is not enough | |
“VLESS is lighter” describes a design trade-off, not a guarantee of faster speeds on every network. Actual performance also depends on server load, network congestion, transport and your local connection. A speed test comparing two servers at different addresses can’t establish that VMess or VLESS is generally better.
2. What UUIDs, Encryption and TLS Each Do
A UUID identifies a user; it is not a server address or a TLS certificate. It is usually written as a hexadecimal string separated by hyphens. Copy it in full, without adding spaces or line breaks. Whether the same UUID can be used with different protocols depends on how the server is configured—not on the UUID’s format.
VMess encryption options and the TLS toggle belong to different layers. VMess can use methods such as AES-128-GCM and ChaCha20-Poly1305 within the protocol; follow the server details and the options available in the app. Enabling TLS does not mean you can change VMess encryption settings arbitrarily.
Check in this order: confirm secure transport, then test connectivity
If your VLESS configuration has TLS disabled, ask your provider whether a specific outer secure transport is configured. Don’t treat a populated UUID or port 443 as proof that the connection is encrypted.
TLS also verifies the server’s identity. The connection address can be an IP, while the Server Name used for certificate verification is a domain; they don’t have to match. Don’t bypass certificate checks just to clear an error. First verify the Server Name, certificate domain and device date and time. VMess authentication also depends on accurate time. If your device clock is significantly off, enable automatic time before trying again.
3. Enter Each Field in Home → Add Server
Open Add Server from Home, choose the Type, then enter the address and authentication details. Available fields vary by protocol and transport; don’t force a value into an unrelated field just because the expected one isn’t shown. The layout may change between app versions, so focus on matching each field’s meaning to the server requirements rather than copying the position from an old screenshot.
- Type: Choose VMess or VLESS as specified by your provider. After importing a server, check its type too—don’t rely on its display name.
- Address and Port: Enter only the hostname or IP used to connect in Address, not the full share link. Use the port supplied by your provider; if the details specify 8443, don’t change it to 443 just because TLS is enabled.
- UUID: Copy the complete user identifier. If the VMess details include an Alter ID, enter it as specified. Modern VMess AEAD configurations typically use 0; VLESS does not use the VMess Alter ID mechanism.
- VMess encryption: Select the method specified by your provider. Keep protocol encryption separate from TLS and WebSocket settings.
- Transport: Choose TCP, WebSocket or another method according to the details provided. For WebSocket, also check Host and Path; the leading slash in Path is part of the value.
- TLS and Server Name: Check whether TLS is enabled, which domain to verify and whether there are any additional requirements. If the configuration includes extended parameters such as Flow, make sure they’re supported by the selected setup and entered correctly.
4. TCP and WebSocket: Check Transport Settings Separately
VMess and VLESS are proxy protocols; TCP and WebSocket are transport methods; TLS provides part of the secure transport. For example, “VLESS + WebSocket + TLS” describes a combination, not three interchangeable protocol options. If the server uses WebSocket, entering the correct UUID and TLS settings alone won’t be enough to connect.
What to check in two common transport setups
TCP + TLS
- Check Address, Port and UUID.
- Make sure the selected transport matches the server.
- Check the TLS Server Name and certificate verification.
- Confirm support for each additional parameter specified by your provider.
WebSocket + TLS
- First verify the address, port, UUID and TLS.
- Then check the WebSocket Host character by character.
- Preserve the Path’s capitalization, slashes and any required query parameters.
- Understand the different roles of the connection address, Host and Server Name.
Don’t assume Address, Host and Server Name are the same. They’re used for the connection target, the WebSocket request and TLS identity verification, respectively.
For example, the connection address might be edge.example.com, the WebSocket Host ws.example.com and the Server Name tls.example.com. These fields can differ in a particular deployment; check the actual configuration. Replacing all three with the connection IP could cause TLS verification to fail or prevent the request from reaching the right service.
5. Test the Connection: Rule Out Global Routing First
After saving the server, select it on Home and check Global Routing. This setting controls how traffic is routed; it doesn’t convert VMess to VLESS. Config applies your configuration’s rules. Proxy sends traffic covered by proxy handling through the proxy, while Direct connects without a proxy. Scene follows the configured scene; its name alone doesn’t tell you which route is actually being used.
Config: Restore your regular rules
RecommendedOnce you’ve verified the server on its own, use Config to check which rules are actually matched. Rules can specify PROXY, DIRECT or REJECT, so don’t assume every request uses the selected server.
Best for: everyday use with an existing configuration and checking traffic routing
Proxy: Temporarily isolate rule-related issues
For testing, temporarily select Proxy and keep the same server and test destination to reduce interference from rules routing traffic directly. Restore your original Global Routing setting when you’re done.
Best for: identifying whether the issue is with the server connection or traffic routing
Direct: Check your local network baseline
Use this to see whether your local network can directly reach a destination that is normally accessible without a proxy. A webpage loading in Direct mode doesn’t prove that a VMess or VLESS server is working.
Best for: ruling out Wi-Fi, cellular and local connection issues
Change only one variable at a time. Keep the network, server and destination fixed; note whether the request times out, shows a TLS error or fails only on specific sites, then try again on a different local network. An open port or a latency reading only shows that the specific test received a response; it doesn’t confirm proxy authentication, the transport path or the full request.
- Immediate TLS error: Check the Server Name, device time and certificate verification first—not the UUID.
- WebSocket handshake returns an HTTP status such as 404: Check Host, Path and the server’s forwarding path first. The status alone doesn’t confirm that the UUID is correct.
- Long timeout: Check Address, Port and network reachability first, then verify transport and authentication. A timeout doesn’t point to any one field on its own.
- Proxy works, but some destinations fail under Config: Check the rule order and matching behavior in Config rather than immediately switching protocols.
6. Imports, Updates and Common Setup Issues
If you already have a subscription, add it using your provider’s import method, then check the imported Type, transport and TLS settings. Subscription updates may overwrite server parameters, so keep the original details before making manual changes. If something breaks after an update, first compare the address, port and transport settings. Avoid changing several fields at once and then trying to remember their original values.
Why won’t it connect even though I have a UUID?
A UUID only covers one part of user identification. Open the server’s edit screen from Home → Add Server and check Type, Address, Port, UUID, transport and TLS in order. In particular, don’t miss the WebSocket Host or Path, or the TLS Server Name.
Will switching from VMess to VLESS make it faster?
You can’t switch protocols by simply changing the setting. Get the complete VLESS details from your provider and save them as a separate server entry. Test results are meaningful only when the server, route and test conditions are comparable; differences between routes can’t be attributed to the protocol name.
What should I do if a subscription update removed my custom Path?
First check whether the subscription sent a new value, then confirm the latest value with your provider. If you need to test a change temporarily, save it as a separate manual entry instead of treating a subscription-managed entry as a permanent manual configuration. Don’t keep restoring an old Path without confirming it’s still correct.
Can enabling On Demand fix a protocol error?
No. Settings → On Demand manages the conditions for connecting on demand; it doesn’t correct UUID, TLS or transport settings. First verify that a manual connection works, then check On Demand. Keep the trigger conditions consistent during testing so changes in automatic connection behavior don’t affect the results.
The final check comes down to this: match the protocol type to the server, verify each transport and TLS setting, then confirm that requests follow the intended routing policy. If the problem persists, give your provider the relevant field details with credentials hidden, along with your network type and the error you’re seeing. That’s more useful for troubleshooting than simply saying “VMess is slow” or “VLESS won’t connect.” For more setup steps, see Server Management and the Global Routing guide.