What VLESS Is: A Protocol That Leaves Encryption to TLS or REALITY

Each VLESS connection starts with a short header that carries your identifier and the destination address. The protocol itself does not encrypt or disguise anything. That work belongs to the layer below it, TLS or REALITY. For this reason, VLESS is rarely discussed without one of the two. This article covers the header, the changes from VMess, the transports and REALITY. It also lists what a VLESS key contains and explains how Ben's VPN uses the protocol.

A VLESS header holds a UUID, a command and an address

VLESS is a protocol for connections between a client and a proxy server. Each connection opens with a request header, and your data follows right after it. The request header consists of the following fields.

• Version of the protocol.
• UUID, your identifier on the server, such as 8b71f62c-7736-4334-ab2f-032d2115d2fd. It also works as the password, because the server accepts only UUIDs from its list.
• Add-ons, extra settings such as the flow mode covered below.
• Command, which requests a TCP stream, UDP packets or several streams in one connection (Mux).
• Destination port and address, where the address can be IPv4, IPv6 or a domain name.

VLESS adds nothing to the data after the header. The server replies with an even shorter header, which holds only the version and the add-ons. The request header has no timestamp and no cipher field, and VLESS does not encrypt the header itself. This is the main difference between VLESS and VMess.

The first version of VLESS shipped with V2Ray in the summer of 2020. Since late that year, most of its development has happened in Xray-core, a fork of V2Ray. Other cores, such as sing-box, support it too. Strictly speaking, VLESS itself is a proxy protocol. You get a VPN for a phone or computer when an app routes all device traffic through VLESS. Our article on how a VPN differs from a proxy compares the two in detail.

VLESS drops the cipher and the clock check of VMess

VMess, the older protocol from V2Ray, encrypts data with its own cipher, ChaCha20-Poly1305 or AES-128-GCM. To authenticate a connection, it checks both the UUID and the current time. The Xray documentation says the client and server clocks must stay within 2 minutes of the correct time. Of these 2 checks, VLESS kept only the UUID check. In a standard setup, VLESS does not encrypt anything. The decryption field on the server and the encryption field on the client are both set to none. The clock has no effect on a VLESS connection.

The table shows the difference in 3 situations. In the first 2, both protocols run inside TLS.

Situation	VMess	VLESS
Your phone clock runs 5 minutes fast	The server rejects the connection	The server accepts the connection
You open an HTTPS site through the tunnel	3 layers of encryption (site, VMess and outer TLS)	2 layers of encryption (site and outer TLS)
The connection has no outer TLS	VMess still encrypts the data with its own cipher	Any observer on the route sees the UUID and destination addresses

Inside TLS, the VMess cipher only adds processor load and battery drain, and VLESS has no such cost. With the flow mode on, the outer TLS stops re-encrypting the data after the handshake with the site. In 2025, Xray gave VLESS an optional built-in cipher, VLESS Encryption. It is meant for setups without outer TLS. It also fits setups where TLS ends before the server, for example at a CDN. A REALITY setup does not need VLESS Encryption.

The transport determines how VLESS traffic looks

VLESS travels inside a transport, and an observer on the network sees that transport. Xray has several transports for VLESS, and the 4 main ones are listed below.

• RAW, called tcp in older configurations. It is a plain TCP connection. With TLS or REALITY on top, it looks like ordinary HTTPS traffic.
• XHTTP, formerly SplitHTTP. It spreads the stream across ordinary HTTP requests and responses over HTTP/1.1, HTTP/2 or HTTP/3. XHTTP also works through a CDN. To an observer, it resembles a web app that keeps sending requests to its server.
• gRPC. Traffic moves as remote procedure calls over HTTP/2, the way many apps exchange data with APIs.
• WebSocket. A long-lived connection of the kind that web chats and browser games use. It also works through a CDN.

REALITY works with RAW, XHTTP and gRPC but not with WebSocket.

A REALITY server needs no domain or certificate

Regular TLS requires the server to have a domain name and a matching certificate. REALITY, introduced in Xray-core 1.8.0 in spring 2023, needs neither. During the handshake, the server uses the identity of a real third-party site, the target site. The steps below show how the server handles 2 kinds of connections.

1. Your client starts a TLS handshake the way a popular browser would. Its first message, the ClientHello, names the target site. The ClientHello also carries a mark that only the holder of the server private key can check. Part of the mark is a short ID called shortId.
2. The server checks the mark. If the mark is valid, the server completes the handshake itself and VLESS data follows.
3. A scanner or any other visitor sends an ordinary ClientHello without a mark. The server does not answer it directly. Instead, the server forwards the connection to the target site, which answers with its real certificate and page.

The target site has to support TLS 1.3 and HTTP/2. REALITY relies on a pair of X25519 keys. The private key stays on the server, and the client gets the public one.

A VLESS key contains every connection setting

A VLESS key from a service or a server administrator is one long string. It holds everything a client needs to connect.

• The server address and port.
• Your UUID, which works as the password.
• The transport and the security layer, TLS or REALITY.
• The site name the client sends in the handshake (SNI).
• For REALITY, the public key of the server and the shortId.
• The browser fingerprint the client imitates in its ClientHello.
• The flow mode, usually xtls-rprx-vision. With another TLS connection inside the tunnel, it hides the typical packet sizes of that handshake. After the handshake, it does not re-encrypt what the site has already encrypted.
• A name, so you can spot the key in a list.

You can also run such a server yourself on a rented VPS. Then the setup and the core updates are your responsibility. If the old address is blocked, you also have to move the server to a new one. For more on renting a server versus paying for a VPN, see our comparison of VPS and VPN.

The server address stays visible to your internet provider

VLESS with REALITY hides what travels over the connection, not which server is on the other end. Your internet provider can still see the connection to that server. The provider sees the server address, when the connection is active and how many bytes go each way. If that address is blocked, no protocol setting can restore the connection. You then need a server at a different address.

Some networks allow traffic only to a list of approved addresses. A server outside that list stays unreachable, however well the protocol is disguised. On networks like that, the traffic has to take a different route.

The Ben's VPN app picks the protocol and needs no key

The Ben's VPN app has 4 ways to connect (VLESS + REALITY, XHTTP, Hysteria2 and Shadowsocks). It picks among them automatically, and you cannot pin one in the settings. For a side-by-side look at all 4, see our guide to VPN protocols.

The app does not accept VLESS keys, whether they come from another service or from your own server. It does not need them either, so you never enter a UUID or a key. On a phone, tablet or computer, install the app and tap Connect. Then pay for a subscription in the Buy Ben's VPN window. If you already have a subscription, sign in from the same window. Downloads for every platform are on our apps page.

On a poor connection, the app may show a Bad connection banner with a Fix the problem button. The button offers 2 options, switching locations or searching for a working server. The search is also available as Find working server under Account → Settings. It rechecks the server and gives it new IP addresses. If nothing else helps, the search enables multihop. The search takes no more than 2 minutes.

Questions and answers

Do I need my own domain to run VLESS?

With REALITY, you do not need a domain. The server uses the identity of a third-party target site, so it needs no certificate of its own. You need a domain and a certificate if VLESS runs inside regular TLS or behind a CDN.

Why put a VLESS server on port 443?

Port 443 is the standard one for HTTPS. A TLS or REALITY connection on this port looks like ordinary web browsing. On an unusual port, the same connection would differ from most other traffic. The VLESS protocol itself works on any port.

How does VLESS compare with Hysteria2?

VLESS usually travels over TCP inside TLS or REALITY. Hysteria2 is built on QUIC, so it runs over UDP. From the outside, Hysteria2 traffic looks like HTTP/3. For this reason, different network limits affect the 2 protocols. A network that blocks or throttles UDP affects Hysteria2 but not VLESS over TCP. Ben's VPN has both, and the app picks between them.

Does REALITY hide the server’s IP address?

No, REALITY disguises the handshake but not the server address. An observer on the network can see which server your device connects to. Once that address is blocked, you need a server at a new one.

Can I add my own VLESS key to Ben's VPN?

No, VLESS keys from other services or from your own server do not work in the app. It connects to Ben's VPN servers and picks the protocol for you.