VMess vs. VLESS: How to Choose the Right Type in Shadowrocket

The key takeaway: the same UUID doesn’t mean the same Type

VMess and VLESS are different protocols. VMess includes encryption settings as part of its protocol handling. VLESS does not provide the same protocol-layer encryption, so check the TLS and other security-layer settings against your existing configuration. This describes a difference at the protocol layer; it doesn’t mean you should enable TLS whenever you see VLESS, or ignore server-specified TLS settings for VMess. Both ends of the connection need compatible settings.

A UUID is generally used as an identifier; on its own, it doesn’t tell you whether a configuration is for VMess or VLESS. Even if two sets of details show the same UUID, they aren’t interchangeable server entries if their Type or transport settings differ. Check which protocol the details specify before filling in the other fields. That’s more reliable than trying each Type in turn.

Fields to check when adding a server manually

If you already have your own server details, choose the corresponding Type in Shadowrocket’s Add Server screen and enter the settings. Available fields vary by Type and transport options. Keep the original details handy and match each field carefully; don’t combine an Address from one configuration with a UUID from another. If you have a complete subscription link, it’s usually easier to import it with Subscribe, then review the imported entry to catch any missed fields.

1. Check Type: Select VMess if the details specify VMess, or VLESS if they specify VLESS. If you only have a UUID, first confirm which protocol it belongs to.
2. Check Address and Port: Enter the server domain name or address in Address, and the corresponding port number in Port. Neither VMess nor VLESS has a single standard port. Even if the port is a familiar one such as 443, check it against your details.
3. Check UUID: Enter the complete value exactly as provided, watching for spaces, line breaks, or lookalike characters introduced during copying. Use the UUID for this specific server entry; don’t reuse one just because it has the right format.
4. Check the remaining settings: If your details include Encryption, a transport type, TLS, SNI, Host, or Path, match each one to its corresponding setting. Don’t make up values that aren’t specified.

Encryption, transport, and TLS: treat them as separate settings

Encryption is a VMess-related protocol setting, so enter the value shown in your existing configuration. VMess and VLESS handle data differently at the protocol layer, so don’t copy a VMess Encryption value into a VLESS configuration. TLS is a separate setting: check whether TLS is required, which server name to use, and any certificate verification requirements against the server details. An empty field in one section doesn’t mean settings in other layers should also be turned off.

Transport describes how protocol data is carried over the connection. Your details may specify TCP, WebSocket, or gRPC. Host and Path are WebSocket transport settings; SNI is used for server name indication in TLS. Although both fields may contain a domain name, they aren’t interchangeable. The options shown in the app depend on the selected Type and the current in-app settings.

For example, if your details specify Port: 443, TLS: on, and a WebSocket Path starting with /, check the port, TLS, and Path separately when entering the settings. Port 443 is only an example here; neither VMess nor VLESS requires it. You can’t infer the Path from the domain name, either. If your details don’t specify the transport or TLS requirements, get that information before troubleshooting the connection.

Can’t connect after saving? Narrow down the cause by symptom

Saving successfully only means the entry was added to the list; it doesn’t mean the server has accepted a connection. To troubleshoot, first make sure you’re testing the entry you just added, then check the connection test or what happens when you try to access a site. Change only one suspected field at a time and keep the original details so you can compare results. Changing Type, Port, and TLS all at once makes the cause harder to track down.

If a test times out, first check Address and Port, whether your current network can reach the server, and whether the server still uses those settings. If the connection is established but the result isn’t what you expected, check the selected entry and routing settings. Don’t conclude that “VMess is faster than VLESS” or the other way around based on different results: connections also depend on the server configuration, network path, transport, and routing mode.

Once Type is correct, distinguish protocol issues from routing issues

In Shadowrocket, Type determines which protocol a server entry uses; Global Routing determines how traffic is handled through the selected connection. Proxy, Direct, and Config in Global Routing are routing modes, not aliases for VMess or VLESS. In Direct mode, traffic is handled as a direct connection, so a site opening successfully doesn’t prove that the server entry you just added is working.

• Proxy: Use this to check how traffic behaves through the currently selected connection. Before switching, make sure the entry you want to test is selected.
• Direct: Use this to compare direct-connection behavior. Results in this mode don’t confirm that the protocol settings have passed a test.
• Config: Traffic is handled according to the rules in your current configuration. If a request matches a rule such as DOMAIN-SUFFIX, GEOIP, IP-CIDR, or FINAL, the result also depends on the action specified by that rule.

Troubleshoot in two steps: first check the connection with the correct entry selected and the routing mode confirmed, then review the rules in Config for everyday use. If the problem only occurs with certain domains, check which rule matches the request instead of repeatedly switching between VMess and VLESS. Settings → On Demand controls when a connection starts automatically; it doesn’t replace checking Type or server fields.

Pre-check checklist

After manually adding or updating an entry, compare the in-app settings with the original details. Most importantly, make sure every value comes from the same configuration. A mismatch or missing value for the protocol, address, port, identifier, transport, or security settings can affect the connection. If the details are incomplete, the app can’t determine which settings the server actually uses.

1. Type is explicitly specified as VMess or VLESS and matches your existing details.
2. Address, Port, and UUID belong to the same entry; copied values contain no extra spaces or line breaks.
3. Enter the VMess Encryption value, transport, and any related settings as specified. Don’t copy VMess settings directly to VLESS.
4. Check TLS, SNI, and—when using WebSocket—Host and Path separately. Don’t treat domain-name fields as interchangeable.
5. When testing, confirm the selected server and Global Routing mode. In Config mode, also check how the rules handle the request.

If you manage existing configuration details through Subscribe, update the subscription after any parameter changes and review the imported entry before deciding whether to edit it manually. Shadowrocket is available on the App Store from developer Shadow Launch Technology Limited. Check the App Store listing for system requirements for iPhone, iPad, and other compatible devices. Getting the app and obtaining your own server configuration are separate things; a one-time app purchase doesn’t include a service plan.