Shadowrocket VMess vs. VLESS: Key Settings to Check When Adding a Server

At a glance

VMess and VLESS are not interchangeable by changing the Type field alone. Check the protocol, UUID, transport, and TLS settings instead of assuming one is faster by name. This guide is for Shadowrocket users on iPhone, iPad, Mac, Windows, Android, and Linux. The examples use Home → Add Server on iPhone and iPad; on other platforms, match the corresponding fields. You’ll need your own provider’s settings. By the end, you’ll be able to check those settings and distinguish authentication, transport, and routing issues.

1. The key difference between VMess and VLESS: authentication and encryption are separate layers

Shadowrocket is a closed-source commercial app. VMess and VLESS are two of the proxy protocols it supports, not separate clients. Choose the Type that matches the protocol running on the server. Although both use UUIDs, their settings are not interchangeable.

VMess provides user authentication and configurable protocol-level data encryption. Its encryption settings must match the server. VLESS does not provide the same kind of protocol-level encryption and is commonly deployed with secure transport such as TLS. If VLESS shows none for encryption, that does not mean the entire connection is unencrypted; check whether TLS is used at the outer layer.

What to check	VMess	VLESS
User ID	Usually a UUID is used for authentication and must match the server.	A UUID is also used as the user ID, but that does not make the connection VMess.
Protocol-level encryption	Has a corresponding data encryption setting; keep the value specified in the configuration.	Does not provide the same kind of data encryption, so don’t copy VMess encryption settings.
Outer TLS	Whether TLS is enabled depends on the server configuration, not the protocol name alone.	TLS is common in VLESS deployments; check the server configuration for the exact setting and authentication parameters.
Transport	Supports different transport types; the client must match the server.	The transport type must also match; copying only the address and UUID is not enough.
When to switch	The server must provide a VMess configuration.	The server must provide a VLESS configuration. Changing Type does not change what the server supports.

Bottom line: confirm the server protocol first, then set encryption and TLS

If your existing configuration connects, keep it as is. To switch protocols, get a complete new configuration from your provider; don’t just change Type on the existing entry.

2. UUID, port, and transport: check these four groups of settings separately

A UUID identifies a user; it is not a server address or subscription URL. It commonly appears as a hexadecimal string with hyphens. A string that looks correctly formatted is not necessarily valid on the server. When copying, watch for spaces, line breaks, or punctuation added by a messaging app.

128 bit

UUID length identifies the user; it does not indicate encryption strength

36 characters

Common UUID text format, including 4 hyphens

443

An example of a commonly used TLS server port—not a fixed port for every configuration

Address and port: The server address can be a domain name or IP address. Enter the port from your settings. Using port 443 does not enable TLS automatically or guarantee that a proxy service is listening on that port.
Authentication: Check that the UUID is complete and that the entry is still valid. Don’t enter a token from a subscription URL in the UUID field.
Transport: Confirm the actual transport type, such as TCP, WebSocket, or gRPC. If the configuration specifies a WebSocket Path, Host, or gRPC serviceName, match each value exactly.
Security: Check the TLS setting, server name, and certificate verification requirements. Client settings only work when they match the server configuration.

For example, if your settings specify a WebSocket Path of /tunnel, don’t shorten it to /. Preserve the capitalization, leading slash, and full path. WebSocket Host, TLS SNI, and the actual connection address serve different purposes. Even if all three match in one configuration, don’t assume they should be identical in every entry. example.com in this guide is a placeholder domain, not a working server address.

3. Entering settings in Add Server: keep all the parameters together

If your subscription already includes all the settings, use the imported entry in Home. To add a server manually, go to Home → Add Server. Field layouts may differ by platform, so match fields by their meaning rather than their position in a screenshot. Subscription URLs, UUIDs, and share links may contain credentials; don’t share them publicly.

Two ways to add a connection: import a subscription or enter settings manually

If you already have a subscription

In Home, confirm that the subscription is imported and has entries.
Open the entry you want to use and check its Type, address, port, and TLS settings.
After an update, check the entry again so you don’t keep using an expired one.
Keep a copy of the original settings before making changes so you can restore them if needed.

If you have a complete set of settings

Go to Home → Add Server and select the matching Type first.
Enter the address, port, and UUID, then set the transport type.
Enter additional settings such as Path, Host, and SNI exactly as provided.
Save the entry, select it in Home, and then test the connection.

A subscription update may recreate entries. Before making a lasting change, confirm the settings with your provider. A temporary manual edit does not change the server configuration.

If a VMess configuration includes additional authentication options, keep their original values. Some settings in older guides may not apply to your current server; don’t copy a value just because it appears in a tutorial. VLESS configurations may also include a flow setting, which cannot be used with every transport. If the instructions are unclear, get the complete settings for that connection instead of guessing each value.

First make sure the Type matches the protocol named in your settings, so you don’t create a VMess entry for a VLESS connection.
Check the UUID, server address, and port character by character, and make sure each value is in the correct field.
Check the transport and its additional fields, then verify TLS. Don’t change several settings at once.
After saving, test only this entry and note whether the error occurs during connection, the TLS handshake, or the web request.

4. Choosing TLS settings: follow the server configuration, not a speed rule

TLS protects data in transit and verifies the other end of the connection. Don’t use “TLS on is slower, TLS off is faster” as a basis for configuration. If the server requires TLS and the client has it disabled, the connection usually won’t work as expected. Conversely, sending a TLS handshake to a port that accepts only plain transport will fail. For VLESS, none for encryption does not mean TLS should also be disabled.

Enable TLS and check the server name

Recommended

When your provider specifies TLS, enable it as instructed, keep certificate verification on, and check the SNI. This applies only when the server is configured for TLS; don’t enable it on every port by default.

For: VMess or VLESS connections with TLS settings explicitly provided by your provider

Disable TLS and keep the original transport settings

Use this only when the server settings explicitly call for it. Understand what protection is used at the outer layer; a plain VLESS connection and one using TLS do not have the same security properties.

For: connections to non-TLS servers with explicit deployment instructions

SNI identifies the target server name during the TLS handshake. Certificate verification also checks whether the certificate matches the expected name. If the connection address is an IP but the certificate was issued for a domain, enter the correct server name as specified by your provider. WebSocket Host is a separate setting; changing it does not fix TLS name verification.

If the certificate name doesn’t match, check the SNI and domain provided by your provider before disabling certificate verification.
If you see a certificate expiration error, check that your device’s date, time, and time zone are correct.
If the handshake times out, first check your network and whether the address and port are reachable. Then verify TLS and transport settings.
Don’t leave settings that allow insecure connections enabled just to silence an error. Making the error disappear does not resolve an identity verification problem.

5. Web pages won’t load after saving: separate protocol issues from routing issues

Selecting an entry in Home and connecting does not mean every request goes through it. Global Routing determines how requests are handled, and Config rules may also affect routing. If a request goes through Direct, whether the page loads doesn’t tell you if the VMess or VLESS settings you entered are valid.

Where to check	What to look for	Next step
Home → Global Routing → Config	Requests are matched against the rules in Config; they are not guaranteed to use the currently selected proxy entry.	Check request logs and the matched policy to see which route the request actually took.
Home → Global Routing → Proxy	For troubleshooting, temporarily route traffic handled by the client through a proxy.	Select the entry you want to test, then restore your usual mode when you’re done.
Home → Global Routing → Direct	A successful direct connection does not confirm that the proxy protocol settings are correct.	To test a proxy entry, make sure the routing mode is not Direct.
Home → Global Routing → Scene	Traffic is handled according to the configured Scene; the result depends on its settings.	Check which policy the current Scene uses before judging the connection result.
Settings → On Demand	Affects when connections are triggered; it does not fix UUID, TLS, or transport settings.	Check the connection status during testing so automatic connection behavior isn’t mistaken for a protocol issue.

In Config mode, DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP ranges, GEOIP matches IP geolocation, and FINAL handles requests that don’t match earlier rules. These rules determine where traffic goes; they don’t create a server-side user or fill in a missing UUID. The target policy must also exist in the current configuration.

Make sure Home has the entry you just checked selected, not an older entry with the same name.
Temporarily switch to a suitable proxy route and test the same request again. Don’t change the entry, mode, and network at the same time.
If the connection fails, recheck the address, port, authentication, and TLS. If the connection succeeds but a particular website doesn’t load, check DNS, rules, and the website’s status.
Restore your usual mode after testing. Note the error and when it occurred. Before contacting your provider, hide sensitive fields such as UUIDs and tokens.

6. Common VMess and VLESS setup questions

Why does the same UUID stop working when I change VMess to VLESS?

A UUID is only part of the authentication settings; the server must also run the matching protocol and transport. Restore the original Type first. If you need VLESS, get a separate, complete set of connection settings from your provider and create a new entry in Add Server. Don’t repeatedly modify your only working entry.

VLESS shows none. Does that mean there’s no encryption?

First check which layer the setting applies to. VLESS can show none for protocol-level encryption while still using TLS at the outer layer. Open the entry and check TLS, the server name, and certificate verification. If your settings don’t specify how the connection is protected, ask your provider instead of guessing an encryption name.

The port is set to 443. Why am I still getting a TLS error?

The port number alone doesn’t ensure TLS is configured correctly. Check that the server actually provides TLS on that port, that the SNI matches the certificate, that your device’s clock is correct, and that WebSocket or gRPC settings match. Don’t disable certificate verification as a substitute for these checks.

Which is faster? Should I switch all my VMess connections to VLESS?

You can’t tell from the protocol name alone. Server load, round-trip latency, packet loss, transport, and the route to the destination all affect performance. Keep working entries. If you have two working configurations, test them on the same network, against the same destination, and at similar times, then compare the results. Differences between routes shouldn’t all be attributed to the protocol.

My manual changes reverted after a subscription update. What should I do?

A subscription update may regenerate entries from settings supplied by your provider. Check whether the updated values have changed and confirm that the subscription is still valid. For a lasting change, tell your provider exactly which field doesn’t match. If you create a temporary standalone entry, keep the original settings and give it a distinct name to avoid selecting the wrong one later.

This guide covers entering and checking settings you already have. This site does not provide, sell, or recommend proxy servers, subscriptions, or providers. For account expiration, server ports, or certificate deployment issues, contact your own provider; changing client fields cannot fix a server-side problem.