VLESS is a tunnel protocol from the Xray project that carries your traffic with almost no overhead and leaves encryption to the TLS layer underneath, so the connection looks exactly like a browser talking to a website over HTTPS. Reality is an extension that goes one step further: the server borrows the identity of a real, well-known website during the TLS handshake, so anyone inspecting the connection sees a legitimate visit to that site. Together they are the current answer to networks that recognize and block conventional VPN protocols.

The problem they solve

WireGuard, OpenVPN and IKEv2 are secure, but their traffic has a shape. A firewall that inspects packets can tell "this is a WireGuard handshake" or "this is OpenVPN" and drop or throttle it. That is what happens on some corporate and campus networks, in hotels with aggressive filtering, and in countries that restrict VPNs. The comparison of conventional protocols is in WireGuard vs OpenVPN; the short version is that none of them was designed to hide.

VLESS was. Its design goal is not speed or simplicity, though it has both, but indistinguishability from ordinary web traffic.

How VLESS works

Conventional protocols wrap each packet in their own header format, and that format is what a firewall recognizes. VLESS adds a minimal header, a few bytes with a user ID, and hands the data to a transport layer. With TLS as the transport, the connection uses port 443, a normal TLS handshake, and a normal encrypted stream. From the outside it is an HTTPS session.

VLESS itself does not encrypt. This is deliberate: TLS already does, and encrypting twice would add cost without benefit. The result is throughput close to WireGuard's with a completely different traffic profile.

What Reality adds

TLS-based tunnels had one remaining weak point: the server needed its own certificate and domain name, and a careful observer could ask whether that domain was a real website or a VPN endpoint. Reality removes the question. During the handshake, the VLESS server presents the TLS identity of a real, popular website; the handshake is cryptographically verified against that site's actual certificate. A client with the right key completes the tunnel; anyone else, including a probe from a firewall, is transparently forwarded to the real website and sees nothing unusual.

So the server does not need a domain or a certificate of its own, it cannot be identified by probing, and the traffic is a valid TLS session with a known site. This is why "VLESS + Reality" is the combination most often recommended for hostile networks.

Speed and battery

Because VLESS does little work of its own and relies on TLS 1.3, it is close to WireGuard in throughput and battery use, and well ahead of OpenVPN. The main variable is the same as with any protocol: distance to the server and its load. Why speed changes with a VPN at all is in does a VPN slow down your internet.

Security

Encryption comes from TLS 1.3, the same as any modern website, with the server authenticated through Reality's handshake. The protocol has been in wide use since 2023 and is open source. As with any tunnel, security in practice depends on the client configuration: DNS must go through the tunnel, IPv6 must be handled, and a kill switch should cover reconnects. The checks in is my DNS leaking apply exactly the same way.

Subscription links and clients

VLESS servers are usually distributed through a subscription link: one URL that contains a list of servers, which the client fetches and keeps updated. The flow:

  1. Install a client. iPhone: Streisand, V2Box, Hiddify, Shadowrocket. Android: v2rayNG, Hiddify. Windows and macOS: Hiddify, v2rayN, Clash-based clients. Or the provider's own app, which handles all of this.
  2. Copy the subscription link from your account.
  3. In the client, add a subscription and paste the link; the server list appears.
  4. Pick a server and connect; the operating system asks once to add a VPN configuration.
  5. Open What Is My IP and confirm the server's address.

If the client offers a TUN or "system-wide" mode, use it; that is what makes the proxy protocol behave like a VPN for every app rather than only the browser.

VLESS or WireGuard?

  • Ordinary home, office and mobile networks: WireGuard is a little faster and lighter.
  • Networks that block or throttle VPNs, travel to restricted countries, hotels and campuses with filtering: VLESS with Reality.
  • Not sure: an app that switches automatically will pick WireGuard where it works and VLESS where it does not.

The two are complementary, which is why serious clients ship both rather than choosing.

404 VPN provides VLESS with Reality alongside WireGuard, selects between them based on the network, keeps DNS inside the tunnel and blocks traffic during reconnects with a kill switch. The connection is described on the how it works page; get started here.