Shadowrocket VMess vs. VLESS: Which Settings to Check When Adding a Server

1. VMess vs. VLESS: What’s the Difference?

The short answer: choose the protocol actually offered by the server; don’t choose based on assumptions about speed. VMess provides authentication and encryption at the protocol layer. VLESS does not encrypt traffic on its own and must be paired with the security layer specified by the server. VLESS uses none for protocol encryption, which does not mean the entire connection is necessarily unencrypted or that you should turn off TLS.

When configuring a server manually, consider three things separately: how the user is identified, how data is transported, and how the connection is secured. WebSocket is a transport method; TLS is a security layer. Neither is another name for VMess or VLESS. A protocol can be used with different combinations, but every client setting must match the server.

So there is no universal “copy the VMess UUID, change Type to VLESS, and you’re upgraded” procedure. Even if both sets of settings happen to use the same UUID, confirm that the server has a matching protocol endpoint, port, and transport configuration.

2. Gather the Full Settings Before Opening Add Server

Tap the add button in the upper-right corner of Home to open Add Server. Choose Type first, then fill in the fields shown for that type. Available fields can change depending on Type and transport options. This guide uses protocol terms such as UUID and SNI to explain what the values correspond to; field names and locations may vary in the current app.

1. Make sure all settings belong to the same endpoint. Keep the protocol, Server, Port, UUID, transport, and security layer together in one record. Don’t mix a port from an old message with a domain from a newer configuration.
2. Distinguish an individual configuration from a Subscribe URL. A subscription URL retrieves a group of configurations; it is not a Server or UUID. If you imported an entry through Subscribe, check its existing details first instead of creating a duplicate without the additional settings.
3. Keep the original configuration. Record the original values before troubleshooting manually. If needed, create a separate test entry and change one setting at a time. A later subscription update may overwrite provider-managed fields, so don’t treat a temporary change as a permanent fix.
4. Gather any additional settings. For WebSocket, also have the Host and Path. For TLS, have the server name and certificate requirements. If Flow is specified for VLESS, check it too; don’t fill it in arbitrarily.

3. How to Enter Server, Port, and UUID

Server is the address of the server you want to connect to, usually a domain name or IP address. Do not include https://, a web page path, or query parameters. Port is the port the server actually listens on. Entering port 443 does not enable TLS automatically, and entering a domain does not set the correct SNI automatically.

A UUID is a protocol credential, not a label or an Apple Account. Preserve the hyphens when copying it, and remove leading or trailing spaces and accidental line breaks. Don’t paste an entire id=... snippet, including its key, into the field. A correctly formatted UUID does not guarantee that the server still accepts it.

• Wrong address: The domain may fail to resolve, or you may connect to a different server. Check the spelling first; don’t start by changing the UUID.
• Wrong port: The connection may be refused or time out. Don’t apply TLS settings from another entry just because you see port 443.
• Wrong credentials: The underlying connection may succeed while protocol authentication fails. Check the UUID, Type, and account status instead of relying on the latency number alone.
• VMess time issue: Authentication depends on time. If authentication still fails with all other fields matching, check that automatic date and time are enabled and the current time is correct in Settings → General → Date & Time.

4. Don’t Mix Up WebSocket Host, Path, and TLS SNI

These fields are often all domains or short strings, but they serve different purposes. Server determines the connection destination. SNI specifies the server name during the TLS handshake. WebSocket Host and Path are used in the HTTP upgrade request and server routing. Their values may match or differ; you can’t derive every value from Server.

The example below illustrates how fields relate to one another. It is not a usable configuration and does not indicate that a real server supports these values. Enter the complete settings for your own existing endpoint; don’t fill in missing fields using this example.

Type: VLESS
Server: edge.example.com
Port: 443
UUID: Use the full UUID provided for your existing endpoint
Transport: WebSocket
Host: web.example.com
Path: /ws
TLS: enabled
SNI: web.example.com

5. How to Decide Whether to Enable TLS: Follow the Endpoint Settings, Not the Protocol Name

VMess can use TLS, and the protocol name alone does not determine whether VLESS should use TLS either. This section compares how security-layer settings work in the same app; it does not rank the two protocols. The recommendation applies when your existing settings explicitly enable TLS. If the server specifies a different security method, check its required fields and whether the current app supports it.

6. How to Verify Your Settings and Avoid Mistaking a Routing Issue for a Protocol Problem

After saving the entry, return to Home, select the configuration you just checked, and test the connection. A latency value only means the relevant test received a response; it does not confirm that the UUID, WebSocket routing, TLS, and access to the destination website are all working. The symptoms below are troubleshooting categories, not the only possible explanation for any error.

1. First, confirm the selected entry. Check the current selection on Home. You may have edited a new entry but still be connecting with a different, older one.
2. Next, check Global Routing. Direct won’t test the proxy endpoint. With Config, a rule may route the destination directly. You can temporarily use Proxy to rule out rule selection, then restore your original setting after testing.
3. Note where the failure occurs. For a connection timeout, check Server, Port, and network reachability first. For a TLS failure, check the security layer, SNI, certificate, and device time. If the connection is established but still fails, check the UUID, transport settings, and server status.
4. Finally, check the rules and DNS. If the destination is accessible with Proxy but not with Config, check which rule and policy are matched in the current Config. Don’t keep changing protocol credentials.

A rule such as DOMAIN-SUFFIX,example.com,DIRECT sends matching domains through DIRECT. FINAL determines the policy for traffic that didn’t match an earlier rule. In this case, the result reflects the routing path, not necessarily the VMess or VLESS entry you just added. Don’t treat a temporary global selection used for testing as a permanent routing configuration.

7. Common Questions About Manually Adding VMess and VLESS

After checking an entry, keep a record of the original values, the changes made, and the result. Once you know whether the failure occurs during address connection, the TLS handshake, protocol authentication, or rule selection, you can troubleshoot that layer without changing the protocol, port, and transport all at once.