VLESS in Plain Words
Picture an envelope with data inside it and the recipient's address on the front. A classic VPN protocol writes its own return address on the envelope and adds a company stamp: it is immediately obvious that this is a letter from a VPN. VLESS is arranged differently — it keeps the service part to a minimum. Historically it had no encryption of its own at all: that was handled by TLS, the very same mechanism that protects banking sites and email. Since 2025 Xray has also had a native encryption layer, but in practice VLESS is still used together with TLS. Everything else has stayed as it was: no elaborate handshake with distinguishing marks, no superfluous service fields. From the outside the result is a TLS stream to some domain, similar in shape to millions of other streams just like it. Hence the name: the letter V from the original family of protocols, and less — that is, less service overhead. It is precisely this minimalism that makes classification harder: filtering equipment has fewer obvious things to catch hold of. This does not make the connection entirely invisible — analysis of nested TLS has long been described and is applied in practice — but the recognition task becomes noticeably harder. Hence a practical requirement: VLESS almost always works together with TLS, and in REALITY mode the client leans on the handshake of a third-party site, so a domain name of your own is not required for it. Without the outer wrapper the protocol loses its main advantage and turns into an ordinary unprotected tunnel.
How VLESS Differs from OpenVPN and WireGuard
OpenVPN and WireGuard were designed for a different task — reliably connecting one office to another on a network where nobody interferes. They are technically excellent, but they are protocols with a recognizable signature. With OpenVPN it is the characteristic handshake and the structure of the packets; with WireGuard it is short UDP datagrams of a fixed format and a noticeable first key exchange. It is not about age: the cryptography in both is modern, the problem lies precisely in the predictability of the first bytes. A deep packet inspection system usually needs no more than that to classify a connection and then tear it down or cut the speed to something unusable. Hence the typical complaint about services built on such protocols: the connection comes up and drops a minute later. VLESS solves not the problem of encryption but the problem of visibility. It is not faster than WireGuard under laboratory conditions and not safer than it in itself — it simply gets through more often where the others do not. The same thing explains why comparing protocols in isolation from a specific network is pointless. Where nobody inspects the traffic, the difference comes down to a few percent of overhead; where inspection is active, it turns into the difference between a connection that works and one that does not.
What the XRay Core Is
VLESS is a description of a protocol, not a program. It runs inside a core — an engine that can accept connections, apply routing rules and wrap traffic in various transports. The most widespread such core is called XRay; popular clients are built on it, Happ among them. The core is responsible for what happens around the protocol: which transport to use on top of TLS, how to disguise the connection as web traffic, which domains to send out directly, past the tunnel, and how to reconnect after a break. The second widespread core is Mihomo, on which Koala Clash runs. To the user the differences between cores are all but invisible: both programs accept one and the same connection key and parse the configuration themselves. Knowing about the core is useful in one case only — when you are choosing a client for your own system. Another job of the core is split routing: local sites and banking apps can be sent out directly while everything else goes into the tunnel. The rules are described in the configuration and arrive together with the key, so they are not usually set up by hand.
Where VLESS Is Faster Than ShadowSocks and When It Is the Other Way Round
ShadowSocks is older and simpler: a lightweight proxy with AEAD encryption on top of ordinary TCP or UDP, with no TLS layer at all. It was devised so that content-based filtering could not make sense of the stream. Thanks to that simplicity it has minimal overhead and brings a connection up very quickly, so it feels at home in mobile networks with a poor signal and frequent switching between towers. VLESS wins where traffic analysis is cleverer: disguise as an ordinary TLS stream as a rule survives the active probing that ShadowSocks sometimes does not. On a stable wired channel and in heavy scenarios — video in high resolution, large downloads, long-lived connections — VLESS usually holds its speed more evenly. In networks where instant response and battery economy matter more, ShadowSocks often turns out to be the more pleasant option. There is no universal winner; there is a tool suited to the conditions. It is better to check empirically: switch on one protocol for a couple of days in your usual scenarios, then the other, and compare not the peak figures from a speed test but how evening video and page loading feel.
Why We Provide Both Protocols
Conditions on networks vary and change over time: with one provider one thing gets through worse in the evening, with another something else does in the morning. That is why RobinGood VPN issues both VLESS and ShadowSocks on a single account: if one option works worse on your network today, you switch to the other right in the client, without changing your plan or obtaining a new key. The picture is completed by an MTProto proxy for messenger traffic and an HTTPS proxy for browser scenarios. If a route stops working, access is restored without your involvement — there is no need to reconfigure the client. There is no automatic switching between protocols, though: you choose the server and the protocol yourself, and it takes a few seconds. Added to this are clients on different cores: XRay in Happ and Mihomo in Koala Clash behave differently on particular networks, and having an alternative sometimes solves the problem faster than any exchange of messages. If you do need help, there is the Telegram support bot, and when the messenger is unavailable, the address support@rgvpn.pro.
What This Means in Practice
A user does not need to understand how the protocol is built in order to use it. It is enough to take the connection key from the dashboard or from the bot and paste it into a client: Happ on a phone and a computer, Koala Clash on a desktop. Outline will not do for VLESS — it can only handle ShadowSocks. If the tunnel is needed exclusively in the browser, there is our extension for Chrome: it requires no key, signing in to your account is enough. The client will parse the configuration itself, bring the connection up and choose a transport. If a page will not open or the speed has dropped, a sensible order of actions is this: change the server, then the protocol, then restart the client. How many devices run on one account depends on the plan — the limit is stated in its description; within that limit a phone, a laptop and a television can use different protocols at the same time, which is normal and sometimes useful. A router is a separate story: VLESS usually will not run on stock firmware, and on Keenetic and OpenWrt it needs extra packages such as Entware and XKeen — but the setup is done once for the whole home network. The connection key is worth storing somewhere other than a chat: save it in a password manager so that you can set up a new device without contacting support. When changing phones it is enough to paste the same key into the client.
What VLESS Does Not Do
It is useful to understand the limits. A native encryption layer appeared in the protocol only in recent versions of Xray, and in practice security is still provided by the TLS on top of it — without the outer wrapper the connection remains unprotected. It does not make you anonymous: sites still recognize you by accounts, cookies and browser fingerprint, and the service at the other end of the tunnel is technically able to see connections. It does not protect against malware and phishing, because it solves a transport problem, not the problem of filtering content. And it does not grant everlasting inconspicuousness: methods of traffic inspection develop — analysis of nested TLS and active probing have long since stopped being theory — and transports and ways of disguising connections change along with them. The resilience of a connection is the result not of a single protocol but of the continuous maintenance of infrastructure. A VPN of any generation is worth regarding as a tool with a clearly defined field of application rather than as a universal shield. Finally, the protocol does not cancel basic hygiene: an updated system, a current browser and attention to certificate warnings matter no less for security than the choice of transport.
Frequently asked questions
Does VLESS encrypt traffic?
Encryption in this combination is provided above all by the TLS in which the connection is wrapped — the same mechanism that protects banking sites, so in practice the data is closed off just as well. In recent versions of Xray the protocol itself has acquired an encryption layer of its own as well, but the familiar arrangement has stayed the same: VLESS inside, TLS outside. It is this division that allows the connection to look like ordinary web traffic.
How is VLESS better than WireGuard and OpenVPN?
Not in speed and not in cryptography, but in how hard it is to identify. WireGuard and OpenVPN are protocols with a recognizable signature: their handshake is fixed, and deep inspection equipment identifies it from the first bytes, after which the connection is torn down or slowed. VLESS minimizes service data and hides beneath ordinary TLS, so it usually gets through where protocols with a noticeable signature fall away.
What has to be installed in order to use VLESS?
A client that supports this protocol: Happ on a phone and a computer, Koala Clash on a desktop; Outline will not do, it works with ShadowSocks only. It is enough to paste in the connection key from the dashboard or from the bot — the configuration will be pulled in automatically. The availability of Happ in the Russian App Store changes from time to time, so look for the current install link in the dashboard. If you need the traffic only in the browser, our extension for Chrome will do: it needs no key, signing in to your account is enough.
Which should you choose: VLESS or ShadowSocks?
Start with VLESS — it is usually more resistant to advanced traffic analysis. If on a mobile network the connection comes up slowly or often breaks when switching between towers, try ShadowSocks: it is simpler and lighter. Both protocols are available on one account, and switching takes a few seconds and is done by hand in the client.
Why does VLESS sometimes stop working all the same?
Because conditions on networks change: providers try new methods of analysis and restrict access to particular addresses and domains. In such cases changing the server or the protocol in the client usually helps, and if a route stops working, access is restored without your involvement — there is no need to reconfigure the client. No protocol grants permanent inconspicuousness without maintenance.
Ready for a stable internet connection?