In Shadowrocket, VMess and VLESS cannot be converted simply by changing the Type. Both can use a UUID to identify users, but their encryption mechanisms differ, and the transport and TLS settings must be checked separately. This guide is for users who already have their own server details or subscription. It covers protocol, identity, transport, and security settings, along with steps to troubleshoot connection failures.
Key differences between VMess and VLESS
Choose the protocol that matches the server configuration; do not judge by which name sounds newer. VMess is a proxy protocol with authentication and protocol-level encryption. Common VLESS configurations do not encrypt payloads at the protocol level, so transport is usually protected by an outer layer such as TLS. Either protocol can use different transports, so “VMess means WebSocket” and “VLESS means TLS” are not accurate equivalences.
| Setting | VMess | VLESS |
|---|---|---|
| User identity | Usually a UUID, which must match the user configuration on the server. | Usually a UUID, which must match the user configuration on the server. |
| Protocol-level encryption | Includes protocol-level encryption; configure it as required by the server. | In common configurations, Encryption is set to none; transport protection must be configured separately. |
| TLS | Can be used separately; it is not the same as VMess encryption. | Common deployments use an outer layer such as TLS. The protocol name alone does not indicate whether the connection is encrypted. |
| Transport | Must match the server, such as TCP or WebSocket. | Must also match the server. Do not reuse transport settings from another server entry. |
| Switching protocols | Add or import a new server entry using the complete configuration for the corresponding server; do not just change Type. | |
VMess AEAD authentication and payload encryption are related but distinct concepts. AEAD is not a TLS toggle. If older settings include an AlterId, do not try random values to make it work; confirm the currently valid configuration with the service administrator. If VLESS settings include additional parameters such as Flow, the client and server must both support them and be configured to match. Do not copy values from another server entry.
A UUID identifies a user; it is not an encryption method
A UUID lets the server identify a user who is allowed to use the service. The same UUID format does not mean the two protocols can share an account configuration: the server must list that identity under the corresponding protocol, and the address, port, and other settings must also match. An extra space or a missing character when copying the UUID can invalidate authentication.
How to check: verify identity, port, and TLS separately
A correctly formatted UUID only means the text looks valid. Check with the server configuration that the user is active, the port matches the protocol, and TLS is enabled as required. Do not assume the other settings can be reused just because the UUID has not changed.
- Copy the full UUID. Do not enter a display name, subscription token, or regular login password in this field.
- Before saving, check for leading or trailing spaces, line breaks, and substituted characters, especially after copying between apps.
- Do not show UUIDs or full subscription links in public screenshots. When troubleshooting, share only the field names and the symptoms.
What the protocol, Transport, and TLS settings control
Think of a server entry as a set of independent layers: VMess or VLESS specifies the proxy protocol; TCP, WebSocket, and other transports determine how data is carried; TLS determines whether the connection is protected by an outer layer. WebSocket does not mean TLS. A WebSocket connection with TLS and one without TLS require different settings on the other end.
For an existing WebSocket over TLS configuration, the server address identifies the connection target, Port specifies the listening port, and the WebSocket Host and Path must match the server's routing. TLS Server Name (SNI) specifies the target name during the handshake. These fields may use the same domain or different values depending on the deployment. Do not replace them all with the server IP just because several fields refer to a domain.
TLS enabled; validate the server certificate
RecommendedIf the server provides TLS, enter the specified Server Name and leave certificate validation enabled. If you encounter a certificate error, check the name, device time, and server certificate first instead of bypassing validation.
Use when an existing VMess or VLESS server explicitly requires TLS
TLS disabled; connect only as explicitly required by the server
Use only when the server actually supports the specified connection method. Disabling TLS does not enable another form of protection. In particular, for VLESS, Encryption set to none does not mean transport encryption is already in place.
Use for controlled network testing with known security boundaries or deployments that explicitly require it
The recommendation above applies to the TLS setting; it does not mean you should force TLS on for every existing server entry. If the server port accepts only connections without TLS, enabling TLS on the client will cause the handshake to fail. Likewise, port 443 is common in some deployments, but does not prove the protocol or encryption status.
Filling in Add Server: recommended order
If you have a complete subscription or share configuration, import it first and then check each setting. This usually preserves the parameters better than re-entering them manually. To enter settings by hand, tap the add button in the upper-right corner of Home to open Add Server. Select Type first, then fill in the fields shown for that type. The fields vary by server type and app state; use the steps below as a checklist, not as a list of fields that must all appear.
- Confirm Type. Select VMess for a VMess server and VLESS for a VLESS server. If the type is wrong, matching values in the other fields still do not make the configuration valid.
- Enter the address and Port. Enter a hostname or IP address, without a web page path. Use the port provided by the server. For example, if the server specifies 8443, do not change it to 443 just because TLS is enabled.
- Enter the UUID. Use the identity assigned to this server entry. Set the VMess encryption option, VLESS Encryption, Flow, and any other additional fields according to the existing server configuration.
- Check Transport. If the server uses WebSocket, check Host and Path. For any other transport, do not copy over the WebSocket fields.
- Check TLS. Confirm whether it is enabled, that Server Name is correct, and that certificate validation is configured properly. Even when the address is an IP, the server may require a domain name for Server Name.
- Save and select the server entry. Return to Home and select the server you just saved from the SERVER list before testing the connection. This avoids testing a different entry that was already selected.
Narrow down connection failures by symptom
First confirm which server entry is in use, then identify the layer where the failure occurs. Turning on the connection switch in Home means the local connection process has started; it does not confirm that remote authentication, the TLS handshake, or access to the destination website has succeeded. Connectivity Test can provide an initial check, but a single result cannot cover every domain, rule, or app.
Why won't the connection work after switching from VMess to VLESS if the UUID is the same?
Restore the original entry instead of continuing to change only Type. Check with the service administrator whether a VLESS endpoint is available, and obtain its port, UUID, Transport, and TLS settings. The two protocols use different handshakes; the same UUID does not make the server switch protocols automatically.
What should I check first when I see a TLS error?
Open the server entry for editing. First confirm that TLS matches the server settings, then check Server Name, the device's system time, and the certificate domain. If the address is an IP, verify the SNI required by the original configuration. Do not disable certificate validation as a substitute for troubleshooting.
If a WebSocket connection fails, what should I check besides the UUID?
Check Port, TLS, WebSocket Host, and Path in that order. If the connection log shows an HTTP status code, a 404 may point to a path or reverse-proxy routing mismatch, while a 403 may indicate an access restriction. These are troubleshooting clues, not proof that the UUID is wrong.
Connectivity Test succeeds, but websites won't load. What next?
First check Home → Global Routing. Direct does not test website access through the selected proxy; Config is affected by rules. Temporarily switch to Proxy, select the target server entry, and try the same website again, then restore the original setting. If it fails only in Config, continue checking the rules and DNS.
Change one setting at a time while troubleshooting, and note what happens before and after each change. If you change the protocol, port, SNI, and Path all at once, you will not know what fixed the connection. For subscription-managed entries, keep the relevant details and check the updated parameters first; local changes may be overwritten the next time the subscription updates.
Choose and test by configuration, not by protocol name alone
For most users, the process is simple: confirm what the existing service supports, check that all its settings can be matched in Shadowrocket, and then compare the results under the same conditions. VLESS has a more streamlined protocol design, but that does not make it faster on every network. VMess includes protocol-level encryption, but that does not mean you can ignore TLS, certificates, or server identity. Latency, congestion, server load, and transport all affect performance.
- Keep test conditions consistent. Test the same destination on the same network so you do not mistake a network change for a protocol difference.
- Separate routing from protocol settings. Config chooses a policy based on rules; Proxy routes applicable test traffic through the proxy; Direct connects directly. Routing settings do not convert VMess to VLESS.
- Check domain access. If the server is reachable but domain access fails, check DNS and which rules are matching before re-entering the UUID.
- Set up automatic triggers only after manual testing. If you need On Demand, go to Settings → On Demand and check the conditions. Automatic connection cannot fix incorrect server settings.
Takeaway: keep the full configurations and compare connection results
Keep separate entries for VMess and VLESS, checking identity, transport, and TLS one by one, then test under the same conditions. If you have only one working configuration, get it working reliably before trying another protocol by guessing at the settings.