To set up VLESS REALITY on iPhone, install a client app that supports REALITY, such as Potatso, and import the vless:// link, QR code or subscription your provider gave you. Then allow the VPN configuration and connect. This guide walks through each step, including how to enter the public key, short ID and Vision flow by hand.

Want to know what REALITY actually does? Read What is VLESS REALITY? first.

What you need

  • An iPhone or iPad with iOS 17 or later.
  • A VLESS server. Your provider gives you one of these:
    • a vless:// link,
    • a QR code of that link,
    • a subscription URL, usually a Clash or V2Ray subscription, or
    • the raw settings: address, port, user ID, and the REALITY public key, short ID and server name.

A typical VLESS REALITY link looks like this:

vless://3971e1b2-18a3-4f83-8fa6-bf9b142ee258@vless.example.com:443?security=reality&sni=www.example.com&fp=chrome&pbk=Z84J2IelR9ch3k8VtlVhhs5ycBUlXA7wHBWcBrjqnAw&sid=0123abcd&type=tcp&flow=xtls-rprx-vision#REALITY-Vision

Keep it handy. If you enter the server by hand later, every value you need is in it.

Step 1: Install Potatso

Download Potatso from the App Store and open it. Tap Get Started, then type a name for your profile, such as “Personal”, and tap Continue. A profile holds your servers, rules and DNS settings.

The Potatso welcome screen with the Get Started button

Step 2: Add your VLESS REALITY server

The Add your servers step offers four ways in. Pick the one that matches what your provider gave you.

  1. Copy the vless:// link or the subscription URL.
  2. In Potatso, tap Paste a link, then Paste.

Potatso reads the transport, REALITY settings and flow from the link. Several links pasted at once are imported together. A subscription URL keeps updating after you import it. See how to import a Clash subscription on iPhone for subscriptions.

From a QR code

Tap Scan a QR code and point the camera at it. If the QR code is a screenshot in your photos, tap the photo button in the corner of the scanner and pick the picture.

By hand

Use the values from your provider, or read them out of the link: the part before @ is the user ID, pbk is the public key, sid is the short ID, and sni is the server name.

  1. Tap Enter a server manually.
  2. Enter a Name, and choose VLESS as the Protocol.
  3. Fill in Address and Port, such as vless.example.com and 443.
  4. Enter the User ID, for example 3971e1b2-18a3-4f83-8fa6-bf9b142ee258.
  5. Under Transport, keep TCP for a link with type=tcp. REALITY also works with gRPC and XHTTP, which ask for a path or service name.
  6. Turn on TLS. Open TLS Settings and set Server Name to the site the server borrows from, the sni value, such as www.example.com. Leave Skip Certificate Verification off: REALITY verifies the server with its key.
  7. Set Flow to Vision if your link has flow=xtls-rprx-vision, or Vision UDP 443 for xtls-rprx-vision-udp443. Otherwise keep None.
  8. Enter the Reality Public Key (pbk) and the Reality Short ID (sid).
  9. Enter the Reality Fingerprint (fp), such as chrome. If you leave it empty, Potatso uses chrome.
  10. If your server relays UDP, turn on UDP Relay. It’s off by default for VLESS.
  11. Tap Save (the checkmark).

For a VLESS server with ordinary TLS, leave the three Reality fields empty.

Once the server is in, the step changes to Servers added. Tap Continue.

Step 3: Choose a route

Potatso tests the latency of every server while you choose:

  • Global sends all traffic through the server you pick. It’s the simplest choice with a single server.
  • Rule lets your configuration’s rules decide what goes through the proxy and what connects directly. It’s offered when your import came with rules, as most Clash subscriptions do.

Pick your server and tap the button at the bottom, such as Use REALITY-Vision. You can switch modes later from Home; see Outbound modes.

Choosing an outbound server, with each server’s protocol and latency

Step 4: Allow the VPN and connect

Potatso sends your traffic through the proxy with a VPN configuration on your device, which iOS asks you to approve once.

  1. Tap Add VPN Configuration, then Allow when iOS asks.
  2. On Home, turn on the switch on the status card.

The status changes to Connecting…, then Connected, and a VPN icon appears in the status bar. Open a website to check that it loads.

Potatso’s Home screen while connected

If VLESS REALITY doesn’t connect on iPhone

A REALITY server that rejects a client doesn’t send an error. It hands the connection to the borrowed website. So a wrong setting usually looks like a timeout, or like the connection works but nothing loads. Check these first:

  • Wrong public key. pbk is a 43-character Base64 string. Copy it exactly. Don’t confuse it with the server’s private key, which you should never need.
  • Wrong short ID. sid must be one of the short IDs the server accepts. It’s hex, up to 16 characters. An empty short ID works only if the server allows one.
  • Wrong server name. sni must be one of the names in the server’s REALITY settings, not the server’s own address.
  • Flow doesn’t match. If the server’s user is set up with xtls-rprx-vision, set Flow to Vision. If it isn’t, keep None.
  • Vision with a transport. Vision works only with TCP and TLS or REALITY. Potatso won’t save a Vision server with WebSocket, gRPC or another transport.
  • Unsupported transport. mKCP, QUIC and TCP with HTTP header obfuscation aren’t supported. Potatso skips such servers at import and says why.
  • UDP doesn’t work (voice calls, some games). Turn on UDP Relay for the server.
  • XHTTP mode. Potatso uses stream-one. Links with mode=auto, or no mode, work. Links that ask for packet-up or stream-up aren’t imported.

All supported settings are in the VLESS reference. For problems that aren’t specific to VLESS, open Settings > Troubleshooting in Potatso, or see Troubleshooting.

Next steps

Frequently asked questions

How do I set up VLESS on iPhone?
Install a client app that supports VLESS, such as Potatso, then import the vless:// link, QR code or subscription URL your provider gave you. Allow the VPN configuration when iOS asks, and turn on the connection on the Home screen.
Where do I find the REALITY public key and short ID?
They're in your vless:// link as pbk (the public key) and sid (the short ID), or in your provider's setup page. If you run the server, the public key comes from xray x25519 and the short IDs are listed in the server's REALITY settings.
Which fingerprint should I use for VLESS REALITY?
Use the one your provider gives, usually chrome. REALITY needs a browser fingerprint, so Potatso uses chrome when your link doesn't set one.
Why doesn't UDP work with my VLESS server?
Potatso keeps UDP off for VLESS servers by default, as Clash does. Turn on UDP Relay in the server's settings if your server relays UDP, as Xray and sing-box servers do.
Do I need flow xtls-rprx-vision?
Only if your server's user is set up with it. The flow must match the server. Vision works only with no transport (TCP) and TLS or REALITY.

Also available in: 简体中文 · 繁體中文 · 日本語 · Русский