VMess vs VLESS comes down to one design choice. VMess encrypts your traffic itself with a built-in cipher, while VLESS has no encryption of its own and relies on TLS or REALITY underneath. That makes VLESS lighter and gives it newer features, such as REALITY and the Vision flow. For a new server, VLESS is usually the better choice; an existing VMess server with TLS still works fine.

Here’s how the two compare in detail.

Where they come from

VMess is the original protocol of V2Ray (Project V), from around 2016. It was designed to be safe on its own, so it authenticates and encrypts every connection without needing TLS.

VLESS was proposed in 2020 in the V2Ray community as a lighter successor. Its development continued in Xray, which forked from V2Ray that year. Xray, V2Ray, sing-box and Mihomo all support both protocols, but new features arrive in VLESS. For the details of VLESS and REALITY, read What is VLESS REALITY?

VMess vs VLESS at a glance

VMess VLESS
Built-in encryption Yes: aes-128-gcm, chacha20-poly1305, auto or none No (optional VLESS Encryption in Xray)
User ID UUID UUID, or text that Xray turns into one
Needs TLS to be private No, but recommended Yes, or REALITY
Depends on clock time Yes No
alterId Yes; use 0 No
REALITY No Yes
Vision flow No Yes
XHTTP transport Not in Potatso Yes
WebSocket, gRPC, HTTP Upgrade, HTTP/2 Yes Yes
Certificate pinning, ECH (in Potatso) No Yes
UDP Yes, off by default in Potatso Yes, off by default in Potatso
Overhead with TLS Encrypts twice Encrypts once

The rows marked “in Potatso” describe what Potatso supports; the VMess and VLESS reference pages list every setting.

Encryption: a cipher vs TLS

VMess encrypts each connection with a cipher you choose on the server:

  • aes-128-gcm is fast on any Apple device, which runs AES in hardware.
  • chacha20-poly1305 is a good choice on devices without AES hardware.
  • auto lets the client pick. Potatso picks aes-128-gcm.
  • none turns off VMess’s encryption. Use it only with TLS, which then encrypts the connection.

VLESS skips this layer. A VLESS connection is only as private as what’s under it, so it’s nearly always used with TLS or REALITY. Without either, VLESS sends your traffic in the clear.

So VMess over TLS encrypts your data twice: once by VMess, once by TLS. That’s safe but wasteful. VLESS over TLS does it once.

Note on VLESS Encryption. In 2025 Xray added VLESS Encryption, an optional post-quantum encryption layer for VLESS. It’s still new and most servers don’t use it. Potatso supports it when it comes in a link or subscription.

alterId and authentication

VMess’s original authentication used an MD5-based scheme, and a setting called alterId controlled it. In 2020 V2Ray introduced AEAD authentication, used when alterId is 0, and servers deprecated the old scheme in 2022.

  • If your provider gives you an alterId, use 0 where you can.
  • Potatso always uses AEAD authentication. Servers whose user still has an alterId above 0 accept it too, so nothing needs to change on the server.

VMess also checks timestamps, so your device’s clock must be close to the server’s. iPhones set their time automatically, so this rarely matters, but a server with a wrong clock refuses every VMess client.

VLESS has no alterId and no time check. It sends the user ID and lets TLS or REALITY do the rest.

Transports

Both protocols run over the same family of transports:

  • TCP with no transport, directly or with TLS.
  • WebSocket, HTTP Upgrade and gRPC, often used to go through a CDN.
  • HTTP/2, which Xray has since replaced with XHTTP.

XHTTP, Xray’s newest HTTP-based transport, is where they differ in Potatso: it works with VLESS but not yet with VMess. mKCP and QUIC aren’t supported for either.

REALITY and Vision: VLESS only

The biggest reason to choose VLESS today is what’s built on top of it:

  • REALITY lets a server borrow a real website’s TLS handshake, so it needs no domain or certificate of its own, and unknown visitors see that website. VMess can’t use REALITY.
  • Vision (xtls-rprx-vision) pads the TLS handshakes you make through the proxy so the “TLS inside TLS” pattern is harder to spot.

If you want either, you need VLESS. See How to set up VLESS REALITY on iPhone for the client side.

Speed and limits

VLESS avoids VMess’s extra encryption, so it uses a little less CPU and adds slightly less overhead. On a phone you’re unlikely to feel it: the server’s distance, load and network path matter far more.

One practical limit applies to VMess in Potatso: a single VMess connection uploads about 1 GiB, after which Potatso closes it rather than weaken the encryption. Downloads have no limit. For very large single uploads, use VLESS or Trojan.

Traffic patterns

Both protocols are encrypted when set up well, but encryption doesn’t hide everything. VMess without TLS has its own recognizable shape. Potatso doesn’t use VMess’s chunk masking or padding options, so the size pattern of VMess traffic is easier to recognize without TLS around it. VLESS over TLS, and especially over REALITY with Vision, looks more like ordinary HTTPS. Neither is undetectable.

Which should you choose?

Choose VLESS if:

  • you’re setting up a new server,
  • you want REALITY, so you don’t need a domain or certificate,
  • you want Vision, XHTTP or certificate pinning.

Keep VMess if:

  • your provider only offers VMess, or you already run a VMess server that works,
  • it uses TLS, or WebSocket over TLS through a CDN.

Avoid:

  • VMess with an alterId above 0 on a new server,
  • VMess with the none or zero cipher and no TLS,
  • VLESS without TLS, REALITY or VLESS Encryption.

If you’re weighing more than these two, Proxy protocols compared puts VLESS and VMess next to Trojan, Shadowsocks, Hysteria 2 and AnyTLS.

Using VMess or VLESS on iPhone

Potatso imports both from share links, QR codes, and Clash, V2Ray or Xray subscriptions. For VMess, it also reads Surge configurations. The steps are the same as for any server:

  1. Install Potatso from the App Store.
  2. Paste your vmess:// or vless:// link, scan its QR code, or import your subscription.
  3. Turn on UDP Relay in the server’s settings if your server relays UDP.
  4. Allow the VPN and connect from Home.

For a full walkthrough with REALITY fields and common errors, follow How to set up VLESS REALITY on iPhone. If you have a subscription with many servers, see how to import a Clash subscription on iPhone.

Frequently asked questions

What is the difference between VMess and VLESS?
VMess encrypts your traffic itself with a cipher such as aes-128-gcm. VLESS has no built-in encryption and relies on TLS or REALITY underneath, which makes it lighter and lets it use newer features such as REALITY and the Vision flow.
Is VLESS faster than VMess?
Usually a little, because VLESS over TLS encrypts your traffic once while VMess over TLS encrypts it twice. On a phone the difference is often small; the server's distance and load matter far more.
Is VLESS safe without TLS?
No. Plain VLESS sends your traffic unencrypted. Always use it with TLS or REALITY, or with Xray's VLESS Encryption.
What alterId should I use for VMess?
Use 0. alterId 0 means the current AEAD authentication. Values above 0 belong to the old MD5 authentication that servers deprecated in 2022, and Potatso always uses AEAD, which those servers accept too.
Can VMess use REALITY?
No. REALITY works with VLESS (and Trojan in some servers), not VMess. If you want REALITY, set up a VLESS server.

Also available in: 简体中文 · 繁體中文 · 日本語 · Русский