What is VLESS REALITY in simple terms?

It's a VLESS proxy server that uses REALITY instead of ordinary TLS. The server presents the TLS handshake of a real, unrelated website, so it needs no domain or certificate of its own, and only clients that know its public key and short ID get through to the proxy.

VLESS itself has no built-in encryption. It relies on the layer under it, TLS or REALITY, to encrypt your traffic. Xray's newer VLESS Encryption adds an optional encryption layer of its own, but most servers still use TLS or REALITY.

What is xtls-rprx-vision?

It's the Vision flow, a setting for VLESS over TLS or REALITY with no extra transport. It pads the start of the TLS connections you open through the proxy, so the TLS-inside-TLS pattern of proxied HTTPS traffic is harder to recognize.

Is VLESS REALITY undetectable?

No protocol is undetectable. REALITY makes a server much harder to identify by probing it, because unknown visitors see a real website, but traffic analysis and other signals, such as an IP address that doesn't belong to the borrowed site, can still give it away.

Can I use VLESS REALITY on iPhone?

Yes. You need a client app that supports REALITY. Potatso, a free proxy client for iPhone and iPad, imports vless:// links with REALITY and Vision and connects to Xray and sing-box servers.

What Is VLESS REALITY? VLESS, Vision and REALITY Explained

VLESS REALITY is a VLESS proxy server that hides behind another website’s TLS handshake. VLESS is a lightweight proxy protocol from the Xray project, and REALITY replaces its usual TLS layer: the server answers like a real, unrelated website, so it needs no domain or certificate of its own, and only clients holding its public key and short ID reach the proxy. It’s usually paired with the Vision flow (xtls-rprx-vision).

This guide explains each piece, how they fit together, and where they fall short.

What is VLESS?

VLESS is a stateless proxy protocol. Each connection starts with a short header: a version, the user ID (a UUID), the command (TCP or UDP) and the destination. Then your data follows.

That’s almost all there is to it. VLESS has no built-in encryption. Its predecessor, VMess, encrypts every packet itself; VLESS leaves that to the layer underneath, normally TLS or REALITY. Not encrypting twice saves work on your phone and on the server.

VLESS was proposed in 2020 in the V2Ray community, and it’s developed today in Xray. sing-box and Mihomo also support it. For a side-by-side look at the two protocols, read VMess vs VLESS.

Transports

VLESS can run directly over TCP, or inside a transport that carries the connection:

WebSocket, HTTP Upgrade and gRPC, often used to pass through a CDN.
XHTTP (formerly SplitHTTP), Xray’s HTTP-based transport, which replaced HTTP/2 and QUIC in Xray.

REALITY is used with no transport, gRPC or XHTTP.

What is XTLS Vision?

When you open an HTTPS site through a TLS proxy, your browser’s TLS connection travels inside the proxy’s TLS connection. This “TLS inside TLS” has a recognizable shape: the sizes and timing of the inner handshake show through the outer encryption.

The Vision flow (xtls-rprx-vision) addresses this. It pads the first packets of the inner TLS handshake so their sizes are less telling. Once the inner connection is encrypted, Vision can pass its data through without encrypting it a second time.

Vision needs VLESS with no transport and TLS or REALITY. A variant, xtls-rprx-vision-udp443, also allows UDP to port 443 (QUIC). The older XTLS flows, such as xtls-rprx-direct, were removed from Xray.

What is REALITY?

A normal TLS proxy needs a domain name and a certificate. That’s work to set up, and a server whose domain and website look thin can stand out.

REALITY, added to Xray in 2023, takes a different approach. The server is set up with a target: a real website it borrows from, such as www.example.com. Then:

Your client starts a TLS 1.3 handshake with the target’s name as its SNI, shaped like a real browser’s handshake.
Hidden inside that handshake is a value only a client with the server’s public key and a valid short ID can produce.
If the value checks out, the server completes the handshake itself, and your client verifies it with the same shared key. The VLESS connection runs inside.
If it doesn’t, for example because someone is probing the server, the server forwards the connection to the real target. The visitor gets the real site and its real certificate.

So the server never needs a certificate of its own, and a probe sees an ordinary website.

Public key, short ID, SNI and fingerprint

A REALITY server gives you four settings. All of them must match the server.

Setting	Link parameter	What it is
Public key	`pbk`	The server’s X25519 public key, a 43-character Base64 string. The private half stays on the server.
Short ID	`sid`	A short hex string, up to 16 characters, that the server accepts. Servers can list several, one per user or device.
Server name (SNI)	`sni`	The website the server borrows from. It must be one of the names the server allows.
Fingerprint	`fp`	Which browser’s TLS handshake to imitate, such as `chrome`, `firefox` or `safari`.

The fingerprint matters because a TLS library’s handshake looks different from a browser’s. Imitating a browser keeps the handshake in line with the site the server pretends to be.

VLESS Encryption

In 2025 Xray added VLESS Encryption, an optional encryption layer of VLESS’s own. It uses a post-quantum key exchange (ML-KEM-768 with X25519), and its client value starts with mlkem768x25519plus. It can run without TLS, or on top of TLS, including with Vision.

It’s still new, and most servers you’ll meet use TLS or REALITY with encryption=none. Potatso keeps the setting when you import a link, subscription or Xray configuration. See the VLESS reference for the supported modes.

Strengths and weaknesses

Strengths:

No domain or certificate needed. REALITY borrows a real site’s handshake.
Resists active probing. Clients without the key are passed through to the real website.
Lightweight. VLESS adds almost no overhead, and Vision avoids double encryption.
Flexible. The same protocol runs over raw TCP, WebSocket, gRPC or XHTTP, with TLS or REALITY.

Weaknesses:

Harder to detect, not undetectable. Traffic patterns can still be analyzed. And a server whose IP address clearly isn’t the borrowed site’s can look out of place.
Choosing a target takes care. It must support TLS 1.3, and a poor choice can make the server stand out or stop working.
No CDN with REALITY. A REALITY server must be reached directly, unlike WebSocket over TLS.
Settings must match exactly. A wrong public key, short ID or SNI looks like a timeout or a normal website, with no clear error.
UDP needs a setting. Many clients, Potatso included, keep UDP off for VLESS until you turn it on.

How VLESS REALITY compares

	VLESS + REALITY	VLESS + TLS	Trojan	VMess	Hysteria 2
Encryption	REALITY (TLS 1.3)	TLS	TLS	Built-in cipher, optionally TLS	TLS 1.3 in QUIC
Needs a domain and certificate	No	Yes	Yes	Only with TLS	Yes, or a pinned self-signed one
Works through a CDN	No	Yes, with WebSocket, gRPC, XHTTP	Yes, with WebSocket or gRPC	Yes, with WebSocket or gRPC	No
Runs over	TCP	TCP	TCP	TCP	UDP (QUIC)
Answer to probes	The borrowed site	Your own site, if set up	A fallback site, if set up	Depends on setup	A masquerade site, if set up

For the bigger picture, see Proxy protocols compared, or read about Trojan and Hysteria 2.

What a VLESS REALITY link looks like

Providers usually hand you a vless:// link. Here’s one with REALITY and Vision, borrowing www.example.com:

vless://3971e1b2-18a3-4f83-8fa6-bf9b142ee258@vless.example.com:443?security=reality&sni=www.example.com&fp=chrome&pbk=Z84J2IelR9ch3k8VtlVhhs5ycBUlXA7wHBWcBrjqnAw&sid=0123abcd&type=tcp&flow=xtls-rprx-vision#REALITY-Vision

Reading it from the left:

3971e1b2-… is your user ID.
vless.example.com:443 is the server and port.
security=reality turns on REALITY.
sni=www.example.com is the borrowed site.
fp=chrome is the fingerprint.
pbk and sid are the public key and short ID.
type=tcp means no transport, and flow=xtls-rprx-vision turns on Vision.
#REALITY-Vision is the server’s name in your app.

A link with ordinary TLS instead has security=tls and no pbk or sid. Every parameter is listed in the VLESS reference.

Use VLESS REALITY on iPhone

Potatso is a free proxy client for iPhone and iPad that supports VLESS with REALITY, Vision, XHTTP and VLESS Encryption, tested against Xray and sing-box servers. Follow How to set up VLESS REALITY on iPhone to import your link and connect in a few minutes.

Frequently asked questions

What is VLESS REALITY in simple terms?: It's a VLESS proxy server that uses REALITY instead of ordinary TLS. The server presents the TLS handshake of a real, unrelated website, so it needs no domain or certificate of its own, and only clients that know its public key and short ID get through to the proxy.
Is VLESS encrypted?: VLESS itself has no built-in encryption. It relies on the layer under it, TLS or REALITY, to encrypt your traffic. Xray's newer VLESS Encryption adds an optional encryption layer of its own, but most servers still use TLS or REALITY.
What is xtls-rprx-vision?: It's the Vision flow, a setting for VLESS over TLS or REALITY with no extra transport. It pads the start of the TLS connections you open through the proxy, so the TLS-inside-TLS pattern of proxied HTTPS traffic is harder to recognize.
Is VLESS REALITY undetectable?: No protocol is undetectable. REALITY makes a server much harder to identify by probing it, because unknown visitors see a real website, but traffic analysis and other signals, such as an IP address that doesn't belong to the borrowed site, can still give it away.
Can I use VLESS REALITY on iPhone?: Yes. You need a client app that supports REALITY. Potatso, a free proxy client for iPhone and iPad, imports vless:// links with REALITY and Vision and connects to Xray and sing-box servers.

Also available in: 简体中文 · 繁體中文 · 日本語 · Русский