This guide is for users who already have a provider and subscription and need to check VMess or VLESS settings. First, distinguish protocol authentication, protocol encryption, TLS, and transport. Then verify the address, port, UUID, server name, and transport parameters one by one. Simply changing the protocol name does not make a configuration work with the other protocol.
1. VMess and VLESS: Protocol Layer vs. Transport Layer
VMess and VLESS are two different proxy protocols in Shadowrocket. Both can use a UUID as a user identifier, but their request formats and authentication processes differ. The client must use the protocol configured on the server. Sharing an address, port, and UUID does not mean the server accepts both protocols.
VMess has its own authentication and data-encryption mechanisms. Its encryption options must be supported by both the server and the client. VLESS does not encrypt payloads at the protocol layer; deployments commonly pair it with a security layer such as TLS. In a VLESS configuration, encryption=none describes the protocol layer—it does not mean the entire connection is necessarily sent in plaintext.
| Check | VMess | VLESS |
|---|---|---|
| User identifier | Uses a UUID that must match the user record on the server. | Uses a UUID that must match the user record on the server. |
| Protocol-level payload encryption | Includes protocol-level encryption; do not copy encryption options from another node without checking. | The base protocol does not encrypt payloads; check the security layer separately. |
| TLS | Can be combined with TLS; protocol encryption does not mean certificate validation can be ignored. | TLS is commonly used, but the protocol name alone does not tell you whether TLS is enabled. |
| Common transports | Common combinations include TCP and WebSocket; settings must match the server. | Common combinations include TCP, WebSocket, and gRPC; settings must match the server. |
| When can they be switched? | A matching server endpoint and complete parameters are required. Changing the client Type alone is not enough. | |
A protocol name describes only one part of a connection. A complete configuration also includes the transport and security layers. For example, “VLESS + WebSocket + TLS” specifies the protocol, transport, and security layer. When a connection fails, check each layer instead of assuming the UUID is always the problem.
2. Checking a UUID: Correct Format Does Not Guarantee Authentication
A typical UUID is 36 characters long, with hexadecimal characters and hyphens arranged in five groups: 8-4-4-4-12. It identifies a user; it is not a server address or a label you can change at will. Generating a correctly formatted UUID will still fail authentication if the server has not registered it.
- Get the UUID from your existing subscription or original configuration details. Do not guess it from a label, domain, or order number.
- Check for spaces, line breaks, or non-ASCII punctuation before and after the copied value. Do not paste explanatory text into the user identifier field.
- If a subscription update changed the UUID, make sure you are editing the updated entry, not an older entry with the same name.
- When asking for help, hide the full UUID and subscription token. A UUID is still a connection credential, even though it is not a traditional password.
How to check: Verify the source after checking the format
If the UUID length and grouping are correct, do not keep changing characters at random. Check the original record and verify the protocol, address, port, and user identifier together. This helps prevent combining fields from two different configurations.
VMess authentication also depends on the time. A significantly incorrect device clock can cause authentication to fail even with the right UUID. Check the date and time on your iPhone or iPad, then try connecting again. Do not change the encryption method to compensate for an incorrect device clock.
3. What to Check for TLS, SNI, Host, and Path
TLS provides the connection's security layer, and SNI indicates the server name during the TLS handshake. WebSocket Host and Path are used later in the HTTP request. These values may share a domain or differ according to the server configuration. Do not substitute one for another just because they look like domain names.
- Address and Port: These specify where to connect. TLS does not require port
443. If the original configuration specifies8443, keep8443. - TLS and server name: Check whether TLS is enabled and whether the server name used for name validation and SNI matches the original configuration. If the address is an IP, do not assume that the server name should be the same IP.
- WebSocket Host: This is the hostname at the HTTP layer and may be used for reverse-proxy routing. A missing or incorrect value may let the request reach the server but prevent it from reaching the intended service.
- WebSocket Path: This usually starts with
/and must match the server path exactly. Case, trailing slashes, and query strings can all affect routing. - gRPC serviceName: This identifies a gRPC service. Pasting the WebSocket Path here does not make the configurations equivalent.
For example, if an existing record specifies the address edge.example.com, port 443, TLS server name tls.example.com, WebSocket Host ws.example.com, and Path /gateway, check each of these five values separately. These domain names and paths are examples to explain how the fields relate; they are not working connection settings.
4. Importing and Checking Settings in Shadowrocket
If you already have a subscription, keep its full set of settings intact and check individual entries as needed. Manual entry is appropriate only when you have all the original parameters. In Shadowrocket, Home is where you view and select connection entries, Config is for configuration files and rules, and Settings is for app preferences. Do not enter protocol authentication fields as rule lines in Config.
Keep the settings imported from your subscription
RecommendedIf you have an active subscription, check the protocol, port, TLS, and transport settings after importing it. Do not change the UUID or Type without a reason. First confirm that the original entry works, then adjust one setting at a time.
Best for: Existing subscriptions and fewer manual entry errors
Enter the complete configuration manually
Enter each parameter supplied by the server. If a field is missing, confirm its value rather than assuming a default. Note any changes you make after saving so you can restore the original settings.
Best for: Complete settings for one entry and troubleshooting a specific field
- Tap the add button in the upper-right corner of Home and choose the matching type under Type. To import an existing subscription, select Subscribe and enter your own subscription URL.
- After saving, return to Home, expand the subscription group, and open the entry you want to edit. First confirm whether its Type is VMess or VLESS.
- Check the address, port, and UUID in order, then verify TLS, the server name, and transport settings. Available fields vary by type; use the fields shown on the current screen.
- Save and return to Home, then select the entry you just checked. Confirm the current Global Routing mode, enable the connection, and make a new network request.
- Check the relevant entries again after a subscription update. Updates may overwrite local edits, so keep subscription entries separate from temporary test configurations.
Subscription URLs often contain tokens, so hide the full link before sharing screenshots or logs. This guide assumes you already have your own subscription; this site does not provide, sell, or recommend nodes or subscriptions.
5. Troubleshoot by Layer; Do Not Infer Speed from the Protocol
“The port is reachable,” “a latency value appears,” and “the destination website loads” are three different tests. A reachable port only shows that an endpoint responded; it does not confirm UUID authentication, TLS validation, or WebSocket routing. Use the observable symptoms below to guide your checks, but do not assume any one symptom has only one possible cause.
| What you observe | Check first | Next step |
|---|---|---|
| Connection timeout | Address, port, and reachability on the current network | Check the original port, then repeat the same request on another network you have access to. |
| Certificate or name validation error | Device clock, TLS server name, and certificate | Compare with the original settings; do not skip validation by default. |
| Disconnects immediately after connecting | Type, UUID, VMess encryption options, and time | Restore the original settings, then confirm the server endpoint matches. |
| WebSocket returns 404 or 400 | Host, Path, and reverse-proxy settings | Check the path's case and transport type. The status code alone does not indicate a UUID error. |
| Only some domains fail to load | DNS and rule matches | Confirm that the request is actually going through the selected entry. |
In Home → Global Routing, use Proxy to temporarily isolate the effect of rules. Direct does not test whether a proxy entry works; Config routes traffic according to its rules. If you are using Scene, also check the settings applied by that scene. Rules using DOMAIN-SUFFIX, IP-CIDR, GEOIP, and FINAL can send different requests through different policies. Restore your original mode when testing is complete so temporary troubleshooting settings are not left in place.
How to check: Confirm the request route before comparing connection behavior
To compare two existing configurations, keep the device, network, destination, and test method the same, and confirm that each request actually goes through the corresponding entry. Results can also vary with server location, congestion, and transport. They do not, by themselves, establish an inherent speed difference between VMess and VLESS.
6. Common Questions About UUIDs, Encryption, and Subscription Updates
Can I change a VMess Type to VLESS and keep using it?
Changing Type alone is not enough. Get the VLESS settings for an existing server endpoint, create a new entry, and check the address, port, UUID, security layer, and transport. Even if the server uses the same UUID for both, the other settings may differ.
If I see none in VLESS, does that mean nothing is encrypted?
First check which field it describes. Protocol-level encryption=none does not tell you whether TLS is enabled. Open the entry for editing and verify that TLS is enabled as intended and the server name is correct. Keep certificate validation enabled. The website's own HTTPS is a separate layer and does not replace checking the proxy's security layer.
An entry with the same name stopped connecting after a subscription update. Should I change the UUID first?
First, return to Home and check whether the selected entry belongs to the updated group. Then verify its Type, address, port, and transport settings. Once you have ruled out selecting an older entry, compare the UUID with your original subscription details. Do not generate a replacement at random.
One configuration works and another does not. Does that mean VLESS is always faster?
A single success or failure does not prove a protocol is faster. Repeat requests to the same destination, rule out differences in address, port, TLS, and transport, then note latency, disconnections, and when they occur. Results without controlled conditions apply only to that connection and cannot establish a protocol ranking.
7. Final Checks Before Saving
Choose the protocol that matches the server's existing configuration, not a preferred protocol name. For both VMess and VLESS, check endpoint reachability, identity settings, security layer, and transport, then check routing rules and the destination request. Change one setting at a time and keep the original configuration so you can identify which change affected the result.
- Type matches the server protocol; Address, Port, and UUID come from the same record.
- Enter VMess encryption settings as specified in the original record. Do not apply VMess encryption-field meanings to VLESS.
- Check TLS, server name, WebSocket Host and Path, or gRPC serviceName separately.
- The intended entry is selected in Home, and the Global Routing mode matches the purpose of the test.
- Hide UUIDs, subscription URLs, and other credentials before exporting a configuration or sharing troubleshooting details.