What is VLESS — and how to read a VLESS key
VLESS and REALITY in plain English, a breakdown of every part of a vless:// key, where to get one and which apps to use.
Updated October 6, 2026 · Vetryx team
What VLESS is
VLESS is a data transfer protocol from the Xray project. It's deliberately minimal: it does almost no encryption or disguise on its own. That job goes to the transport layer — TLS or REALITY. The result is a fast, lightweight protocol that pairs well with different kinds of camouflage. VLESS traffic can ride over plain TCP, XHTTP, WebSocket or gRPC.
What REALITY is
REALITY is a camouflage layer for VLESS. To an outside observer — say, your ISP's filtering equipment — the connection looks like an ordinary HTTPS visit to a popular website. If someone probes the server, they get the real website's response. A REALITY server needs no domain or certificate of its own, which makes servers easy to launch and replace. That's why VLESS + REALITY became the go-to setup in countries that block VPNs.
Anatomy of a VLESS key
A VLESS key is a single line with all the server settings. For example (made-up values):
vless://1b2c…[email protected]:443?encryption=none&security=reality&sni=www.example.com&fp=chrome&pbk=Xy…&sid=6ba8&type=tcp&flow=xtls-rprx-vision#Netherlands
| Part | Meaning |
|---|---|
| UUID before @ | Your personal ID — treat it like a password. |
| address and :443 | Server address and port. 443 is the standard HTTPS port, so the traffic looks familiar. |
| encryption=none | Normal: VLESS itself doesn't encrypt — TLS or REALITY does. Newer Xray versions add optional VLESS encryption, but most keys use none. |
| security= | reality or tls. none means no protection at all. |
| sni= | The website name the connection imitates. For REALITY, it's someone else's popular site. |
| fp= | Which browser's fingerprint to mimic: chrome, firefox, safari. |
| pbk=, sid= | REALITY public key and short ID — how the client recognizes the right server. |
| type= | Transport: tcp, xhttp, ws, grpc. |
| flow=xtls-rprx-vision | Vision mode: better camouflage and speed for TCP with REALITY or TLS. |
| #Netherlands | The label you see in the app. |
You don't need to edit these by hand. Server and client config examples with comments are in our vless-reality-guide repository on GitHub.
Where to get a key
- A VPN subscription — a link to a list of keys the service keeps up to date. The most convenient option.
- A single key — one server. When it's blocked, you need a new one.
- Free public keys — short-lived, slow, and you don't know who runs the server.
- Your own server — rent a VPS and set up VLESS + REALITY yourself, if you're comfortable maintaining it.
Which apps to use
On every platform there are free clients that accept VLESS keys and subscriptions — see VLESS clients for Windows, macOS, iOS, Android and Linux. Adding a key works the same everywhere: copy → + → paste from clipboard.
Why VLESS stops working
- The server was blocked. Update your subscription and try another server.
- The method was blocked. Try another transport or protocol — XHTTP or Hysteria2. See VPN protocols compared.
- Mobile whitelists (in Russia): regular servers are unreachable on any protocol. See VPN and mobile whitelists in Russia.
- Outdated app — update it.
VLESS + REALITY with zero setup. A Vetryx subscription includes servers on VLESS + REALITY, XHTTP, WebSocket and Hysteria2 in 10 countries, plus our own apps for Windows and Android. See pricing.
FAQ
What is VLESS in simple terms?
VLESS is a lightweight data transfer protocol from the Xray project. It does almost no encryption or disguise on its own — the transport layer (TLS or REALITY) does that work, which makes VLESS fast and flexible.
What is VLESS REALITY?
VLESS with REALITY camouflage: to an outside observer, the connection looks like a normal visit to a popular website over HTTPS. The server doesn't need its own domain or certificate.
Why does my VLESS key say encryption=none?
That's expected: encryption is handled by TLS or REALITY, set in the security parameter. The risky combination is security=none, which means the traffic isn't protected.
Where can I get a VLESS key?
From a VPN service. A subscription link is better than a single key, because the service updates the server list for you. Free public keys get blocked quickly and you don't know who runs the server.