VMess and VLESS cannot be converted simply by changing Type. Both commonly use a UUID for user identification, but their protocol-level encryption differs, and either may use TLS and WebSocket as the transport layer. This guide is for users who already have provider parameters or a subscription. Check fields in order—protocol, authentication, transport, then TLS—and use Global Routing to distinguish connection issues from rule-related issues. Get subscriptions and nodes from your provider.
1. Know the difference between VMess, VLESS, TLS, and transport
In Shadowrocket, VMess and VLESS are two different proxy protocols, not speed settings for the same connection. The client’s Type must match the protocol configured on the server. Even if the server address, port, and UUID are identical, changing VMess to VLESS alone will not make the server accept the other protocol.
Think of the parameters as separate layers. VMess or VLESS defines the proxy protocol and authentication format; TCP, WebSocket, and similar options determine how the connection is carried; TLS encrypts the connection and verifies the server’s identity. WebSocket is not encryption, and using port 443 does not mean TLS is enabled.
For example, “VLESS + WebSocket + TLS” means VLESS handles proxy requests, WebSocket carries the connection, and TLS protects the connection to the relevant TLS termination point. Each term describes a different layer; one cannot replace another.
2. Encryption and UUIDs: VLESS with none does not mean the whole connection is unprotected
VMess supports protocol-level data encryption. AEAD-based VMess implementations also authenticate the relevant protocol data; the encryption method must be compatible with the server. Options such as auto in the client relate to VMess encryption and should not be treated as VLESS configuration requirements.
VLESS does not provide the same protocol-level data encryption as VMess. In common parameters, encryption=none refers to this layer. If TLS is configured correctly around it, the connection can still receive TLS transport protection. So “VLESS has no built-in data encryption” does not mean “a VLESS connection is always in plaintext.” Do not disable TLS if your provider requires it.
| Item to check | VMess | VLESS |
|---|---|---|
| User credentials | Usually a UUID that must match the user configuration on the server. | Usually a UUID that must match the user configuration on the server. |
| Protocol-level data encryption | Supports protocol-level encryption; choose a setting compatible with the server. | Does not provide encryption at this layer; the common encryption value is none. |
| Outer TLS | Can be used with TLS; the protocol name does not determine whether TLS is enabled. | Can be used with TLS; do not disable TLS just because the value is none. |
| AlterId | A legacy compatibility parameter; modern AEAD VMess typically uses 0. Do not change it to a nonzero value without a reason. | VMess AlterId is not used; do not copy it over. |
| Time checks | Authentication involves time, so a significant device clock offset can cause failures. | Does not use VMess’s time-based authentication, but TLS certificate validity checks still depend on the correct time. |
A UUID is an authentication credential, not a server domain or subscription URL. The fact that both protocols use UUIDs in the same format does not mean an account works with either one. Copy it exactly, without quotation marks, spaces, or line breaks. When sharing diagnostic information, hide your UUID, subscription token, and other credentials.
3. Shadowrocket fields: check the shared settings, then the differences
When adding or editing a node in Home, check Type first, then fill in each field. If you already have a subscription, use the import data from your provider to avoid losing extra parameters during manual entry. The table below explains what each field means. Options may vary by Type; follow the current interface and your provider’s instructions.
| Field or parameter | What to enter | Common mistake |
|---|---|---|
| Type | Select VMess or VLESS explicitly. | Guessing the protocol from the node name. Names are customizable and are not a reliable guide. |
| Server address | The domain name or IP address provided by your service provider. | Pasting the full subscription URL into the address field or adding https:// by mistake. |
| Port | Enter the port number provided by your service provider, such as 443. | Assuming TLS only works on port 443 and replacing the actual port. |
| UUID | Copy the value exactly, character for character. | Using the node label as the account name or missing a character when copying. |
| Transport settings | Choose the matching option, such as TCP or WebSocket, based on the provided parameters. | Assuming both protocols must use WebSocket. |
| TLS / SNI | Check the toggle, server name, and certificate requirements. | Copying the connection address into SNI without checking the domain specified by your provider. |
| WebSocket Host / Path | When WebSocket is enabled, enter the values required by the server. | Omitting the leading / from Path or treating Host and SNI as the same field. |
The server address tells the client where to connect. SNI provides the server name during the TLS handshake and relates to certificate verification settings. WebSocket Host is the host information in the HTTP request. These values may be the same, but they serve different purposes. If your provider gives them separately, keep each value as specified rather than changing them just to make them match.
- Keep a copy of the original parameters, then verify Type, address, Port, and UUID.
- Check the transport method next. Configure Host and Path only when using WebSocket.
- Finally, check TLS, SNI, and any other provider requirements. Do not treat disabling certificate verification as the default fix.
- After saving, return to Home, select the node, and test an actual request. Change one setting at a time so you can identify the cause.
4. Importing a subscription vs. manual entry: two ways to check your settings
A subscription is a way to provide or update node information; it is not VMess or VLESS itself. One subscription can include multiple protocols, and node addresses, ports, or transport parameters may change after an update. A successful import only means the client read the data; it does not guarantee that the credentials are still valid or the server is currently available.
A practical approach: keep the original parameters and avoid repeated manual edits
If you have a subscription
- Get the subscription from your provider, add it through the subscription option in Home, and update it.
- Expand the imported results and check that Type, address, and port match your provider’s instructions.
- Record any manual changes before updating; an update may rebuild or overwrite node fields.
If you only have parameters for one node
- In Home, add a node and select the correct Type first.
- Enter the UUID, transport, and TLS parameters using the field table. Do not mix settings specific to the two protocols.
- Keep the original details and compare each field if parameters change instead of repeatedly guessing which toggles to use.
Both methods rely on the server configuration. Subscription access, node credentials, and app purchase records are managed separately.
Subscription URLs often contain authentication details. The example URL https://example.com/sub?token=xxxx illustrates the format only and cannot be used for import. Keep your real URL out of public screenshots, chat logs, and logs. If a subscription update fails, first determine whether the URL has expired, the request cannot reach the server, or the response cannot be parsed; then check with your provider.
5. Test the connection: distinguish node configuration errors from Global Routing choices
Use Home to select a node and connect, Config to manage configuration files and rules, and Settings for app settings. Correctly entering a node’s protocol does not mean every request will use that node. Global Routing determines how traffic is handled, while the active rules under Config also affect the result.
Config
RecommendedUse the current configuration rules to choose how traffic is handled. Requests that do not match earlier rules typically go to FINAL. Whether they connect directly depends on the configuration; it is not always true that “everything else goes direct.”
Best for: everyday use with verified rules and different handling based on the destination.
Proxy
Send traffic through the proxy route to temporarily rule out destination-based matching. When testing, also check the selected node and any applicable exclusions.
Best for: checking whether the selected node can complete a request to the same website.
Direct
Use the direct route. If a website opens in this mode, that does not prove the VMess or VLESS node you entered is working.
Best for: checking whether the same destination is directly accessible on your local network.
If you use Scene, check its settings too; do not infer the current route from the node selected last time. During troubleshooting, keep the network and test destination fixed, note the original mode, switch temporarily for testing, then restore the original settings. On Demand manages connections based on conditions; it will not fix a UUID, SNI, or WebSocket Path for you.
- Direct works, but Proxy fails: Check the selected node, server reachability, and authentication parameters before changing rules.
- Proxy works, but Config fails: Check which policies DOMAIN-SUFFIX, GEOIP, IP-CIDR, and FINAL point to in the active configuration. Use request logs to determine which rule actually matched.
- Connection times out: First check the address, port, and current network. A timeout alone does not prove the UUID is wrong.
- TLS or certificate error: Check the device time, SNI, certificate name, and TLS settings. Do not treat skipping verification as a routine fix.
6. Common questions: speed, protocol changes, and issues after import
Is VLESS always faster than VMess?
You cannot tell from the protocol name alone. Keep the network, approximate test time, and destination consistent; record whether requests complete and their latency, then check the server route, congestion, and outer transport. If the nodes use different servers, the difference cannot be attributed entirely to the protocol. VLESS having no built-in data encryption also does not mean it will deliver higher throughput in every situation.
Can I change Type from VMess to VLESS directly?
No. Get the corresponding VLESS parameters from your provider, then add a separate node in Home and check its settings. The server must be configured for the matching protocol; using the same UUID does not replace server support. Keep the original VMess node for comparison.
The UUID and port are correct. Why won’t WebSocket connect?
Check the transport method, Host, Path, TLS, and SNI. For example, if the server requires the Path /connect, entering connect or / is not equivalent. If you get an HTTP status error, check the reverse proxy entry point against your provider’s instructions rather than cycling through random domains. /connect is an example path, not a universal value.
What should I do if a previously working node fails after a subscription update?
First, confirm the currently selected node in Home. Then compare its updated Type, address, and transport parameters, and check whether the update overwrote any manual changes. If the returned data is missing a required field, keep a description of the error with credentials redacted and check with your provider. Do not guess the UUID or TLS settings.
7. Verify the app source and service scope
Shadowrocket is a closed-source commercial app, and the App Store is its only purchase and installation channel. It is sold as a one-time purchase. To verify the app, check the official icon, developer Shadow Launch Technology Limited, and app ID 932747118. It is primarily used on iPhone and iPad. Check the App Store page for system requirements, pricing, compatibility, and purchase availability.