Classic TLS disguise needs your own domain and certificate, and that certificate — registered by you — can be tied back to you. REALITY takes a different route and removes both.

How it disguises

REALITY makes your server “borrow” the certificate chain of a real, well-known website during the TLS handshake. To a censor, your traffic looks like ordinary HTTPS heading to that real site. Because it uses the target's genuine certificate, the fingerprint is nearly flawless.

SponsoredWhere does the subscription link come from?Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click.Get high-speed nodes

Doesn't active probing catch it?

This is the clever part: if someone actively connects to your port to probe it but lacks the correct key, the server transparently forwards that connection to the real site it borrowed. The prober sees that site's genuine content and can't tell it's a proxy server.

Key parameters

  • dest / serverName: the borrowed target — pick a major site that supports TLS 1.3 + HTTP/2, is directly reachable from your server, and isn't blocked.
  • publicKey / privateKey: a key pair; the client uses the public key.
  • shortId: an optional short identifier.
REALITY only works on the Xray core, not v2ray-core. Both server and client must be Xray.