Trojan came later than VMess, but its idea is refreshingly direct: don't invent complex encryption — make proxy traffic identical to visiting an ordinary HTTPS website.

The core mechanism

A Trojan server is also a real web server. When a client connects, it completes a standard TLS handshake and then sends a password. Right password, and it forwards proxy traffic; wrong password, and the server treats you as a normal visitor and returns a real web page. To anyone probing it, the server is indistinguishable from any HTTPS site.

SponsoredWhere does the subscription link come from?Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click.Get high-speed nodes

Relationship to VLESS

The idea is very close — both lean on TLS for disguise and barely encrypt anything themselves. The difference: Trojan requires a real domain and certificate by design, whereas VLESS with REALITY needs no domain of your own. Functionally the two are interchangeable.

When it fits

If you already own a domain and are happy to set up a TLS certificate, Trojan is a solid choice — especially behind an Nginx reverse proxy with “fallback”, where the disguise is very natural. If you want the least fuss and hardest-to-detect setup, use VLESS + REALITY.

Trojan depends on a valid TLS certificate. An expired certificate causes connection failures or warnings, so schedule auto-renewal (e.g. acme.sh).