VLESS is the Xray team's “subtraction” from VMess. The less in the name is literal — strip out what isn't needed.

The key difference: no built-in encryption

VMess encrypts the payload itself; VLESS does no encryption of its own and carries no timestamp check. It hands encryption and authentication entirely to the outer TLS layer. Two benefits follow: no extra protocol signature to expose, and none of VMess's “clocks must be in sync” hassle.

SponsoredWhere does the subscription link come from?Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click.Get high-speed nodes

Why that is actually safer

“No encryption” sounds odd, but the point is that VLESS almost always runs inside TLS. A VLESS + TLS connection looks like a standard HTTPS request on the wire, and DPI struggles to tell it apart from normal browsing. Fewer signatures means harder to fingerprint.

The REALITY combination

VLESS truly took off after REALITY arrived. REALITY lets the server borrow the TLS handshake of a real major website, so you don't even need your own domain and certificate — another leap in blocking resistance. Most nodes built today use VLESS + Vision + REALITY.

VMess or VLESS? Performance is similar, but VLESS has fewer signatures and is simpler to configure. Prefer VLESS unless the server only supports VMess. See VLESS vs VMess.