When you visit an HTTPS site in a browser, the data is already TLS-encrypted. If the proxy then wraps it in another TLS layer, you get “TLS-in-TLS” — two rounds of encryption, wasting CPU and potentially creating detectable packet-length patterns.

The XTLS idea

XTLS detects whether the inner traffic is already TLS. If it is, it skips re-encrypting and passes the already-encrypted data straight through, handling only what's necessary. That removes an entire encryption layer.

SponsoredWhere does the subscription link come from?Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click.Get high-speed nodes

What Vision is

Vision (written flow: xtls-rprx-vision in config) is the recommended XTLS flow control today, replacing the earlier direct / splice modes. It lowers CPU use and also mitigates the TLS-in-TLS fingerprinting problem.

How to use it

On a VLESS node, set flow to xtls-rprx-vision, with plain TLS or REALITY as the outer layer. VMess does not support this flow control.

The flow value must match exactly on client and server; set on one side but not the other, the handshake fails outright.