This guide is for users who already have connection details from a provider and need to check a VMess or VLESS configuration in Shadowrocket. Start by distinguishing the protocol, credentials, and transport layer, then check UUID, alterId, flow, and TLS. If the connection fails, troubleshoot the address and port, authentication, transport, and routing in that order. Don't assume speed or reliability based on the protocol name alone.
VMess vs. VLESS: Protocol Layer and Transport Layer
VMess and VLESS both require the client and server to use matching protocol settings. Both commonly use a UUID as the user credential, but their message formats and authentication methods differ. Changing the type in Add Server from VMess to VLESS does not complete a migration; the server must also provide a matching configuration.
VMess has a protocol-level data encryption mechanism, with the specific method depending on the configuration on both ends. VLESS does not encrypt payloads by itself; its security must be considered alongside outer protections such as TLS. So if you see none for VLESS encryption, that doesn't mean the entire connection is unencrypted. Likewise, using VMess doesn't mean you can skip verifying the server's identity.
| Check | VMess | VLESS |
|---|---|---|
| Credentials | Usually a UUID; it must match the user configuration on the server. | Usually a UUID; sharing a UUID with VMess does not mean the configurations are interchangeable. |
| Protocol-level encryption | Has a configurable data encryption mechanism, which is separate from outer TLS. | Does not encrypt payloads; common configurations use none for encryption. |
alterId | A legacy compatibility field; modern VMess AEAD configurations typically use 0. | This field is not used. |
flow | VLESS does not use this type of flow parameter. | Used with some configurations, such as xtls-rprx-vision; must match the server. |
| Outer configuration | Check the actual TCP, WebSocket, TLS, and other settings. | The transport method and outer security settings also need to match. |
A protocol name describes just one layer of the connection stack. A complete connection also includes the server address, listening port, transport method, and security layer. Even if two configurations both say VLESS, you can't copy fields between them if they use different transport methods or server names.
UUID and alterId: Don't Guess at Authentication Details
A UUID identifies a user authorized by the server. It is not the server address or an access token in a subscription URL. When copying it, check for extra spaces, line breaks, or quotation marks. A correctly formatted UUID still won't authenticate if the server has no matching user.
alterId is a legacy VMess configuration concept. It does not mean the number of backup servers, and a higher value does not make a connection more secure. Modern VMess AEAD configurations typically use 0; nonzero values in older documentation may not apply to current servers. If your existing settings still have a nonzero value, ask the configuration provider about compatibility instead of trying different numbers.
VMess authentication is also time-sensitive. If authentication suddenly starts failing, check Settings → General → Date & Time on your iPhone or iPad and make sure the time and time zone are correct. Correcting the clock is one troubleshooting step, not a substitute for checking the UUID, server status, and protocol type.
Bottom line: Verify where the credentials came from, then check their format
Use the same valid configuration as your reference. If the UUID or alterId doesn't match, reimport the configuration or verify the original settings first. A correctly formatted value does not guarantee valid authentication.
flow and TLS: Check the Flow Parameter and Server Identity Separately
flow is a flow parameter used with some VLESS configurations, not a speed setting. The common value xtls-rprx-vision requires client support and must be compatible with the server's transport and security settings. Don't enter it just because the option appears in the app; use it only if the server requires it.
TLS encrypts the outer connection and verifies the server's identity. The connection address may be a domain name or an IP address; the server name used by TLS usually participates in SNI and certificate verification. The connection address, TLS server name, and WebSocket Host may match, or they may differ depending on the server setup. Check each one against the provided settings.
- First, check whether TLS is enabled: If the server requires TLS, the client must not connect as if the connection were plain text. Conversely, don't enable TLS on a port that isn't configured for it.
- Next, check the server name: The certificate must cover the name required by the configuration. Connecting by IP does not mean you should change the server name to that IP.
- Check the transport settings: If you use WebSocket, Host and path must match. The example path
/example-wsonly illustrates the field; it is not a value to use for a real connection. - Finally, check flow: Use only the value explicitly provided by the server. Don't copy flow from another VLESS configuration.
Add Server Checklist: Verify One Set of Settings at a Time
In Shadowrocket, go to Add Server from the Home screen. Select the protocol that matches your existing settings, then enter the fields. Available options depend on the protocol and selected transport. The order below is for checking settings; not every field will appear on the same screen.
- Address and port: Enter the original server address and listening port. For example,
example.com:443is illustrative only; don't change the port to443just because TLS is enabled. - Protocol and credentials: Confirm whether the configuration uses VMess or VLESS, then enter the UUID. For VMess, also check the encryption option and alterId. VLESS does not use VMess's alterId.
- Transport method: Select the method in the original configuration, such as TCP or WebSocket. If there are additional settings like Host or path, check each one and keep the leading slash in the path.
- Security settings: Check TLS, the server name, and certificate verification. For VLESS, also verify the flow value and its associated requirements, if applicable.
- Save and test: Return to Home, select the configuration, and confirm that VPN configuration permission has been granted. Then connect and visit an actual destination. Note where the failure occurs, and avoid changing several fields at once.
If you're using a subscription you already have, keep the imported fields unchanged where possible. A subscription update may regenerate entries and overwrite manual edits; note any differences before troubleshooting. A subscription URL retrieves a set of configurations; it is not the server address for Add Server. Don't paste the entire subscription URL into the server address field.
Home is mainly for selecting a connection and checking its status. Config manages configuration files, while Settings contains app preferences. Updating a subscription and updating rule files in Config are different operations: the former may change server settings, while the latter changes traffic matching and policies. They are not interchangeable.
Connectivity Tests and Routing Modes: Don't Mistake Rule Issues for Protocol Issues
Home → Connectivity Test can help check connectivity, but a single latency result doesn't prove that a service is usable or directly compare VMess and VLESS throughput. The test may cover only part of the connection, so also check an actual website or destination service.
Config: Test with Your Existing Rules
RecommendedIn Home → Global Routing, select Config to route traffic according to the active configuration rules. Confirm that the destination matches the intended proxy policy before deciding whether the connection is working.
Best for: Everyday use with valid rules and follow-up checks during troubleshooting.
Proxy: Isolate the Effect of Routing Rules
Temporarily switch to Proxy to reduce interference from regular routing rules during testing. Still confirm which server is selected and test by visiting an actual destination; don't rely on the connection toggle alone.
Best for: Briefly distinguishing server setting issues from rule selection issues.
Direct: Check the Basic Network Connection
Direct connects without a proxy, so it can't tell you whether VMess or VLESS is working. It can help confirm that the current network has basic connectivity.
Best for: Checking basic network connectivity, not proxy protocol authentication.
Scene in Global Routing applies routing behavior based on the selected scene; it is not a third proxy protocol. To keep test conditions consistent, check the current routing mode first. If the connection comes back on after you disconnect, also check Settings → On Demand. Automatic connection behavior is unrelated to UUID, alterId, and flow.
Bottom line: Change the routing mode only; leave server settings alone
If the same configuration works in Proxy but fails in Config, check which rule matched and which policy it selected. If it fails in both modes, troubleshoot the address, TLS, authentication, and transport settings in turn.
Troubleshooting: Find the Right Setting for Each Symptom
Why does switching from VMess to VLESS stop working when the UUID is the same?
A UUID is only part of the credentials; it doesn't determine which protocol the server accepts. Switch back to the original type and ask the configuration provider whether there is a separate VLESS endpoint. Then check its port, TLS, and flow settings. Changing only the protocol type does not convert the configuration.
VLESS shows none. Should I change it to an encryption method?
First, identify which field shows none. If it's the VLESS protocol-level encryption setting, this is common. Check outer protections such as TLS, and don't copy VMess encryption settings into VLESS. If the original configuration uses another security mechanism, keep all of its settings intact.
Latency shows a result, but websites won't load. What should I check first?
First, confirm the selected server and Global Routing mode, then try accessing the destination. If TLS errors appear, check the server name, device time, and certificate. If only certain sites fail, check the rules and DNS. Don't rule out the UUID or flow based on a latency result alone.
A subscription update changed the flow I entered manually. What should I do?
Note the fields and entry names before and after the update, and confirm that you're editing the same configuration. Use the latest subscription content and the configuration provider's instructions as your reference. If you need to test settings separately, keep an independent copy so the next update doesn't overwrite them again.
How VMess and VLESS perform in practice depends on the network path, server load, outer transport, and destination service. Without measurements under the same conditions, you can't conclude that one protocol is always faster. Keep error messages and field differences for troubleshooting, but don't share a full UUID, subscription token, or other access credentials publicly.