This guide is for users with their own service provider settings who need to import or manually enter VMess or VLESS in Shadowrocket. First distinguish protocol authentication, connection encryption, and transport encapsulation. Then check the Address, Port, UUID, and TLS settings in Add Server. If the connection fails, review each field in order rather than switching protocol types to see if one works.
VMess vs. VLESS: Authentication, Encryption, and Transport
VMess and VLESS are connection protocols, not connection services. The client must use the protocol enabled on the server. Even if the Address, Port, and UUID are identical, changing a VMess entry to VLESS does not convert the server to that protocol.
VMess can encrypt data at the protocol layer; modern configurations commonly use AEAD authentication. The base VLESS protocol does not provide the same kind of payload encryption and typically relies on an outer layer such as TLS to protect the connection. So “VLESS Encryption is none” does not mean “the entire connection is unencrypted.” Check the outer security settings as well.
| Field | VMess | VLESS |
|---|---|---|
| Authentication | Uses authentication parameters such as a UUID; modern configurations typically use AEAD | Uses a UUID to identify the user; this does not indicate the encryption method |
| Protocol-layer encryption | Choose the value required by the server; common options include auto, aes-128-gcm, and chacha20-poly1305 | Encryption is typically set to none for the base protocol; do not apply VMess encryption options |
| Outer-layer security | Whether to enable TLS depends on the server; TLS is separate from VMess protocol-layer encryption | Common deployments rely on TLS or another outer-layer security mechanism; check all related settings |
| Transport | Use the transport required by the server, such as TCP or WebSocket | Also determined by the server; you cannot infer it from the protocol name alone |
A protocol can use different combinations of transport and security settings. To compare configurations, check the full combination of “protocol + transport + security parameters,” not just whether the entry is VMess or VLESS. The protocol name alone also does not determine actual speed; your local network, server load, and intermediate network paths all affect performance.
Add Server: Entering the Address, Port, and UUID
In Home, tap the add button in the upper-right corner to open Add Server. Select Type, then enter the settings you have. Available fields vary by Type, and field names may differ depending on the app’s display language and interface. Use the table below to check what each setting means; not every field will appear on the same screen.
- Keep the original settings.Save the complete configuration details provided by your service provider. If you have a subscription or share link, import it first, then review the entry in its edit screen instead of recreating it from memory.
- Enter the Address.Use only a hostname or IP address, such as
example.com. Do not includehttps://, a path, or query parameters from a web address. - Enter the Port.Use the numeric port provided by the server.
443is a common TLS port, but not every configuration uses it. Enabling TLS does not mean you should change the original port to 443. - Paste the UUID.Copy the complete value and check for leading or trailing spaces, missing characters, and line breaks. A UUID is authentication data, not a label or a token from a subscription link.
- Check the transport and TLS settings.Correct basic fields do not complete the configuration. Before saving, also check the related fields in the next section.
Keep in mind: Correct format does not guarantee valid authentication
A UUID can have the correct 36-character format and still not belong to the current server. If authentication fails after the Address resolves and the Port connects, compare the UUID with the original settings and check your account status. Generating a new UUID will not fix the problem.
VMess settings may also include AlterId. Modern VMess AEAD configurations typically use 0; do not treat other values from older documentation as a universal answer. VLESS does not use the VMess AlterId mechanism, so this field cannot be carried over. If older settings do not match the current options, confirm them with the original provider rather than substituting values at random.
TLS, SNI, Host, and Path: Which Layer Does Each Belong To?
Address specifies where to connect. SNI supplies the server name during the TLS handshake. For WebSocket, Host is part of the HTTP request headers, while Path is the request path. These values may or may not be the same; setting all of them to the server address is not a universal rule.
| Setting | How to configure it | Common mistake |
|---|---|---|
| Transport | Match the server settings, such as TCP or WebSocket | Switching WebSocket to TCP while keeping the original port and other settings |
| TLS | Enable it if the server requires it, then check the server name and certificate | Enabling TLS just because the port is 443 |
| SNI | Enter the name specified by the server, usually without a protocol prefix or path | Entering a full URL or an IP address that does not match the certificate |
| Host | For WebSocket and similar setups, use the request headers specified by the server | Assuming that changing Host also changes TLS SNI |
| Path | Preserve the full path, capitalization, and any required query string, such as /ws | Omitting the leading slash or changing the value to / |
For example, if the settings specify Port 443, Transport WebSocket, TLS enabled, and Path /ws, enter that exact combination. These values are examples of fields, not a working service. Use your own settings when configuring the entry.
Some VLESS configurations also include Flow or fields for a specific security mode. Enter them only when required by the original settings and supported in the current client. Do not add Flow to a standard VLESS entry or use a public key from another security mode as TLS SNI.
After Importing: Use Global Routing to Separate Settings Issues from Rule Issues
Importing a subscription reduces manual entry, but you should still verify the imported entry’s Type, Port, and transport settings. A subscription manages server entries; it should not be treated as a rules file in Config. Subscription updates may also overwrite manual changes. Record the original values before testing, and keep a separate test copy if needed.
Select the entry you want to test in Home, then check the current Global Routing mode. Config processes requests according to the active configuration’s rules. Proxy sends ordinary requests through the proxy route, while Direct connects directly. Scene follows the selected scene’s definition; do not treat it as a fixed test condition without checking its settings.
Config: Use Rules After Verifying the Connection
RecommendedUse the current configuration to determine where requests go. Matching requests follow the corresponding policy. Requests that do not match an earlier rule are usually handled by FINAL, which does not necessarily mean a direct connection.
Best for: Applying existing rules to everyday requests after confirming the connection works
Proxy: Temporarily Rule Out Rule Interference
Test whether the selected proxy route can reach the target page, reducing interference from rules that may route requests to Direct. Also verify the selected server and check for other settings that may apply.
Best for: Determining whether a failure is caused by connection settings or rule selection
Direct: Check the Local Direct-Connection Baseline
Send ordinary requests directly to confirm that sites normally accessible on your current network still work. This does not verify whether VMess or VLESS authentication succeeded.
Best for: Ruling out issues with your local Wi-Fi or Cellular connection first
Keep in mind: If Proxy works but Config fails, check the rules first
Keep the same server and test URL, and change only Global Routing. If the page loads with Proxy but not Config, first check the active Config rules, policy names, and where FINAL sends requests. Do not start by changing the UUID or protocol type.
Keep the network and target page consistent during testing. If Settings → On Demand is enabled, note its trigger conditions so automatic connections do not interfere with manual tests. If you need to pause it temporarily, save the original settings and restore them after testing. Do not change transport, rules, and automatic connection conditions at the same time.
Connection Failures: Troubleshoot from the Outer Layer Inward
A latency value only shows that the relevant test received a response. It does not guarantee that a web request passed authentication, TLS, and the full transport flow. Record what actually happens—for example, an immediate certificate error, a timeout, or one domain failing to load—instead of simply noting that it does not work.
- Check the local network.Try accessing a site that normally connects directly on your current network. If needed, compare Wi-Fi and Cellular. Keep all other settings unchanged so the results are comparable.
- Check the Address and Port.Look for extra spaces or a URL prefix in the address, and verify that the port was entered correctly. A timeout can also result from the network path or an unreachable server; it does not automatically mean the UUID is wrong.
- Check TLS and transport.Verify the TLS toggle, SNI, Transport, Host, and Path. For certificate errors, check the certificate. For WebSocket handshake errors, check the path, request headers, and server endpoint.
- Check protocol authentication.Verify Type and UUID. For VMess, also check the encryption setting, AlterId, and device time. For VLESS, check the Encryption, Flow, and other fields required by the original settings.
- Check rules and DNS last.Use Proxy for comparison. If only certain domains fail, check how those requests resolve and route. Do not replace all DNS settings at once.
Even if both protocols work, one speed test is not enough to determine which is better. Keep the test time, network, server conditions, and target resource consistent. For configuration issues, a more reliable measure of success is being able to reconnect consistently after saving, send the target request through the expected route, and see the expected rule behavior after restoring Config.
FAQs: UUIDs, Encryption Options, and Subscription Updates
Can I change a VMess entry to VLESS if both entries have the same UUID?
Not based on the UUID alone. First get the VLESS settings explicitly provided by the server. Then create a new entry with the matching Type in Home → Add Server and check the Port, transport, and security settings. Keep the original entry so you do not overwrite the only working configuration.
VLESS shows none. Should I change it to aes-128-gcm?
Do not apply VMess encryption values to VLESS. First confirm that none refers to protocol-layer Encryption, then check TLS or the outer-layer security mechanism specified in the original settings. Security depends on the full combination, not a single field.
What should I do if a subscription update resets my manually changed Path?
First compare the settings before and after the update, and confirm the original value supplied by the subscription. Keep a separate copy for isolated testing instead of repeatedly editing an entry managed by subscription updates. For a lasting change, confirm the correct value with the original provider.
Why can’t I connect after changing only the port to 443?
A port number does not configure TLS automatically. Return to the entry’s edit screen and check the server’s actual listening port, TLS, SNI, and transport one by one. This combination can connect only if the server has a matching endpoint.
The protocol and UUID are correct, but some webpages still fail. Should I recreate the entry?
Temporarily select Proxy in Home → Global Routing and test the same URL again. If it loads, check the Config rules and policies. If it still fails, continue by checking the domain’s resolution and connection errors; you do not need to recreate every entry right away.