This guide is for users who already have their own provider configuration or subscription and need to check VMess and VLESS settings in Shadowrocket. First, understand how protocol encryption differs from TLS, then check the address, port, UUID, and transport settings one by one. You’ll learn which fields must match the original configuration and where to start troubleshooting when an import succeeds but connections fail.
VMess vs. VLESS: Protocol Differences, Not Speed Tiers
VMess and VLESS are protocol types for connection configurations—not Global Routing modes or plan names. Shadowrocket’s Type must match the protocol used by the server. Changing an existing VMess entry to VLESS while keeping the same address and UUID does not convert it; the server’s inbound protocol and related settings must match too.
VMess includes protocol-level authentication and data protection mechanisms, and common configurations use AEAD authentication. Check the original configuration for the payload encryption method. VLESS has a more streamlined protocol design and does not encrypt payloads on its own; it typically relies on an outer security layer such as TLS to protect traffic. So “VLESS has no built-in protocol encryption” does not mean “a VLESS connection using TLS is unencrypted,” nor does it mean TLS can be disabled at will.
| Check | VMess | VLESS |
|---|---|---|
| User identifier | Usually a UUID; it must match the server. | Usually a UUID; it must match the server. |
| Protocol-level encryption | Includes related mechanisms and encryption options; choose according to the configuration. | Does not encrypt payloads; VMess encryption options do not apply. |
| TLS | Can provide an outer layer of security; whether it is enabled depends on the server. | Commonly used to protect traffic; settings must match the server. |
| Transport | Check the actual configuration, such as TCP or WebSocket. | The transport must also match; the protocol name does not replace these settings. |
| Can they be swapped directly? | Changing the client Type alone is not enough; obtain the complete configuration for the server’s protocol. | |
Actual speed also depends on network congestion, latency, packet loss, server load, and the outer transport. Two connections to different addresses—one labeled VMess and the other VLESS—cannot prove that one protocol is inherently faster based on a single speed test. Focus first on a complete configuration and a stable connection, then compare real-world access under similar conditions.
UUID, Port, and TLS: Know What Each Field Does
A UUID is a user identifier, not a server address or the domain in a TLS certificate. A typical UUID string has 32 hexadecimal characters and 4 hyphens, grouped into 8-4-4-4-12 characters. A valid format only confirms that the string is structured correctly; it does not prove the server recognizes that user. An extra space, a missing segment, or an expired UUID can all cause authentication to fail.
Address specifies where to connect; Port specifies which entry point to use at that address. Even though 443 is commonly used for TLS, do not change another port in the original configuration to 443. TLS Server Name (SNI) indicates the target name during the handshake and is used for certificate checks. It may differ from the connection address, so use the value from your existing configuration.
Check Each Layer: Connection Endpoint and Outer Transport
Connection endpoint and authentication
- Type: Confirm whether the protocol is VMess or VLESS; don’t guess from the name.
- Address and Port: Use the server’s actual listening endpoint.
- UUID: Copy it in full and compare it character by character with the original configuration.
- VMess encryption settings: Keep the original values; don’t apply them to VLESS.
Transport and security settings
- TLS: Match the server’s enabled or disabled state.
- Server Name (SNI): Use the value in the original configuration.
- WebSocket: Check Path and Host.
- Additional settings such as Flow and ALPN: Enter them only if required by the original configuration and supported by the current client.
Bottom line: Both endpoint and transport settings must match. A correct UUID cannot make up for an incorrect Path, SNI, or port.
WebSocket Host and TLS SNI belong to different layers: Host appears in the HTTP handshake, while SNI is used in the TLS handshake. The server may require the same value for both, or different values. Path often starts with a slash, for example /example-path. Preserve capitalization, query parameters, and trailing slashes exactly as shown in the original configuration. Don’t substitute one for the other just because they look like a domain or URL.
Configure Add Server: Preserve the Original Settings and Check Each Layer
In Shadowrocket, Home is where you manage connection entries and connection status; Config is for rule configurations; Settings contains app settings. To add VMess or VLESS manually, open Add Server from the add menu on Home. Don’t put a UUID in Config rules. Available fields vary by protocol; use the current interface and server configuration as your reference.
- Choose the Type.On Home, open the add menu and choose Add Server, then select VMess or VLESS. Confirm the protocol first, then enter the other settings to avoid missing protocol-specific fields after switching types.
- Enter the endpoint and identifier.Copy the Address, Port, and UUID. Don’t add
https://or a WebSocket Path to the Address field; enter the port separately. - Check protocol-specific fields.For VMess, the encryption method and any AlterId in an older configuration must match the original. Don’t transfer legacy settings to an AEAD configuration without checking. If VLESS requires Flow or another setting, first confirm that the current interface supports the specified value—don’t guess.
- Set up the transport.If the original configuration uses WebSocket, enter its Host and Path. If it uses TCP, don’t switch to WebSocket just because a guide does.
- Configure TLS.Enable TLS as specified in the original configuration, and check Server Name (SNI) and any explicitly required additional settings. Don’t hide a name mismatch by disabling certificate verification.
- Save and test.Return to Home, select the new entry, and grant any system permissions required for the first connection. Then visit a known-working HTTPS page. A successful save only means the entry was stored; it doesn’t confirm that authentication or transport is working.
If your existing configuration includes a required setting that isn’t shown in the client, don’t assume leaving it blank will work. First confirm that the configuration is compatible with the current version of Shadowrocket, then check the app’s App Store listing for available updates and review the server’s field requirements. Change one setting at a time and record what happens before and after, so you can tell an input issue from a change in network conditions.
Existing Subscriptions and Share Links: Which Import Method to Use
If you already have your own subscription, preserve all its settings. A subscription URL provides a set of connection details; a share link beginning with vmess:// or vless:// usually describes one entry. They are different kinds of input: don’t use a subscription URL as a server Address or treat a single share link as a subscription that updates over time.
Import an Existing Complete Configuration
RecommendedImport from an existing subscription or complete share link to reduce the risk of missing a UUID, TLS, Host, or Path value when entering it manually. After importing, still check the protocol and key fields; an entry name alone isn’t enough to verify them.
Best for: Users with a complete subscription or share link compatible with Shadowrocket
Enter Settings Manually in Add Server
Enter each setting you can confirm to understand the fields and troubleshoot one variable at a time. If you don’t have all the required values, check the original configuration rather than filling in assumed defaults.
Best for: Users with a confirmed list of settings who need to add one entry or check for input errors
Edit an Imported Entry
Change only settings you’ve confirmed need adjustment, and keep a record of the original values. A subscription update may recreate an entry or overwrite local changes, so distinguish temporary tests from your long-term configuration.
Best for: Troubleshooting a known field without changing the server protocol or authentication details
Bottom Line: Confirm the Configuration Is Complete Before Choosing a Protocol
If one of two entries imports and connects while the other doesn’t, first compare missing fields with the server’s requirements. Don’t immediately blame VMess or VLESS performance; use the entry that fully matches the existing server configuration.
To add a subscription, open the add menu on Home, choose Subscribe, enter your existing subscription URL, and save. This example is only to illustrate the format: https://example.com/sub?token=xxxx. It does not provide a working service. A subscription token and an individual entry’s UUID may both grant access. Hide them in troubleshooting screenshots, and don’t post a complete link in a public discussion.
- Subscription retrieval fails: First check that the URL is complete, the token is still valid, and your current network can reach the subscription address.
- Can’t connect after updating a subscription: Reopen the entry and check whether its protocol, port, UUID, or transport settings changed. Don’t keep using values from an old screenshot.
- Duplicate entries with the same name after importing: Check each entry’s source and actual settings. The same name doesn’t mean the address and authentication details are the same.
- Need to keep a manual test entry long term? Save it as a separate entry and note its purpose. Don’t rely on automatic subscription updates to preserve local changes.
Troubleshoot Connection Failures: Narrow It Down from Endpoint to Rules
When troubleshooting, distinguish among three things: the app’s connection switch being on, the server port being reachable, and the destination website being accessible. A VPN status indicator does not prove that remote authentication succeeded, and a latency reading does not replace a full check of TLS, WebSocket, and access to the destination. The symptoms below are clues, not definitive proof of any one cause.
The UUID looks right. Why won’t it connect?
Open the entry on Home and confirm that its Type, UUID, and Port all come from the same configuration. Then check the system time and whether the authentication details are valid. Copying the UUID alone while keeping transport settings from a different entry can still cause a failure.
Latency shows a reading, but webpages still won’t load?
Select the entry you’re testing, temporarily set Global Routing to Proxy, and visit the same known-working HTTPS page. If it still fails, check TLS and transport settings. If Proxy works but Config doesn’t, check the rules and their referenced policies. Restore the original mode when testing is complete.
The log reports a TLS handshake or certificate error. What should I change?
Return to the entry and check TLS, Server Name (SNI), and Address. Also check the system date. A name mismatch, certificate validity dates, or server settings can all cause errors. Don’t disable certificate verification; first confirm what the server requires.
WebSocket returns an HTTP error. Is it the UUID?
An HTTP error can occur before protocol authentication. First check the transport, Host, Path, and TLS to confirm the request reaches the right endpoint. A 404 often points to a mismatched path or endpoint, but check the logs and server configuration before drawing conclusions from the status code alone.
The settings I fixed manually changed again after a subscription update?
Check the updated entry against the subscription to see whether your local changes were overwritten. Save temporary tests as separate entries and record the specific differences. For long-term use, rely on a complete and valid original configuration.
Global Routing’s Config mode handles connections according to the current rule configuration. Proxy sends connections handled by that mode through the proxy, while Direct connects directly. Scene is for choosing a scene; it isn’t a fourth protocol. If access fails only in Config mode, check the order of DOMAIN-SUFFIX, GEOIP, IP-CIDR, and FINAL rules in Config, along with their policy targets, rather than replacing the UUID.
If you’re troubleshooting a connection that starts or reconnects automatically, also check the trigger conditions in Settings → On Demand. On Demand controls when a connection starts based on those conditions; it doesn’t fix VMess or VLESS authentication settings. To keep the test consistent, note the current settings and decide whether you’re testing a manual connection or an automatic trigger. Don’t conflate the two.
Final Checks Before Saving
Whether an entry works depends on the client and server using matching protocol, authentication, transport, and security settings. The existing server determines whether to use VMess or VLESS. You can compare their real-world performance only if the server provides complete configurations for both, and you test on the same network, to the same destination, and at similar times. A single latency reading or an entry name doesn’t establish a difference.
- The Type matches the original configuration. VMess and VLESS cannot be converted by renaming an entry or changing its Type.
- Address, Port, and UUID are complete; the port hasn’t been changed to 443 by default.
- TLS, SNI, WebSocket Host, and Path each match the original configuration.
- You’ve tested access to a webpage after importing and distinguished protocol issues from Config rule issues.
- The test did not expose a complete subscription URL, token, or UUID, and temporary changes have been recorded.
Shadowrocket is a closed-source commercial app primarily for iPhone and iPad. The App Store is the only place to get it. The developer is Shadow Launch Technology Limited, and the app ID is 932747118. The one-time app purchase is separate from any connectivity service you already use. Check the App Store listing for system requirements and general purchase availability; buying the app does not generate a working VMess or VLESS configuration.