What VLESS and Reality are, in plain English

Connection descriptions are full of words that mean nothing to an ordinary person: VLESS, Reality, XTLS Vision, the “xtls-rprx-vision flow.” It looks like a jumble of characters, and yet those very words decide whether your connection will still be working six months from now.

Below is a plain-language explanation: what these things are, how they differ from the familiar WireGuard and OpenVPN and, most importantly, what this technology cannot do. That last part matters most: promises that something “cannot be blocked” are common, and they are not true.

Why some connections stop working sooner than others

Telecom operators run equipment that takes apart the traffic passing through it: not just where a connection is going, but what it looks like. It does not need to decrypt the contents — the shape is enough: the length of the first packets, their order, the service fields at the beginning.

Classic VPN protocols are defenseless here, because they were never built for masking in the first place. WireGuard’s first message is always of the same type and the same length, 148 bytes, and it runs only over UDP. Its developers say plainly that masking is not the protocol’s job and should be handled by a layer above it. OpenVPN gives itself away through characteristic patterns: in a study presented at the USENIX Security conference in 2022, the authors identified more than 85% of OpenVPN connections at a real provider with over a million users — and, more interestingly, defeated most of the “obfuscated” modes offered by commercial services.

The fix looks obvious: make the traffic completely random, with no recognizable fields. But that is a sign too. Since November 2021, China has operated a system that looks in real time for exactly these “fully encrypted” connections — Shadowsocks, VMess and obfs4 all got caught by it. Randomness stands out precisely because ordinary traffic does not look like that.

VLESS: who you are and where you are going

VLESS appeared in the summer of 2020 as a lightweight replacement for the VMess protocol. Its job is a narrow one: tell the server who is connecting and where the data should be passed on. It identifies the user by a UUID — a long unique identifier issued together with the subscription.

The main thing worth knowing: VLESS has no encryption of its own. The official documentation warns outright that it must not be used on the open internet without an external protective layer. That layer is TLS — or Reality.

Hence its lightness: the protocol spends no resources on work the layer above will do anyway. Unlike VMess, it does not even depend on the accuracy of the device clock — with VMess, a drift of more than two minutes breaks the connection.

TLS and the handshake in one minute

TLS is what turns an ordinary connection to a website into a closed one. In the browser it is marked by the secure-connection icon: it used to be a padlock, and in newer versions of Chrome it is a settings icon. The icon only tells you that the channel is protected from eavesdropping and tampering; it says nothing about whether the site itself is acting in good faith.

It all starts with a handshake: the browser and the site exchange a few messages and agree on keys. In the modern TLS 1.3, almost the entire contents of the handshake are encrypted, and an observer sees only the very beginning. But one detail in that beginning travels in the clear — the name of the site you are reaching. That is why filtering “by site name” works, and why masking begins with the handshake.

Reality: borrowing someone else’s handshake

The official definition goes like this: Reality is a modification of TLS that uses the appearance and characteristics of a target site’s handshake as camouflage. In plain language: the server pretends to be not “its own site with a certificate,” but a well-known site belonging to someone else.

Here is how it works. The server settings name a cover site — an ordinary popular website that supports modern TLS. When a connection arrives at the port, the server checks whether whoever is knocking knows the secret:

• It does not — the server simply forwards the connection to the cover site. The inspector gets a real site with a real certificate. From the outside, the server looks like nothing more than a port forward to someone else’s site.
• It does — the server answers itself, and your channel opens from there.

Two consequences follow. First: the server needs no domain or certificate of its own, which means there is no domain to add to a filter. Second: actively probing to see “what is on this port” gets you nowhere — the one doing the probing is answered by someone else’s site.

What Reality does not do: it does not route your traffic through someone else’s site. The cover site is needed only to mask the handshake and to answer outsiders. Your data travels from your server straight to wherever you are going.

XTLS Vision: removing encryption on top of encryption

There is one more hook that got connections caught in entire waves. When you open a site through an intermediate server, the data is encrypted twice: on the inside by the site’s own TLS, on the outside by the connection’s TLS. This “nesting doll” gives itself away through the order and length of the first packets: very short, short, long, short again, and always in the same sequence.

The xtls-rprx-vision mode solves this in two ways. It stops adding a second layer of encryption where the inner TLS is already reliable, and it pads the short handshake packets out to 900–1400 bytes so that they cannot be told apart by length. The side effect is a pleasant one: less unnecessary work means higher speed. The developers claim an improvement of “several times over”; we found no independent measurements, so we pass this on as their claim.

And now, honestly, about the limit. In 2024, a paper at USENIX Security examined Vision head-on: evening out the lengths really does deprive a censor of that particular sign, but the order and direction of the packets remain, and a classifier can be retrained on those. The conclusion worth remembering: masking makes detection harder, but it does not rule it out.

How this looks next to the familiar protocols

That is exactly why, in 2023, the waves of restrictions hit OpenVPN and WireGuard on mobile operators first, while VLESS-type connections held out longer. “Longer” does not mean “always”: since late 2025 there have been reports that the restrictions started reaching those as well.

What this technology cannot do

This is the section usually missing from vendors’ articles, and it is the most useful one.

• This is not anonymity. The address the request comes from changes — and that is all. A site recognizes you by your login, your cookies and your browser settings exactly as before.
• Blocking by address has not gone anywhere. Instead of picking apart the handshake, someone can simply cut off access to the server’s address or to an entire data-center subnet. This has already been done in Russia.
• Whitelists are a different story. When a network allows only a handful of addresses, the protocol is not the issue: the destination addresses themselves are unreachable. No masking helps here.
• Masking does not last forever. Researchers keep demonstrating new signs, and operators keep changing their equipment settings. This is a race, not a one-time win.
• Speed depends on more than the protocol. The distance to the server, your operator’s channel and the load on the node matter just as much.

If what you need is not a breakdown of the technology but of the everyday problem — getting back into Russian services from abroad — that is covered in a separate article: what a “reverse VPN” is and why you need one after moving abroad.

How all of this works in our service

The connection in Liberum VPS is built on exactly this combination: VLESS with Reality masking and the xtls-rprx-vision mode. There is nothing to set up by hand — every parameter is already inside the subscription link, and the app reads it itself. The bot’s menus are in Russian, so button names are shown exactly as they appear on screen, with a translation.

Step 1. Get access in the Telegram bot

1. Open the Liberum VPS bot and tap Start.
2. Confirm that you accept the documents.
3. In the menu, tap 🔐 Тарифы / Подключить VPS (“Plans / Connect VPS”).
4. Choose 🎁 Активировать TRIAL (7 дней) (“Activate TRIAL (7 days)”) — free, with no card required.
5. Pick a location: 🇷🇺 Россия (Москва) (“Russia (Moscow)”) for Russian services, or a foreign one for everything else.
6. In 10–15 seconds you will get a subscription link, which is also kept in the 📱 Мои конфиги (“My configs”) section.

Step 2. Open it in an app

Any app that can handle VLESS with Reality will do. We recommend Happ: iPhone and Mac, Android, Windows, Apple TV.

1. Copy the subscription link — just tap it in the chat.
2. Open Happ and tap + in the top right.
3. Choose the option to add from the clipboard.
4. Pick the location by its flag and tap the connect button.

What it costs and what opens up with the Russian location is on the Russian IP address page.

If the connection does not work

• The wrong location is selected. Russian services need the server with the Russian flag; for foreign ones, any other server will do.
• The app is holding an old profile. Refresh the subscription in the app and the settings will be pulled in again.
• You are over the device limit. The limit counts simultaneous connections; you can see the current ones in the 📲 Мои устройства (“My devices”) section.
• The network uses a whitelist. If only certain resources are allowed, the connection will not be established at all — that is a restriction of the network itself, not of your settings.
• You need speed for video. Speed requirements and what affects quality are covered in the article on streaming services.

The short version

• A connection is recognized not by its contents but by its shape: the length of the first packets, their order and the service fields.
• VLESS only handles who you are and where you are going; it has no encryption of its own and works together with TLS or Reality.
• Reality disguises the server as a well-known third-party site: outsiders are answered by that site, and no domain or certificate of your own is needed.
• Vision removes encryption on top of encryption and evens out the length of the first packets — but researchers have shown that the packet order remains.
• It does not give you anonymity, and it does not save you from address blocking or from whitelists. The honest wording is “harder to detect,” not “impossible.”