URL structure and encoding

A VLESS URL contains protocol, UUID, host, port, query parameters and a label. Ports range from 1 to 65535; enclose IPv6 in brackets and use Punycode for internationalized hosts.

Parameter names are case-sensitive and must not repeat. URL-encode values and labels: /example becomes %2Fexample and a space becomes %20. The structure below is illustrative.

VLESS URLCopy
vless://<uuid>@<host>:<port>?type=<transport>&security=<security>#<label>

Protocol and transport fields

encryption controls protocol encryption; security controls transport security. New extensions require compatible client and core versions.

FieldMeaning and values
encryptionCommonly none for VLESS; newer proposals also define mlkem768x25519… forms requiring the complete server value
flowFor example xtls-rprx-vision; match the server
typetcp, kcp, ws, http, grpc, httpupgrade, xhttp
securitynone, tls, reality
host / pathHost and path for WS, HTTPUpgrade, XHTTP and related transports
serviceName / authoritygRPC service name / Authority
modegRPC gun, multi, guna, or the corresponding XHTTP mode
mtu / ttimKCP transport parameters
extra / fmURL-encoded JSON for XHTTP extensions / Finalmask

TLS and REALITY fields

Check server names and certificates for TLS, and preserve provider-supplied authentication parameters for REALITY. fp is a TLS ClientHello fingerprint, not a certificate SHA-256 fingerprint.

FieldMeaning
sniTLS/REALITY serverName; usually uses the server host when omitted
fpTLS client fingerprint; required for REALITY
alpnComma-separated, URL-encoded protocol list
echECH configuration list
pcs / vcnCertificate SHA-256 pins / verification names
pbkREALITY password parameter, labeled public key in older interfaces
sidREALITY shortId
pqvREALITY ML-DSA-65 verification public key
spxURL-encoded REALITY spiderX

Import and verify an example

This example uses a reserved domain and placeholder UUID. After importing your own complete link, check host, port, transport, SNI and flow. encryption=none does not disable TLS; security selects transport security.

VLESS · illustrative URLCopy
vless://00000000-0000-4000-8000-000000000000@proxy.example.com:443?encryption=none&type=ws&security=tls&sni=proxy.example.com&host=proxy.example.com&path=%2Fexample#Example%20TLS

Older links and newer cores

The proposal evolves; historical flow or xtls examples may not apply to current versions. Check the imported fields and core logs when a link fails.

Resolve certificate failures through correct trust/name settings. The newer Xray format used by 7.25.6 does not use allowInsecure as a workaround.

Release compatibilityCertificate settings