VLESS and Reality in plain words

VLESS: a transport with nothing extra

VLESS carries data and deliberately does nothing more: no encryption of its own and no heavy headers. Encryption comes from the TLS layer on top of it.

In practice: less overhead, a lighter and faster connection, especially on weak set-top boxes.

Reality: a connection that looks like an ordinary site

An ordinary secure server shows its own certificate, which makes it easy to recognise. Reality uses the handshake of a real third-party site when the connection is set up.

From outside it looks like a visit to that site. Such a server has no certificate of its own: nothing to expire and nothing to recognise it by.

Fields in the key

• sni: the name of the site whose handshake is used.
• pbk: the public part of the server key, which the client uses to check it talks to the right server.
• sid: a short number that separates clients of one server.
• fp: which browser the client imitates. On iPhone it is chrome: with safari the connection drops.
• flow: the transfer mode; in Shtil keys it passes data directly without an extra layer.

Why it is not «just another protocol»

The difference is not speed but how the connection looks from outside. Old protocols were recognised by their own signature; Reality borrows a familiar one, so it has no marks of its own.