VLESS: what it is and what vless:// key fields mean

People usually meet VLESS as a long vless://… line: someone sends it as a “key” and asks you to paste it into an app. Below: what VLESS is, what each field of the key means and how to handle it. Everything here is as of 10 October 2026, based on the Xray project's documentation.

In short. VLESS is a lightweight protocol from the Xray project: it carries traffic between the app and the server and recognises you by an identifier (UUID). It does not encrypt by itself: an outer layer does, TLS or REALITY, so encryption=none in a key is normal and does not mean “unencrypted”. A vless:// key is the server address, your UUID and the settings of that layer: security, sni, fp, pbk, sid, flow, type. The UUID is like a password: do not hand the key to strangers.

We make Mayak — a private network. For iPhone, Windows and Mac we issue VLESS keys with REALITY through a subscription link for Happ, one per device; on Android we have our own app. 3 days free after you confirm your email, no card needed.

Start for free Straight to Google Play

What VLESS is

VLESS is a protocol from the Xray project, open software for servers and apps. The Xray documentation calls it a “stateless lightweight transport protocol”: it carries your traffic from the app to the server and back and checks who is connecting by an identifier — a long number like 8f3c…-…-…, called a UUID.

VLESS has no app and no servers of its own. It is the language spoken by one provider's server and the app you installed — Happ, for example. So a “VLESS VPN” is not a separate service but a way of connecting that many services use.

How VLESS differs from a classic VPN protocol. Protocols like WireGuard encrypt and describe themselves. VLESS splits the job into two layers: inside, VLESS, which knows who you are and where the traffic goes; outside, a security layer that encrypts and decides how the connection looks on the wire. Most of the key describes that outer layer.

encryption=none: why it is not “unencrypted”

The line that scares people most is encryption=none. It only means that encryption at the VLESS level itself is off. Per the Xray documentation the field cannot be left empty and none is the usual value, while VLESS itself is meant to run inside an outer security layer — TLS or REALITY. That layer encrypts your traffic; in the key it is named in the security field.

Since 2025 VLESS also has encryption of its own — VLESS Encryption (currently one option, mlkem768x25519plus). If a key uses it, the encryption field holds a long string instead of none. Keys with encryption=none and security=reality are encrypted by REALITY.

One exception worth knowing: a key with security=none (and no VLESS Encryption) encrypts nothing. The Xray documentation allows that only for addresses inside a private network.

What the fields of a vless:// key mean

A key looks like this (values are placeholders):

vless://UUID@server.example.com:PORT?encryption=none
  &flow=xtls-rprx-vision&fp=chrome&pbk=…&security=reality
  &sid=…&sni=…&type=tcp#Name

Field	What it means	Can you change it
`UUID` (before @)	Your identifier on the server; the server lets you in by it. Works like a password.	No
address and port (after @)	Where to connect. Port 443 is the one ordinary websites use, so it is a common choice; others occur too.	No
`encryption`	`none` — the outer layer encrypts; a long string — VLESS Encryption is on.	No
`security`	The outer security layer: `reality`, `tls` or `none`.	No
`sni`	The site name the app states at the start of the connection. With REALITY it is one of the names set on the server; with another name the server will not let you in.	No
`fp`	A “fingerprint”: which browser the app's first message looks like (e.g. `chrome`). Required for REALITY.	Better not
`pbk`	The REALITY server's public key; the app uses it to make sure it is talking to the right server.	No
`sid`	REALITY short id: up to 16 hex characters, always an even number of them. The server keeps a list of valid ones.	No
`flow`	`xtls-rprx-vision` — the XTLS Vision mode, per the docs “XTLS, including inner handshake random padding”. May be empty.	No
`type`	The transport: `tcp` (called RAW in newer Xray versions); `xhttp`, `grpc` and others also exist.	No
after `#`	The name the app shows in its server list.	Yes

The main point of the table: almost every field must match what is set on the server. A key is not a set of personal preferences but a pass written for one particular server. Edit anything except the name and the app will most likely just fail to connect.

VLESS Reality: what it means

REALITY is a security layer from the same Xray project. The documentation describes it as a modified TLS that uses the appearance and handshake of a real site, so that from the outside the connection looks like ordinary web traffic. Hence the sni field (that site's name), fp (which browser the greeting imitates) and the pbk/sid pair by which the app and the server recognise each other.

For you as a user this means two things. First, such a server may have no certificate or domain of its own for a website, and that is normal. Second, sni points at someone else's site, but the traffic goes to the server in the address after @, not to that site.

VLESS TCP Reality is the most common combination in keys: transport tcp, REALITY as the security layer, often with flow=xtls-rprx-vision. That is exactly what we issue too.

How to add a VLESS key to an app

A key is one line, so the method is similar everywhere: copy it whole and choose “add from clipboard” in the app (in Happ: “+” → “Import from clipboard”). More often than a bare key, a provider gives a subscription link: with it the app loads keys for all servers by itself and keeps them updated. How that looks in Happ on a computer — “Happ VPN on PC”; where to get a subscription and why it beats one-off keys — “Keys and subscriptions for Happ”.

If the key was added but nothing connects, first check that it was copied whole: a cut-off tail (sid, sni or pbk) breaks the connection silently. Next — the order of checks in “Happ not working”.

A key you do not need to take apart. In the Mayak dashboard the subscription link brings keys for all our countries into Happ by itself, and a device can be reissued with one button. We do not ask for payment details for the trial. A confirmed email opens the access — 3 free days.

Start for free Straight to Google Play

A key is a password: how not to give your access away

The UUID in the key is your pass. Whoever has the key connects as you and takes your place with the provider.
Do not paste the key into “online checkers” or unknown apps. Seeing the line once is enough for them.
Do not post a screenshot with the key, even when asking for help: a key reads from a picture as easily as from text.
Free “VLESS keys” from chats are someone else's server that your traffic will pass through. You do not know who runs it or what they see. How a free key differs from a subscription — in the article on Happ keys.
Key leaked — reissue it. A decent provider lets you do that in the dashboard: the old key stops working at once.

VLESS at Mayak

Where we use it. VLESS keys with REALITY come with the subscription link from your dashboard: for Happ on iPhone, Windows and Mac and for INCY on iPhone. On Android we have our own app, where the main protocol is different — AmneziaWG.
What our keys look like. encryption=none, security=reality, type=tcp, with sni, fp, pbk and sid filled in; flow is xtls-rprx-vision or empty. The server address in the key is always a domain name, never an IP.
Each device has its own UUID. Reissue a device's link in the dashboard and that device's old key stops working; the others carry on.
What Happ lacks. Automatic path switching like in our Android app: the key connects one way.

What we checked

The Xray documentation on VLESS, transports and REALITY — 10 October 2026: the meaning of encryption, flow, sni, fp, pbk, sid, the name RAW instead of tcp and the rule about an outer security layer.
The format of our keys — from the server code that builds the vless:// link: the set of fields, a domain name instead of an IP, a UUID per device.
Happ with our link on Windows 11 and Mac — a live connection on 25 September 2026; INCY on iPhone — 22 September.

What we do not know

How other people's keys are set up. We described the fields per the documentation; what another provider configured on its server only it can see.
VLESS Encryption in practice. We do not issue keys with it and have not tested it live.
How apps other than Happ and INCY behave. The key format is shared, but every app parses it in its own way.
How the connection will behave on your network. Only you can see that.

Short answers

Is VLESS a VPN? It is a protocol, a way of connecting. You get a VPN in the usual sense when an app sends all of a device's traffic through VLESS.

Does encryption=none mean the traffic is not encrypted? No, if security=reality or tls: the outer layer encrypts. Only a key with security=none is unencrypted.

What is security in VLESS? The field naming the outer security layer: reality, tls or none.

What is sni in a VLESS key? The site name the app states at the start of the connection. With REALITY it must be on the server's list; the traffic still goes to the server in the key, not to that site.

What does flow=xtls-rprx-vision mean? The XTLS Vision mode, running over TLS or REALITY. If the field is empty, the app connects without it.

Why is the port 443? It is the port of ordinary secure websites. A key on another port can work too — what matters is that it matches the server.

Where do I get VLESS keys? From a provider you trust with your traffic, ideally as a subscription link rather than a one-off key. Free keys from chats are a stranger's server.

VLESS or AmneziaWG — which is better? Different approaches: AmneziaWG encrypts by itself and changes the shape of WireGuard packets, VLESS relies on an outer REALITY or TLS layer. On Android our main one is AmneziaWG; the subscription link carries VLESS with REALITY.

VLESS: what it is and what security, sni, flow and encryption mean in a key