What Are VLESS and REALITY, Explained Simply
How the VLESS protocol with REALITY masking works, why its traffic looks like an ordinary website visit, and how it differs from WireGuard and OpenVPN.
Published
In short: VLESS is a way to carry traffic between your device and a server, and REALITY is a way to make that connection look, from the outside, like a normal visit to a popular website. Together they produce a connection that carrier-side filters cannot tell apart from regular HTTPS.
Why new protocols were needed at all
Classic VPN protocols — OpenVPN, WireGuard, IPsec — were designed to encrypt traffic, not to hide the fact that it exists. Each has a recognisable signature: a characteristic first packet, its own port, its own rhythm of exchange. A carrier's deep packet inspection (DPI) system only needs to spot that signature to block the connection, without decrypting anything.
So the goal changed. It is no longer enough to encrypt the data; the connection has to be indistinguishable from what already flows through the network millions of times a second — an ordinary HTTPS request to a website.
What VLESS is
VLESS is a transport protocol from the Xray project. It does one job: deliver your data to the server and back with as little overhead as possible. The technical specification is in the Xray documentation.
What matters:
- VLESS does not encrypt on its own. That is by design, not an oversight: encryption is handed off to TLS — the same layer that protects any site with a padlock in the address bar. The protocol never invents its own encryption that could be fingerprinted.
- It is lightweight. The request header carries almost no service data, so latency is lower and throughput higher than with the older VMess.
- Authentication by UUID. The key you get from the bot is, among other things, a client identifier. The server responds only to clients that present the correct UUID; to everyone else it behaves like an ordinary web server.
On its own, VLESS can still be spotted by DPI: a TLS connection to an unknown server with a self-made certificate looks suspicious. That is where the second component comes in.
What REALITY is
REALITY is a way to establish a TLS connection so that it looks like a connection to a real, well-known website, while actually leading to the VPN server.
Step by step:
- Your device starts a TLS connection and puts the name of a real website in the SNI field — a major CDN or cloud service, for instance, that is certainly not blocked.
- The Buzz VPN server accepts the connection. If the client has presented the correct key, the server recognises it as its own and VPN traffic begins.
- If there is no key (say, the carrier is probing the connection, or someone is scanning the server), the server transparently forwards the request to that real website. The prober receives its genuine certificate and genuine page.
As a result, the VPN server has no certificate of its own that could give it away, and under any outside inspection it behaves like someone else's legitimate site.
On top of that, the client shapes the TLS "fingerprint" of the connection to match a regular browser (this is called uTLS). To a filter, it looks as if Chrome or Safari is opening a website.
How it differs from WireGuard and OpenVPN
| VLESS + REALITY | WireGuard | OpenVPN | |
|---|---|---|---|
| Looks like ordinary HTTPS | yes | no | no |
| Resists DPI on mobile networks | yes | usually blocked | usually blocked |
| Needs its own server certificate | no | — | yes |
| Speed | high | very high | medium |
| Setting up yourself | hard: needs Xray and a cover site | easy | moderate |
| Built for | stealth | speed and simplicity | versatility |
WireGuard is faster and simpler, but it runs over UDP with a recognisable packet format — filters see it. OpenVPN is flexible, but its handshake has long been known to DPI as well. VLESS with REALITY was designed later than the others, specifically not to stand out; the price is a more involved server-side setup.
Both components are open source: Xray-core and REALITY can be studied on GitHub.
What this means for you
You do not need to deal with SNI or certificates: all of that is already configured on the Buzz VPN side. The key from the bot contains the server address, the UUID and the masking parameters, and Happ, v2RayTun or INCY apply them automatically.
In practice you will notice three things:
- the connection comes up on mobile data even where a regular VPN fails to connect — more on that in the article about whitelists;
- speed stays close to your line speed, because the protocol adds almost no overhead;
- the app needs no administrator rights or certificate installation — only confirmation of the VPN profile.
How to get a key and connect is covered in the guides.