VLESS vs VMess vs Trojan vs WireGuard: how they differ
This is a comparison of how the protocols are designed, not a speed test. Real speed depends on the network, the server and the app.
At a glance
| Protocol | Own encryption | Transport | Needs an accurate clock | Designed to blend in |
|---|---|---|---|---|
| VLESS | Usually none — relies on TLS or REALITY | RAW (TCP), XHTTP and others | No | Yes, with REALITY |
| VMess | Yes (AES-128-GCM or ChaCha20-Poly1305) | RAW (TCP), WebSocket and others | Yes, within 120 seconds | Depends on the transport (e.g. TLS) |
| Trojan | No — runs inside TLS | TLS over TCP | No | Yes, as HTTPS — but TLS-in-TLS can give it away |
| WireGuard | Yes (ChaCha20-Poly1305) | UDP only | No, but a clock jump ahead can block later handshakes | No — not its goal |
| OpenVPN | Yes (keys via TLS, separate data channel) | UDP or TCP | No | No — shown to be fingerprintable |
VLESS
A lightweight, stateless protocol used by Xray-core. In the common setup its own encryption is “none” and security comes from TLS or REALITY around it; Xray also offers an optional built-in VLESS Encryption mode. It identifies users by UUID and, unlike VMess, does not depend on the device clock. With REALITY, the connection takes on the TLS handshake characteristics of a real website, and connections that fail authentication are forwarded to that site.
VMess
The older protocol of the V2Ray family. It encrypts on its own (AES-128-GCM or ChaCha20-Poly1305) and depends on system time: the device and server clocks must be within 120 seconds of real time, so a wrong device clock can make a VMess connection fail.
Trojan
The client sends a hash of its password inside an ordinary TLS connection; anything that is not a valid Trojan request is handed to a preset endpoint — by default a local web server. The server needs a valid TLS certificate. Xray’s documentation warns that when the traffic inside is itself TLS, this TLS-in-TLS pattern is easy to detect unless multiplexing is used. As with any TLS setup, the clock only has to be close enough for certificate dates to be valid — there is no fixed window like VMess’s 120 seconds.
WireGuard
A modern, compact VPN protocol with a fixed set of modern cryptography (Noise protocol framework, Curve25519, ChaCha20-Poly1305, BLAKE2s). It runs only over UDP and uses system time as a counter that must keep increasing, not as a clock that must be exact. Its authors state that it does not focus on obfuscation — that is left to layers above WireGuard.
OpenVPN
A long-established VPN: a TLS-based control channel negotiates the keys for a separate data channel, over UDP or TCP. In research presented at USENIX Security 2022, a fingerprinting system tested with a million-user ISP identified over 85% of OpenVPN flows with negligible false positives.
When WireGuard is the better choice
- On networks that do not filter VPN traffic, where a simple, lean design matters more than disguise.
- When you control both ends (for example, your own home network) and value a small codebase meant to be reviewable by one person, with a formally verified protocol.
- On phones that switch between Wi-Fi and mobile data: WireGuard has built-in IP roaming, so the tunnel carries on from the new address.
When VLESS Reality fits better
On networks where the shape of VPN traffic itself becomes a problem, protocols that imitate ordinary HTTPS — such as VLESS with REALITY — are built for that situation. No protocol is invisible, and none helps during a full shutdown or on a whitelist-only network that does not let the server through.