VLESS Reality vs Shadowsocks

Shadowsocks (released 2012) and VLESS Reality (released 2023) both target the same problem: VPN traffic that needs to survive DPI in censored networks. They use different approaches; Reality is the newer-generation answer.

At a glance

	Shadowsocks (AEAD)	VLESS Reality + Vision
Released	2012, AEAD 2017	2023
Approach	Encrypted SOCKS5 stream	Real TLS 1.3 to real public host
Handshake	None (immediate encrypted stream)	Real TLS 1.3 (to camouflage host)
Active probing resistance	Weak (no real service to mimic)	Strong (transparent proxy to real site)
Entropy detection	Caught by classifiers	Looks like normal HTTPS
Detection rates (Russia/China 2026)	30-60%	<5%
Speed	Faster (lighter protocol)	Slightly slower (TLS overhead)

How each defeats DPI

Shadowsocks wraps a SOCKS5 stream in symmetric encryption. The stream from the first packet is encrypted random-looking bytes. There is no TLS handshake at the start, no real server response if probed. The defence is just "encrypted bytes look like nothing in particular."

This worked when DPI was relatively unsophisticated. As DPI got better — entropy classifiers that flag streams with high entropy from the first packet, active probing that connects to suspect servers and notes the absence of a legitimate web service response — Shadowsocks became increasingly detectable.

The Great Firewall caught Shadowsocks at scale starting around 2017. AEAD variants (chacha20-ietf-poly1305) helped briefly. By 2024, GFW detection of AEAD Shadowsocks was 30-60% per community testing. Still works on lighter networks; not reliable in heavy-DPI markets.

VLESS Reality performs a real TLS 1.3 handshake to a real public host like microsoft.com. The Reality server transparently proxies unauthenticated connections to the actual real site, so an active prober gets a real Microsoft response. There is no fake server to detect; there is no entropy anomaly in the handshake.

Reality with the Vision flow (xtls-rprx-vision) eliminates the TLS-in-TLS pattern that traffic analysis would otherwise see. Statistical detection becomes essentially impossible; the only attack surface is IP-reputation analysis (noticing patterns of long-lived TLS connections from residential IPs to specific VPS IPs).

Detection rates against properly-deployed Reality are under 5% as of May 2026.

Speed

Shadowsocks is faster. No TLS handshake overhead, less per-packet framing, simpler protocol math. On a clean connection both perform well; on a connection where the encrypted-stream-with-no-handshake pattern is itself a flag, Shadowsocks's "advantage" disappears because the connection does not survive.

For modern use, the speed difference between Reality and Shadowsocks is small enough that detection-resistance dominates the choice.

Self-hosting complexity

Shadowsocks is simpler to self-host. Several mature client and server implementations; basic deployment is trivial. Configuration is minimal.

Reality requires XRay-core, a real public-host camouflage target, careful key management, and the Vision flow configuration. More moving parts; more failure modes if misconfigured.

For commercial VPN providers, both are operationally manageable. For individual self-hosters, Shadowsocks is friendlier; Reality requires more work.

When to use which

Shadowsocks: lightly-filtered networks where DPI is not aggressive. Self-hosting projects where simplicity matters more than maximum detection resistance. Some legacy deployments still in operation.

VLESS Reality: active-DPI markets (Russia, China, Iran, Pakistan, UAE, Saudi). Anywhere where Shadowsocks no longer works.

In 2026, the Reality recommendation extends to most use cases that Shadowsocks historically served. The practical advice is "if you used to use Shadowsocks for censorship circumvention, switch to Reality." The Chinese self-hosting community has largely made this transition since 2023.

What Fexyn ships

Reality with the Vision flow as Fexyn Stealth. We do not ship Shadowsocks because it does not survive the markets we serve. Smaller providers ship both; some commercial setups still offer Shadowsocks as a legacy option.

Try Fexyn free for 7 days — Stealth (VLESS Reality + Vision) is the protocol class designed for the markets where Shadowsocks no longer works.