Skip to main content

Protocol guide

What is VMess? Configuration, transports and safety

VMess is a proxy protocol from the V2Ray ecosystem. A profile combines authentication with a transport and optional outer security settings, so copying only the host and port is not enough.

Checked VMess servers Compare all protocols Verification method
Laptop displaying network configuration code for a VMess protocol guide

Quick facts

TCP, WebSocket or gRPCTransport
UUIDAuthentication
vmess:// linkConfiguration

VMess in plain English

A VMess client authenticates with a UUID and carries proxy requests over the configured transport. Deployments may add TLS and use TCP, WebSocket or gRPC. Every layer must match the server. Client and server clocks also need to be reasonably accurate for compatible authentication behavior.

Important: encryption protects traffic between the client and endpoint, but it does not make an unknown public operator trustworthy.

How VMess works

  1. The client reads the server, port, UUID and transport parameters.
  2. It establishes the selected TCP, WebSocket or gRPC transport and optional TLS layer.
  3. VMess authenticates the client and relays destination traffic.
  4. The client decides whether to proxy selected requests or create a full-device TUN route.

Configuration fields that must be complete

FieldWhy it matters
Address, port and UUIDCore endpoint and authentication values.
TransportTCP, WebSocket or gRPC must match the server.
TLS and SNIOptional security layer and certificate hostname.
Host, path or service nameTransport-specific routing values.

PublicVPNList publishes a download only when the exact configuration is still present in an allowed, publication-compatible source and its fresh full-tunnel check succeeds.

Strengths

  • Flexible transports make it compatible with varied deployments.
  • Supported by many V2Ray- and Xray-compatible clients.
  • Share links can preserve the complete set of connection fields.

Limits and risks

  • Transport and TLS mismatches are common import failures.
  • VMess is not the same protocol as VLESS and their credentials are not interchangeable.
  • Operator trust and logging cannot be inferred from a successful connection.

Safe setup and verification

  1. Use a maintained client that explicitly supports VMess.
  2. Inspect the server, transport, identity and authentication fields before importing.
  3. Keep certificate and server-identity validation enabled where the protocol supports it.
  4. Connect without opening sensitive accounts, then verify the visible IP and DNS path.
  5. Disconnect and remove stale public profiles after low-risk testing.
Check public IPRead public VPN risks

Common connection problems

  • Check the UUID and every transport-specific field.
  • Verify WebSocket path, gRPC service name, Host header and SNI.
  • Synchronize the device clock and update the client.
  • Test the public exit IP rather than relying on a connected icon.

A client “connected” indicator is not enough. A valid test must send real HTTPS traffic through the protocol and confirm that the public exit IP changed.

Official technical reference

For field semantics and protocol behavior, consult the Project X VMess protocol documentation. PublicVPNList adds operational testing and publication policy; it does not replace the specification.

Related protocol guides

Frequently asked questions

Is VMess a VPN?
VMess is primarily a proxy protocol. It becomes a full-device path only when a compatible client routes all traffic through a TUN or VPN interface.
What does a usable VMess profile need?
It needs all endpoint, authentication, transport and security fields required by the server. A hostname and open port alone are not a downloadable working configuration.
How does PublicVPNList verify VMess endpoints?
The checker starts the real protocol client in an isolated VM, sends HTTPS through the tunnel and requires the observed public exit IP to differ from the direct checker IP.
Is a checked public endpoint safe for sensitive accounts?
No technical connectivity test can verify the operator, logging policy or jurisdiction. Avoid banking, private work and identity-sensitive sessions on unknown public infrastructure.

Page history

  • 2026-08-31 — Published the protocol overview, configuration requirements, troubleshooting guidance, safety notes and PublicVPNList verification policy.