v2rcA config link packs everything a client needs into one line: the server, the key and the transport settings. Knowing how to read one tells you what you were given and why a config fails. All examples below use placeholders, not real servers.
VLESS
vless://[email protected]:443?encryption=none&security=reality&sni=site.example&fp=chrome&pbk=PUBLIC_KEY&sid=SHORT_ID&type=tcp&flow=xtls-rprx-vision#my-config| Part | Meaning |
|---|---|
00000000-… | The user ID (UUID). It is the key: whoever has it can use the server. |
server.example:443 | Server address and port. |
encryption=none | VLESS does no encryption of its own; the security layer protects the traffic. |
security | none, tls or reality. |
sni | The server name presented in the TLS handshake. With REALITY it is the real site being imitated. |
fp | The TLS fingerprint the client imitates, such as chrome. |
pbk, sid | REALITY public key and short ID. Both must match the server exactly. |
type | Transport: tcp, ws (WebSocket), grpc and others. |
flow | xtls-rprx-vision is the Vision flow, used with REALITY or TLS over TCP. |
path, host, serviceName | Settings of the WebSocket or gRPC transport, when used. |
#my-config | The label shown in your list. |
VMess
A vmess:// link is the prefix followed by Base64 of a small JSON document. Decoded, it looks like this:
{"v":"2","ps":"my-config","add":"server.example","port":"443","id":"00000000-0000-0000-0000-000000000000","aid":"0","scy":"auto","net":"ws","type":"none","host":"server.example","path":"/path","tls":"tls","sni":"server.example"}add and port are the server, id is the UUID, aid is the legacy alter ID (it should be 0), net is the transport, host and path belong to WebSocket, tls turns TLS on and ps is the label. To decode one by hand, take the text after vmess:// and run it through base64 -d.
Shadowsocks
ss://BASE64(method:password)@server.example:8388#my-configThe part before the @ is the cipher and the password, Base64-encoded. Use an AEAD cipher. Older stream ciphers such as rc4-md5 or aes-256-cfb are weak. Some older links Base64-encode the whole method:password@host:port instead.
Trojan
trojan://[email protected]:443?security=tls&sni=server.example&type=tcp#my-configThe part before the @ is the password. Trojan needs TLS to protect the traffic, so security=tls should be there.
Subscriptions
A subscription URL returns a list of links, usually Base64-encoded, one per line. The app fetches it, decodes it and adds every link. When a provider replaces blocked servers, refreshing the subscription brings the new ones.
Mistakes that break a link
The link decoder checks for the common ones:
- an invalid UUID or port;
- REALITY without a public key or a server name;
- VLESS or Trojan without TLS;
allowInsecureswitched on, which turns off certificate checks;- an outdated Shadowsocks cipher;
- a non-zero VMess alter ID.
One wrong character in pbk or sid makes a REALITY config fail without any message. See why a connection can succeed and still load nothing.
A link is a credential
The UUID or password inside a link is the key to the server. Anyone who has the link can use it, and on a shared server that can eat into your quota. Do not post links in public chats; a public link gets blocked sooner as well.
The decoder on this site decodes in the page and sends nothing anywhere: the page makes no network requests when it decodes a link. Even so, be careful with any online tool you paste a link into. You can always decode one offline with base64 -d, as above.
Sources
- Xray configuration examples
- REALITY documentation
- Trojan protocol description
- Shadowsocks SIP002, which defines the link format