# How to read a vmess://, vless://, ss:// or trojan:// link

HTML: https://v2rc.app/learn/read-a-config-link/ · Last reviewed: 2026-11-06

What each part of a V2Ray config link means, with placeholder examples for VLESS, VMess, Shadowsocks and Trojan, and why a link is a credential.

A config link packs everything a client needs into one line: the server, the key and the transport settings. Knowing how to read one tells you what you were given and why a config fails. All examples below use placeholders, not real servers.

## VLESS

```
vless://00000000-0000-0000-0000-000000000000@server.example:443?encryption=none&security=reality&sni=site.example&fp=chrome&pbk=PUBLIC_KEY&sid=SHORT_ID&type=tcp&flow=xtls-rprx-vision#my-config
```

| Part | Meaning |
|---|---|
| `00000000-…` | The user ID (UUID). It is the key: whoever has it can use the server. |
| `server.example:443` | Server address and port. |
| `encryption=none` | VLESS does no encryption of its own; the security layer protects the traffic. |
| `security` | `none`, `tls` or `reality`. |
| `sni` | The server name presented in the TLS handshake. With REALITY it is the real site being imitated. |
| `fp` | The TLS fingerprint the client imitates, such as `chrome`. |
| `pbk`, `sid` | REALITY public key and short ID. Both must match the server exactly. |
| `type` | Transport: `tcp`, `ws` (WebSocket), `grpc` and others. |
| `flow` | `xtls-rprx-vision` is the Vision flow, used with REALITY or TLS over TCP. |
| `path`, `host`, `serviceName` | Settings of the WebSocket or gRPC transport, when used. |
| `#my-config` | The label shown in your list. |

## VMess

A `vmess://` link is the prefix followed by Base64 of a small JSON document. Decoded, it looks like this:

```
{"v":"2","ps":"my-config","add":"server.example","port":"443","id":"00000000-0000-0000-0000-000000000000","aid":"0","scy":"auto","net":"ws","type":"none","host":"server.example","path":"/path","tls":"tls","sni":"server.example"}
```

`add` and `port` are the server, `id` is the UUID, `aid` is the legacy alter ID (it should be `0`), `net` is the transport, `host` and `path` belong to WebSocket, `tls` turns TLS on and `ps` is the label. To decode one by hand, take the text after `vmess://` and run it through `base64 -d`.

## Shadowsocks

```
ss://BASE64(method:password)@server.example:8388#my-config
```

The part before the `@` is the cipher and the password, Base64-encoded. Use an AEAD cipher. Older stream ciphers such as `rc4-md5` or `aes-256-cfb` are weak. Some older links Base64-encode the whole `method:password@host:port` instead.

## Trojan

```
trojan://PASSWORD@server.example:443?security=tls&sni=server.example&type=tcp#my-config
```

The part before the `@` is the password. Trojan needs TLS to protect the traffic, so `security=tls` should be there.

## Subscriptions

A subscription URL returns a list of links, usually Base64-encoded, one per line. The app fetches it, decodes it and adds every link. When a provider replaces blocked servers, refreshing the subscription brings the new ones.

## Mistakes that break a link

The [link decoder](https://v2rc.app/decoder/) checks for the common ones:

- an invalid UUID or port;
- REALITY without a public key or a server name;
- VLESS or Trojan without TLS;
- `allowInsecure` switched on, which turns off certificate checks;
- an outdated Shadowsocks cipher;
- a non-zero VMess alter ID.

One wrong character in `pbk` or `sid` makes a REALITY config fail without any message. See [why a connection can succeed and still load nothing](https://v2rc.app/learn/russia/).

## A link is a credential

The UUID or password inside a link is the key to the server. Anyone who has the link can use it, and on a shared server that can eat into your quota. Do not post links in public chats; a public link gets blocked sooner as well.

The decoder on this site decodes in the page and sends nothing anywhere: the page makes no network requests when it decodes a link. Even so, be careful with any online tool you paste a link into. You can always decode one offline with `base64 -d`, as above.

## Sources

- [Xray configuration examples](https://github.com/XTLS/Xray-examples)
- [REALITY documentation](https://github.com/XTLS/REALITY)
- [Trojan protocol description](https://trojan-gfw.github.io/trojan/protocol)
- [Shadowsocks SIP002](https://shadowsocks.org/doc/sip002.html), which defines the link format