When you get a link, first check whether it contains the settings for one server or points to a remote list of configurations. This guide is for anyone importing a configuration for the first time, moving to a new device, or troubleshooting subscription updates. Identify the vmess://, vless://, or HTTPS subscription URL, check the key settings, then import it in your client and verify that it connects.
Share Links vs. Subscription URLs: Settings or a Server List?
vmess:// and vless:// are typically share formats for a single configuration. The client reads the server address, port, credentials, and transport options from the link, then saves them as a local configuration. Copying two share links lets you import two entries at once, but that still does not create an updatable subscription.
A subscription URL is usually an HTTPS URL. The client visits it, retrieves the configuration list from the server, then parses and updates it. The URL may contain an account token; whether its path includes sub or ends in a particular file extension is not a reliable way to identify it. A regular webpage URL or a link to a single JSON file may not work as a subscription endpoint.
Subscription URL
RecommendedA set of configurations maintained over time. Use the update function to fetch the list again. If the provider changes server addresses or ports, or adds or removes configurations, the client must update successfully to get those changes.
Best for: Keeping configurations in sync when your provider offers a subscription URL.
Single share link
A snapshot of the settings at the time of import. Reimporting the same link usually won't pick up changes the provider has made since then.
Best for: Quick tests, checking one configuration, or moving a small number of known settings.
This recommendation assumes you have a trusted subscription source. A subscription is not a connection protocol, and it does not guarantee that every configuration in the list will work. VMess and VLESS are connection protocols; a subscription is a way to distribute and update configurations. They serve different purposes.
vmess://: Decode It, Then Check the Address, Transport, and TLS
A common VMess share format consists of vmess:// followed by a Base64-encoded JSON object. Base64 is an encoding, not encryption, so it does not hide credentials such as a UUID. Formats vary between tools, so not every Base64 string is a VMess configuration.
Here is the structure of a typical share link after decoding. The domain and UUID are illustrative only and do not point to a working service. These short keys belong to the share format; they are not a complete core configuration you can paste and run.
{
"v": "2",
"ps": "VMess example",
"add": "edge.example.org",
"port": "443",
"id": "123e4567-e89b-42d3-a456-426614174000",
"aid": "0",
"scy": "auto",
"net": "ws",
"type": "none",
"host": "edge.example.org",
"path": "/gateway",
"tls": "tls",
"sni": "edge.example.org"
}addandport: The server address and port used for the connection. The port must match the server's listening port; don't change it to 443 just because the example uses that port.id: The VMess user UUID.aidis a legacy compatibility field. Modern VMess AEAD configurations typically use 0; don't change it to another value without a reason.net,host, andpath: This example uses WebSocket.hostis the request Host header, andpathis the request path. Both must match the server or reverse proxy settings.tlsandsni: These control TLS and the server name used for it. The connection address, request Host, and TLS server name may be the same, or the server may be configured to use different values.ps: Usually a display label. Changing it won't fix an incorrect address, UUID, or transport setting.
Being able to read the fields after decoding does not mean the client supports every combination. The GUI client parses the share format and generates a configuration; the core handles the connection. When troubleshooting, check both the imported configuration and the capabilities of the core in use.
vless://: Query Parameters Set the Transport and Security
VLESS share links commonly use a URI structure: the UUID comes before @, followed by the server address and port. Query parameters come after the question mark, and the label comes after the hash. This example shows VLESS with WebSocket and TLS; it is not a working connection link.
vless://[email protected]:443?encryption=none&security=tls&type=ws&host=edge.example.org&path=%2Fgateway&sni=edge.example.org#VLESS-WS-TLS| Field | Example value | What to check |
|---|---|---|
encryption | none | This does not mean TLS is disabled; it is separate from the outer security setting. |
security | tls | This example uses TLS. Changing the label alone will not switch the server to REALITY. |
type | ws | The transport must match the server configuration. |
path | %2Fgateway | URI-decodes to /gateway; avoid encoding it twice. |
sni | edge.example.org | The server name used for the TLS handshake; set it as required by the server. |
For a REALITY configuration, check the corresponding parameters, such as pbk, sid, and fp, against the source. Whether to use flow=xtls-rprx-vision depends on the server and transport combination. Don't add a Vision field to the WebSocket example above and assume that upgrades the protocol.
Bottom line: Check Each Setting After Importing; Don't Change the Protocol First
Start by checking five groups of settings: address, port, UUID, transport, and security. Test the connection only after confirming that the source settings are complete and the client supports that combination. Switching TLS, REALITY, or transport types at random can introduce new mismatches.
v2rayN and v2rayNG: Choose the Import Method for Your Link Type
The steps below use common Chinese menu labels. Button locations and wording may vary by version, so look for functions such as “Import from clipboard,” “Subscription group settings,” and “Update subscription.” Importing, selecting a configuration, starting a connection, and enabling the proxy are separate actions. Seeing an entry in the list does not mean setup is complete.
Import on Either Client: First Identify a Single Link or a Subscription
Desktop: v2rayN
- Single link: Copy the full link, then choose “Server” → “Import bulk URL from clipboard” in the main window. You can also press Ctrl+V in versions that support this shortcut.
- Subscription URL: Go to “Subscription group” → “Subscription group settings,” add a group, and enter a label and URL. Save it, then choose “Update subscription.”
- After the update, select the configuration you want, choose “Set as active server” from the right-click menu, and configure the system proxy if needed.
Android: v2rayNG
- Single link: Copy the full link, tap “+” in the upper-right corner, then choose “Import from clipboard.”
- Subscription URL: Open the side menu and choose “Subscription group settings.” Tap “+” to add a label and URL, save, then return to the main screen and choose “Update subscription.”
- Select the configuration you want and tap the connect button. The first time you connect, approve the VPN connection when prompted by the system, then check the connection status and logs.
You can add the same subscription to both clients, but update schedules, the selected configuration, and local routing settings won't sync automatically.
v2rayNG uses the Xray core; v2flyNG uses the v2fly core. Similar interfaces or the same subscription source do not mean they support exactly the same protocol extensions. For specific VLESS security and flow-control combinations, check the capabilities of the core in use. A link being recognized does not mean it will work.
- Before importing, make sure the clipboard contains only the link—not chat instructions, quotation marks, inserted line breaks, or Chinese punctuation at the end.
- After importing, open the edit screen and check the server, port, transport, and TLS settings. Don't rely on the label alone.
- After updating a subscription, check that entries appear in the intended group, then select one as the active configuration.
- Once connected, test with the application you actually use and check the logs to diagnose connection and routing issues.
Subscription Updates and Port Checks: Two Separate Connections
A subscription update uses the “client connects to the subscription server” path. Everyday traffic uses the “app connects to the local proxy, then the core connects to the remote server” path. One working does not mean the other will. A successful subscription download only confirms that the list was fetched and parsed; it does not mean every server in it is reachable.
These numbers show what to check; they are not universal defaults. The remote port comes from the configuration provider. For the local port, use the listening settings shown under v2rayN “Settings” → “Parameter settings.” If the local SOCKS inbound is listening on 127.0.0.1:10808, you can explicitly specify the proxy in a terminal with the command below.
curl --proxy socks5h://127.0.0.1:10808 --connect-timeout 10 --max-time 20 --head https://example.com/socks5h tells the proxy to resolve the destination hostname. The 10-second and 20-second values set the connection timeout and total timeout for this command. If it fails, note the error instead of comparing just one run's timing. Check separately whether your browser uses the system proxy and whether the terminal explicitly specifies a proxy.
- Cannot connect to the local port: Check that the core is running, the listening port is correct, and nothing else is using that port.
- Connected to the local proxy, but the remote handshake failed: Check the address, UUID, TLS server name, transport path, and system clock.
- Only subscription updates time out: Check whether the subscription domain is reachable. If your version offers a “Update through proxy” option, try it when you already have a working connection.
- Fewer configurations appear after an update: Check that you selected the right group, whether the subscription contents changed, and whether the logs show a parsing error.
Common Import and Update Questions
Why does an HTTPS URL return “No valid configurations found”?
First, make sure you copied the subscription endpoint, not an account management page URL. Paste it into the URL field under “Subscription group settings,” then run an update. Don't treat a remote URL as a single VMess or VLESS link. If it still fails, check the logs for a sign-in page, access denial, or unsupported content format. Don't share your token while troubleshooting.
Why didn't the subscription update change anything after I imported a single link?
A single link is saved as a local snapshot and is not automatically linked to a subscription source. Add the actual subscription URL separately and update the relevant group. Don't put a share link in the subscription URL field or expect a new server configuration after changing the label.
Why did my manual changes disappear after refreshing the subscription?
Depending on the client version and update method, a subscription update may regenerate or overwrite entries in the group. To keep manual changes, copy the configuration to a separate local group and check the source of both entries so you don't select the wrong one next time.
Can I use an online decoder to inspect a share link?
A link may contain a UUID, subscription token, or server details. Check it in the client's edit screen first, or use a trusted offline tool. Don't post a full link, QR code, or unredacted logs in a public forum. If credentials have been exposed, reset them in your provider's dashboard and update the configurations on both clients.
Final Checks Before Moving to a New Device
A share link usually carries connection settings; a subscription usually provides a configuration list. Don't assume system proxy settings, per-app rules, DNS, routing, local inbound ports, or log levels will move with them. If the same source works differently on two devices, compare these local settings before blaming the remote service.
- Make sure the client and core on the target device support the protocol combination you need.
- When moving a subscription, keep the trusted source and check the update results and last updated times on both devices.
- Test with one verified configuration first. Avoid changing DNS, routing, and transport options at the same time.
- For routing and local inbound settings, see the JSON manual. New users can follow the Getting Started guide step by step.