sing-box vs Xray (2026): REALITY, Hysteria2, Which to Pick

Short answer: want a focused, proven VLESS + REALITY anti-censorship setup with the largest pool of guides? Choose Xray. Want one binary that is both client and server and also speaks new QUIC protocols (Hysteria2, TUIC)? It also adds Shadowsocks, VMess, VLESS, Trojan and WireGuard, so choose sing-box. Both support REALITY. The real choice is a focused tool vs an all-in-one toolkit. New to these protocols? Start with our V2Ray / VMess / VLESS setup guide.

Whichever you pick, the server side runs on a VPS outside the censored network. One option that fits is a HostPapa Unmanaged VPS Lite (affiliate link, 2.95 $ a month on a 3-year term, then the regular rate) or a Contabo Cloud VPS on Ubuntu 24.04 (affiliate link), from 5.50 € a month on a 24-month term as read on 17 October 2026; choose a datacenter close to your users for lower latency. HostPapa's Lite plan is the smallest one here: 1 core, 1 GB RAM, 25 GB NVMe and 4 TB transfer, unmanaged (root SSH on Ubuntu or Debian, no control panel, you install sing-box or Xray yourself), enough for a proxy server for a few users, 30-day money-back guarantee, read on 28 October 2026.

Bank card declined? Ultahost also takes Bitcoin and other cryptocurrencies, Alipay, WeChat Pay and Qiwi (its payments page, read on 25 October 2026). This is an affiliate link; check its terms for your country before ordering.

Not sure yet? You do not have to commit before testing. Our free VLESS REALITY config generator writes the server and client configs for both cores from the same keys, and if you already have a vless:// or vmess:// link, the share link converter turns it into an Xray config and a sing-box config side by side, with a security review of the link. Both run in your browser.

Keeping the values straight is where most REALITY setups break. Our free VLESS REALITY Cheat Sheet (3-page PDF, direct download, no sign-up) puts the Xray, sing-box and vless:// names of each field side by side, with the server checks and the usual failure causes. Download the cheat sheet.

REALITY needs a server you control

More RAM for the same job? see the Contabo Cloud VPS offer

Affiliate link: we may earn a commission, at no extra cost to you. The generator stays free and does not depend on it.

See HostPapa VPS Lite, 2.95 $/mo on 3 years

Runs entirely in your browser: keys, UUID and configs are generated locally and never sent anywhere.

Server address

Your VPS public IP (or a domain pointing to it). Used in the client config and the share link.

Port

443 is the norm: REALITY imitates HTTPS.

Target site (SNI)

A third-party site with TLS 1.3 and HTTP/2, reachable from your clients. See the checklist below the tool.

Profile name

uTLS fingerprint (client)

chromefirefoxsafariiosandroidedgerandom

The TLS fingerprint the client imitates. chrome is the usual choice.

X25519 key pair

Private key (server)

Public key (clients)

New key pairDerive public key

The private key goes on the server only. The public key goes to every client.

User UUID

New

Short ID

New

Hex, even length, up to 16 characters.

• The keys are missing or invalid (32 bytes, base64url, 43 characters). Generate a pair or paste yours.

vless:// share link

vless://@203.0.113.10:443?encryption=none&flow=xtls-rprx-vision&security=reality&sni=www.example.com&fp=chrome&pbk=&sid=&type=tcp&headerType=none#my-reality

Copy

Import it in v2rayN, v2rayNG, Hiddify, Streisand or Shadowrocket, or scan the QR code.

Xray-coresing-box

config.json- Xray server, /usr/local/etc/xray/config.json

CopyDownload

{
  "log": {
    "loglevel": "warning"
  },
  "inbounds": [
    {
      "listen": "0.0.0.0",
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "",
            "flow": "xtls-rprx-vision",
            "email": "my-reality"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "target": "www.example.com:443",
          "xver": 0,
          "serverNames": [
            "www.example.com"
          ],
          "privateKey": "",
          "shortIds": [
            ""
          ]
        }
      },
      "sniffing": {
        "enabled": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ],
        "routeOnly": true
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom",
      "tag": "direct"
    },
    {
      "protocol": "blackhole",
      "tag": "block"
    }
  ]
}

client-xray.json- Xray client, SOCKS 127.0.0.1:10808 and HTTP 10809

CopyDownload

{
  "log": {
    "loglevel": "warning"
  },
  "inbounds": [
    {
      "listen": "127.0.0.1",
      "port": 10808,
      "protocol": "socks",
      "settings": {
        "udp": true
      }
    },
    {
      "listen": "127.0.0.1",
      "port": 10809,
      "protocol": "http"
    }
  ],
  "outbounds": [
    {
      "protocol": "vless",
      "tag": "proxy",
      "settings": {
        "vnext": [
          {
            "address": "203.0.113.10",
            "port": 443,
            "users": [
              {
                "id": "",
                "flow": "xtls-rprx-vision",
                "encryption": "none"
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "reality",
        "realitySettings": {
          "serverName": "www.example.com",
          "fingerprint": "chrome",
          "publicKey": "",
          "shortId": "",
          "spiderX": "/"
        }
      }
    },
    {
      "protocol": "freedom",
      "tag": "direct"
    }
  ]
}

install.sh- install, check and start on the server

CopyDownload

# Install Xray-core with the official script (systemd service included)
bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install

# Optional: confirm the public key matches the private key
xray x25519 -i ""

# Check that the target answers in TLS 1.3 and HTTP/2
xray tls ping www.example.com

# Open the port
sudo ufw allow 443/tcp

# Paste the server config, test it, then start the service
sudo nano /usr/local/etc/xray/config.json
xray run -test -c /usr/local/etc/xray/config.json
sudo systemctl restart xray && sudo systemctl enable xray

# Follow the log while the first client connects
sudo journalctl -u xray -f

REALITY needs a server you control

A REALITY server is a VPS with a public IP and port 443 free, nothing more. Contabo's entry VPS includes a public IPv4, root access and a large traffic allowance, and you can pick the datacenter closest to your users.

Second option, a US host with a 30-day money-back guarantee: Ultahost VPS Basic, 5.52 $/mo on a 24-month term, 1 CPU, 1 GB DDR5 and a dedicated IPv4 (read on 21 October 2026), enough for one Xray server. It also takes Bitcoin and other cryptocurrencies, Alipay, WeChat Pay and Qiwi (its payments page, read on 25 October 2026), which helps if your bank card is declined; check its terms for your country before ordering. See Ultahost VPS

Affiliate link: we may earn a commission, at no extra cost to you. The generator stays free and does not depend on it.

See the Contabo VPS

Want files already tested end to end?

The VLESS + REALITY config pack holds a commented Xray server on port 443, a desktop client (local SOCKS5 and HTTP proxy), a vless:// template for v2rayN, v2rayNG and Shadowrocket, and two things this generator does not write: a server variant with per-device traffic counters, and a README with a 10-point troubleshooting checklist. Every JSON file passes xray run -test on Xray-core 26.10.31. Xray-core only, no sing-box files.

See the VLESS + REALITY config pack (4.90 EUR)

Our own product, one payment, ZIP of text files. Templates for your own server, not a VPN subscription, and no promise that REALITY keeps passing a given DPI. The files generated above work without it.

What is sing-box, and what is Xray?

• V2Ray (Project V) - the original multi-protocol proxy platform. It introduced VMess and later VLESS, with transports like TCP, WebSocket, HTTP/2, gRPC and QUIC. It is still the main reference, but its original core does not have REALITY.
• Xray - a fork of V2Ray that added XTLS Vision and REALITY. It is the core that gets worked on most for getting past censorship. Most "V2Ray" anti-GFW setups in 2026 in fact run Xray under the hood. (We cover a full setup in our V2Ray / VMess & VLESS guide.)
• sing-box - commonly written singbox in forums and search boxes, while the project itself spells it with the hyphen; the binary, the package and the config key are all sing-box. It is a newer all-in-one platform (Go, single binary). It runs many protocols as both client and server: Shadowsocks, VMess, VLESS, Trojan, Hysteria/Hysteria2, TUIC, WireGuard, ShadowTLS and more. It adds TLS/REALITY and several transports. Apps exist for Android (SFA), iOS (SFI) and macOS (SFM).

Side-by-side comparison

Which should you choose, sing-box or Xray?

• Choose Xray if your single goal is a tough VLESS + REALITY setup against heavy DPI (China's GFW, Iran, Russia) and you want the most-documented path. It does that one job very well.
• Choose sing-box if you want to bring it all into one tool: one binary for the server and all your devices, the freedom to test Hysteria2/TUIC (UDP/QUIC protocols that can run better on lossy or throttled networks), and built-in WireGuard. It is the better "Swiss-army" base if you expect to switch protocols.
• Not sure? Both run on a small VPS (which VPS suits V2Ray/Xray) and both support REALITY, so neither is a wrong answer. Start with the one that matches the guide you'll actually follow. For VLESS + REALITY that's often Xray. For a multi-protocol lab that's sing-box.

What you need to try one

Both cores run on any small Linux VPS with a public IP, and the server is the one part you cannot borrow: it has to sit outside the network that filters you. Our free VLESS REALITY config generator writes the server and client configs for Xray and for sing-box from the same keys, generated in your browser, so you can install one core, test it, and switch to the other without regenerating anything.

If you connect from China or Iran, the datacenter location matters more than the specs. Contabo has Singapore and Tokyo locations besides Europe and the US, and its entry plan (4 vCPU, 8 GB RAM, €5.50/month for the first 24 months) is far more than a personal proxy needs. No provider's IP ranges are guaranteed to stay reachable, so treat the server as replaceable and keep your config ready to redeploy on a new IP.

Protocols and transports at a glance

The two cores overlap on the classic proxy protocols but diverge on newer ones. This is the clearest factual difference between them.

• Shared ground: both speak VLESS, VMess, Trojan and Shadowsocks, and both support REALITY and TLS. Both also offer common transports such as TCP, WebSocket, HTTP/2 and gRPC. So for a VLESS + REALITY tunnel, either core covers you.
• Xray's focus: the Xray core is built around the VLESS + XTLS Vision + REALITY stack. XTLS Vision is Xray's own flow-control design that reduces the "TLS-in-TLS" overhead of tunnelling TLS traffic inside a TLS proxy. This is the setup Xray is best known and most documented for.
• sing-box's extra protocols: sing-box adds newer QUIC/UDP-based protocols in the same binary, notably Hysteria/Hysteria2 and TUIC, plus WireGuard as a built-in inbound/outbound and ShadowTLS. That breadth is the main reason to reach for sing-box rather than Xray.

Which one resists deep packet inspection better?

Both projects treat REALITY as their front line against deep packet inspection. REALITY works by borrowing the real TLS handshake of a legitimate third-party site (a "steal-oneself's-handshake" design), so that to an observer the connection looks like ordinary HTTPS to that site rather than a proxy. Crucially, it is designed to survive active probing, where a censor connects to your server to see whether it behaves like a proxy: because REALITY forwards unexpected probes toward the genuine target site, a probe sees a normal TLS response instead of a tell-tale proxy.

Xray is the project where REALITY was introduced and where XTLS Vision reduces the double-encryption fingerprint of a TLS tunnel. sing-box implements REALITY too, and layers it on top of its wider protocol set, so you can pair REALITY with, say, a QUIC-based protocol on a separate endpoint. Neither approach is a guaranteed bypass: censorship systems change, and the honest position is that anti-DPI is an ongoing cat-and-mouse rather than a solved problem.

Design and governance

The projects come from different lineages, and that shapes how each is built.

• sing-box (SagerNet) is a single multi-purpose binary: the same executable is client and server, with routing rules, DNS handling and multiple inbounds/outbounds configured in one unified JSON file. It is the newer of the two and aims to be a universal platform rather than one protocol's reference.
• Xray (Project XTLS) is a community fork of V2Ray (Project V). It stays close to the proxy-core role: it is primarily the engine, with the client experience usually provided by separate third-party apps. Its identity is tied to XTLS Vision and REALITY, the anti-detection features it pioneered.

So the split is not only feature-by-feature. It is one all-in-one toolkit versus a focused proxy core with a large surrounding client ecosystem.

The licences are not the same, and comparisons keep leaving this out

Both projects are open source, and most side-by-side write-ups stop at that word. They are not under the same terms, and it is the kind of difference that matters if you ship something built on one of them.

Xray-core is Mozilla Public License 2.0. GitHub's API normalises it as MPL-2.0. It is a file-level copyleft: modify an MPL file and that file stays MPL, but you may combine it with code under other licences.

sing-box is GPL version 3 or later, plus a clause of its own. Its LICENSE file carries the standard GPLv3-or-later grant, then adds:

In addition, no derivative work may use the name or imply association with this application without prior consent.

That added sentence is why GitHub does not normalise it: the API reports Other / NOASSERTION rather than GPL-3.0, because the text is no longer the unmodified licence. (Both values read from the GitHub API on 20 August 2026, alongside 41,119 stars for Xray-core and 37,139 for sing-box.)

If you self-host for your own use, none of this reaches you, running software is not redistributing it. If you are building a product, a service or an appliance on one of these cores, "GPLv3-or-later with a naming restriction" and "MPL-2.0" are very different starting points, and that is a question for whoever handles your licensing rather than something to settle from a comparison article.

Which clients work with sing-box and Xray?

For everyday use, how you connect matters as much as the server core.

• Client apps: sing-box ships official companion apps - SFA (Android), SFI (iOS) and SFM (macOS) - that run the same core on the device. Xray does not ship its own consumer apps; instead it is embedded in popular third-party clients such as v2rayNG on Android and Shadowrocket on iOS, which many people already use.
• Configuration: both cores are configured with JSON. sing-box uses one unified schema covering inbounds, outbounds, DNS and routing rules in a single file, which suits an all-in-one setup. Xray's JSON is centred on the proxy inbound/outbound with its own routing block. Neither is trivial, and both schemas change between releases - the config, not the install, is where most setups go wrong.

"sing-box or v2rayN?" is the wrong comparison

This question comes up constantly, and it mixes two different kinds of software.

sing-box is a core. It speaks the protocols, terminates the tunnel and routes traffic. v2rayN is a client - a Windows desktop front-end that manages your profiles, imports subscription links and starts and stops the connection. It does not implement the protocols itself: it drives a core underneath. Depending on the build you install, that core is V2Ray, Xray or sing-box.

So the two are not alternatives. The honest way to phrase the decision is in two parts:

• Which core do you want handling the protocol and the DPI resistance - sing-box or Xray? That is the comparison this page makes above.
• Which client do you want driving it on your machine? On Windows, v2rayN is the common answer whichever core you pick. On Android the equivalent is v2rayNG, and sing-box also ships its own official apps (SFA, SFI, SFM).

If you already run v2rayN and are wondering whether to "switch to sing-box", what you are really considering is changing the core it launches - not replacing the application. Check which cores your v2rayN build supports before assuming either way, since that varies by release.

How do you migrate from Xray to sing-box?

A question that comes up once people have chosen: can you just convert the config file? Not by hand-editing it, no. A migration from V2Ray to sing-box re-creates the configuration rather than translating it, the two cores describe the same connection with different key names, so there is no find-and-replace that gets you there.

The shape of the difference, taking a VMess outbound as the example:

Two practical notes on top of the renaming. Xray's current documentation shows the VMess outbound with address, port and id directly under settings, rather than the older vnext array many published examples still use, so even configs within the same lineage do not all look alike. And sing-box splits into tls and transport what Xray keeps together under streamSettings, which is where a mechanical field-by-field copy usually goes wrong.

The reliable route is therefore to write the sing-box outbound from the server parameters you already know (host, port, UUID, transport, TLS settings) rather than from the old file, then validate it before running anything: sing-box check -c config.json reports schema errors, and sing-box format -w -c config.json rewrites the file in canonical form. As the caveat below says, check field names against the current docs for the version you actually installed, because these schemas do change between releases.

If you use v2rayN on Windows, the migration is a different job. You are not rewriting a server config there, you are swapping which core the client drives, since v2rayN can run either the Xray core or the sing-box core underneath the same interface. That changes which options the GUI exposes and, more importantly, which component resolves DNS. We cover that switch and its one recurring trap in v2rayN with the sing-box core.

What server do you need to run either of them?

If plain WireGuard is enough for your network and you do not need an obfuscated protocol, our free WireGuard config generator gives you a working server and client config in a minute, keys generated in your browser. The generator is free with no account, up to 250 devices, and its ZIP export holds every client .conf and its QR code as a PNG, handy to set up a whole office or family in one go.

Whichever core you pick, the tunnel breaks the same way when the MTU is wrong: small requests succeed, large transfers stall, and the connection drops under load. That profile is routinely blamed on the provider. mtu-probe measures the largest packet your path actually carries, so you can set the interface MTU from a measurement rather than from a default, subtract 60 bytes for WireGuard over IPv4, 80 over IPv6.

Whichever core you pick, you self-host it on your own VPS. That's what keeps the setup private and under your control. A small instance is plenty for personal use; if you are still choosing a provider, see how Contabo, Hetzner and OVH compare for a self-hosted VPN.

One handy option is a Contabo VPS (Ubuntu 24.04). Pick a datacenter near your target region for lower latency. See Contabo VPS pricing →

Once the VPS is up, our VLESS REALITY config generator writes the server and client configs for either core, Xray or sing-box, from the same keys, so you can try both.

What should make you hesitate?

Getting past censorship can break local law in some countries. This article explains the tech; it is not legal advice. Also, proxy-core config schemas change between releases. Treat any config snippet you find (even in guides) as a starting point. Check it against the current official docs for sing-box or Xray before you rely on it.

And if maintaining a proxy core is more than you want to take on, the turnkey route is a commercial VPN with obfuscated servers, such as NordVPN (now running on its NordWhisper protocol). The trade-off is real: its server IPs are shared and known to censors, so in a heavily filtered country it gets blocked more often than your own REALITY server.

Your VPN hides your IP. It does not hide your browser.

A correctly configured WireGuard tunnel replaces the address a site sees. It changes nothing about what your browser announces on its own: fonts, screen, time zone, graphics stack. That combination is often unique enough to follow you across sessions, tunnel or no tunnel.

Measure your own browser fingerprint, passive, no questions, no account, no email. It tells you how many browsers out of N look like yours, and which attribute makes you stand out.

Related guides

• v2rayN explained: the Windows client for VLESS and VMess
• Hysteria2 masquerade: hiding the tunnel behind a plausible site
• V2Ray setup: VMess & VLESS for China, Iran, Russia
• Shadowsocks vs VPN: technical comparison
• Cloak: TLS obfuscation for self-hosted VPN
• Anti-DPI: bypassing deep packet inspection
• Russia's VPN crackdown in 2026: what's blocked and what still works
• v2rayN with the sing-box core: what changes, and the DNS trap

Both cores still need a server to run on. If that part is not settled yet, our cheapest-VPS comparison for WireGuard lists what each provider charges for the specs these setups actually need.