Affiliate disclosure — This article contains a Contabo affiliate link. If you order a VPS via our link, we earn a commission at no extra cost to you. The comparison below reflects the documented capabilities of each project; verify exact config syntax against each tool's official documentation, as it changes between versions.
Short answer: if you want a focused, battle-tested VLESS + REALITY anti-censorship setup with the largest pool of tutorials, choose Xray. If you want one unified binary that is both client and server and also speaks modern QUIC protocols (Hysteria2, TUIC) alongside Shadowsocks, VMess, VLESS, Trojan and WireGuard, choose sing-box. Both support REALITY; the real decision is focused tool vs all-in-one toolkit.
What each one is
- V2Ray (Project V) — the original multi-protocol proxy platform. Introduced VMess and later VLESS, with transports like TCP, WebSocket, HTTP/2, gRPC and QUIC. Still the conceptual reference, but its original core does not implement REALITY.
- Xray — a fork of V2Ray that added XTLS Vision and REALITY, and is generally the more actively developed core for censorship circumvention. Most "V2Ray" anti-GFW setups in 2026 actually run Xray under the hood. (We cover a full setup in our V2Ray / VMess & VLESS guide.)
- sing-box — a newer universal platform (Go, single binary) that unifies many protocols as both client and server: Shadowsocks, VMess, VLESS, Trojan, Hysteria/Hysteria2, TUIC, WireGuard, ShadowTLS and more, with TLS/REALITY and multiple transports. Companion apps exist for Android (SFA), iOS (SFI) and macOS (SFM).
Side-by-side comparison
| Criterion | Xray (V2Ray fork) | sing-box |
|---|---|---|
| Core focus | VLESS/VMess/Trojan + XTLS Vision + REALITY | Universal: many protocols, one binary |
| REALITY (anti-DPI) | Yes (introduced REALITY) | Yes |
| Modern QUIC protocols (Hysteria2, TUIC) | Not native | Yes, built in |
| WireGuard support | No (separate) | Yes (built in) |
| Client + server in one tool | Core is server-side focused; many separate clients | Yes, same binary both roles |
| Official mobile apps | Via third-party clients (v2rayNG, Shadowrocket…) | SFA (Android), SFI (iOS), SFM (macOS) |
| Tutorials / community size (VLESS+REALITY) | Largest | Growing fast |
| Config | JSON | JSON (unified) |
When to choose which
- Choose Xray if your single goal is resilient VLESS + REALITY against heavy DPI (China's GFW, Iran, Russia) and you want the most-documented path. It does that one job extremely well.
- Choose sing-box if you want to consolidate: one binary for server and all your devices, the freedom to test Hysteria2/TUIC (UDP/QUIC protocols that can perform better on lossy or throttled networks), and built-in WireGuard. It is the better "Swiss-army" base if you expect to switch protocols.
- Not sure? Both run on a small VPS and both support REALITY, so neither is a wrong answer. Start with whichever matches the tutorial you'll actually follow — for VLESS + REALITY that's often Xray; for a multi-protocol lab that's sing-box.
Both need a server to run on
Whichever core you pick, you self-host it on your own VPS — that's what keeps the setup private and under your control. A small instance is plenty for personal use.
A practical option is a Contabo VPS (Ubuntu 24.04); pick a datacenter near your target region for lower latency. See Contabo VPS pricing →
Honest caveats
Bypassing censorship can violate local law in some countries — this article explains the technology, it is not legal advice. And proxy-core config schemas change between releases: treat any config snippet you find (including in tutorials) as a starting point and verify it against the current official documentation for sing-box or Xray before relying on it.
Related guides
- V2Ray setup: VMess & VLESS for China, Iran, Russia
- Shadowsocks vs VPN: technical comparison
- Cloak: TLS obfuscation for self-hosted VPN
- Anti-DPI: bypassing deep packet inspection
★ Nuremberg GDPR datacenter · ✓ Dedicated IPv4 included · 200+ Mbps guaranteed
A VPS you fully control for tunneling & obfuscation → ContaboRoot access · open any port · run your own stack→
