sing-box vs V2Ray / Xray (2026): Which Proxy Should You Choose?

Affiliate disclosure - This article contains a Contabo affiliate link. If you order a VPS via our link, we earn a commission at no extra cost to you. The comparison below reflects the documented features of each project. Check the exact config syntax against each tool's official docs, since it changes between versions.

Short answer: want a focused, proven VLESS + REALITY anti-censorship setup with the largest pool of guides? Choose Xray. Want one binary that is both client and server and also speaks new QUIC protocols (Hysteria2, TUIC)? It also adds Shadowsocks, VMess, VLESS, Trojan and WireGuard, so choose sing-box. Both support REALITY. The real choice is a focused tool vs an all-in-one toolkit. New to these protocols? Start with our V2Ray / VMess / VLESS setup guide.

What each one is

V2Ray (Project V) - the original multi-protocol proxy platform. It introduced VMess and later VLESS, with transports like TCP, WebSocket, HTTP/2, gRPC and QUIC. It is still the main reference, but its original core does not have REALITY.
Xray - a fork of V2Ray that added XTLS Vision and REALITY. It is the core that gets worked on most for getting past censorship. Most "V2Ray" anti-GFW setups in 2026 in fact run Xray under the hood. (We cover a full setup in our V2Ray / VMess & VLESS guide.)
sing-box - a newer all-in-one platform (Go, single binary). It runs many protocols as both client and server: Shadowsocks, VMess, VLESS, Trojan, Hysteria/Hysteria2, TUIC, WireGuard, ShadowTLS and more. It adds TLS/REALITY and several transports. Apps exist for Android (SFA), iOS (SFI) and macOS (SFM).

Source code displayed on a computer screen - proxy cores like sing-box and Xray are configured through JSON; follow the official docs as the schema evolves.

Side-by-side comparison

Criterion	Xray (V2Ray fork)	sing-box
Core focus	VLESS/VMess/Trojan + XTLS Vision + REALITY	Universal: many protocols, one binary
REALITY (anti-DPI)	Yes (introduced REALITY)	Yes
Modern QUIC protocols (Hysteria2, TUIC)	Not native	Yes, built in
WireGuard support	No (separate)	Yes (built in)
Client + server in one tool	Core is server-side focused; many separate clients	Yes, same binary both roles
Official mobile apps	Via third-party clients (v2rayNG, Shadowrocket…)	SFA (Android), SFI (iOS), SFM (macOS)
Tutorials / community size (VLESS+REALITY)	Largest	Growing fast
Config	JSON	JSON (unified)

When to choose which

Choose Xray if your single goal is a tough VLESS + REALITY setup against heavy DPI (China's GFW, Iran, Russia) and you want the most-documented path. It does that one job very well.
Choose sing-box if you want to bring it all into one tool: one binary for the server and all your devices, the freedom to test Hysteria2/TUIC (UDP/QUIC protocols that can run better on lossy or throttled networks), and built-in WireGuard. It is the better "Swiss-army" base if you expect to switch protocols.
Not sure? Both run on a small VPS and both support REALITY, so neither is a wrong answer. Start with the one that matches the guide you'll actually follow. For VLESS + REALITY that's often Xray. For a multi-protocol lab that's sing-box.

Protocols and transports at a glance

The two cores overlap on the classic proxy protocols but diverge on newer ones. This is the clearest factual difference between them.

Shared ground: both speak VLESS, VMess, Trojan and Shadowsocks, and both support REALITY and TLS. Both also offer common transports such as TCP, WebSocket, HTTP/2 and gRPC. So for a VLESS + REALITY tunnel, either core covers you.
Xray's focus: the Xray core is built around the VLESS + XTLS Vision + REALITY stack. XTLS Vision is Xray's own flow-control design that reduces the "TLS-in-TLS" overhead of tunnelling TLS traffic inside a TLS proxy. This is the setup Xray is best known and most documented for.
sing-box's extra protocols: sing-box adds newer QUIC/UDP-based protocols in the same binary, notably Hysteria/Hysteria2 and TUIC, plus WireGuard as a built-in inbound/outbound and ShadowTLS. That breadth is the main reason to reach for sing-box rather than Xray.

How each approaches DPI resistance

Both projects treat REALITY as their front line against deep packet inspection. REALITY works by borrowing the real TLS handshake of a legitimate third-party site (a "steal-oneself's-handshake" design), so that to an observer the connection looks like ordinary HTTPS to that site rather than a proxy. Crucially, it is designed to survive active probing, where a censor connects to your server to see whether it behaves like a proxy: because REALITY forwards unexpected probes toward the genuine target site, a probe sees a normal TLS response instead of a tell-tale proxy.

Xray is the project where REALITY was introduced and where XTLS Vision reduces the double-encryption fingerprint of a TLS tunnel. sing-box implements REALITY too, and layers it on top of its wider protocol set, so you can pair REALITY with, say, a QUIC-based protocol on a separate endpoint. Neither approach is a guaranteed bypass: censorship systems change, and the honest position is that anti-DPI is an ongoing cat-and-mouse rather than a solved problem.

Design and governance

The projects come from different lineages, and that shapes how each is built.

sing-box (SagerNet) is a single multi-purpose binary: the same executable is client and server, with routing rules, DNS handling and multiple inbounds/outbounds configured in one unified JSON file. It is the newer of the two and aims to be a universal platform rather than one protocol's reference.
Xray (Project XTLS) is a community fork of V2Ray (Project V). It stays close to the proxy-core role: it is primarily the engine, with the client experience usually provided by separate third-party apps. Its identity is tied to XTLS Vision and REALITY, the anti-detection features it pioneered.

So the split is not only feature-by-feature. It is one all-in-one toolkit versus a focused proxy core with a large surrounding client ecosystem.

Client ecosystem and configuration

For everyday use, how you connect matters as much as the server core.

Client apps: sing-box ships official companion apps - SFA (Android), SFI (iOS) and SFM (macOS) - that run the same core on the device. Xray does not ship its own consumer apps; instead it is embedded in popular third-party clients such as v2rayNG on Android and Shadowrocket on iOS, which many people already use.
Configuration: both cores are configured with JSON. sing-box uses one unified schema covering inbounds, outbounds, DNS and routing rules in a single file, which suits an all-in-one setup. Xray's JSON is centred on the proxy inbound/outbound with its own routing block. Neither is trivial, and both schemas change between releases - the config, not the install, is where most setups go wrong.

Both need a server to run on

Whichever core you pick, you self-host it on your own VPS. That's what keeps the setup private and under your control. A small instance is plenty for personal use; if you are still choosing a provider, see how Contabo, Hetzner and OVH compare for a self-hosted VPN.

One handy option is a Contabo VPS (Ubuntu 24.04). Pick a datacenter near your target region for lower latency. See Contabo VPS pricing →

Honest caveats

Getting past censorship can break local law in some countries. This article explains the tech; it is not legal advice. Also, proxy-core config schemas change between releases. Treat any config snippet you find (even in guides) as a starting point. Check it against the current official docs for sing-box or Xray before you rely on it.

★ Nuremberg GDPR datacenter · ✓ Dedicated IPv4 included · 200+ Mbps guaranteed

A VPS you fully control for tunneling & obfuscation → ContaboRoot access · open any port · run your own stack→

Frequently asked questions

sing-box or Xray - which should I pick in 2026?

Pick Xray if you want a proven VLESS + REALITY / XTLS Vision setup. It is built to beat DPI-based censorship, and it is the most widely used core for that one job. Pick sing-box if you want one binary that also speaks new QUIC-based protocols (Hysteria2, TUIC). It adds Shadowsocks, VMess, VLESS, Trojan and WireGuard, and works as both client and server on desktop and mobile. Both support REALITY. The choice is mainly about scope: one focused tool, or one that does it all.

What is sing-box?

sing-box is an open-source proxy platform written in Go and shipped as a single binary. It works as both client and server, and it handles many protocols in one tool. Those include Shadowsocks, VMess, VLESS, Trojan, Hysteria/Hysteria2, TUIC, WireGuard, ShadowTLS and more. It also offers TLS, REALITY and several transports. It has mobile apps too: SFA for Android, SFI for iOS, and SFM for macOS.

What is the difference between V2Ray and Xray?

V2Ray (Project V) is the original multi-protocol proxy platform (VMess, VLESS, Trojan, Shadowsocks). Xray is a fork of V2Ray. It adds XTLS Vision and the REALITY anti-detection layer. It is also worked on more often for getting past censorship. If you read 'V2Ray' guides today, most live anti-GFW setups in fact run the Xray core.

Do sing-box, V2Ray and Xray support REALITY?

Xray introduced REALITY, and sing-box supports it too. REALITY hides the fact that you run a proxy. It does this by borrowing the TLS handshake of a real third-party website. That makes it much harder for deep packet inspection to flag the connection. V2Ray's original core does not have REALITY. This is one reason most anti-censorship setups use Xray or sing-box.

Which one is easier to self-host?

sing-box uses a single binary and one config file. That is handy when you want client and server from one tool and want to try new protocols like Hysteria2. Xray is just as easy to deploy. It also has the most community guides for VLESS + REALITY. Either one runs fine on a small VPS. The hard part is writing the config right. Always follow the current official docs, since the schemas change between versions.

Which is better for bypassing the GFW in 2026?

Both are used against the Great Firewall, and both support REALITY, which is currently the leading anti-detection approach for TLS-based proxies. Xray is the core where REALITY and XTLS Vision originated, and it has the largest body of documented VLESS + REALITY setups aimed at heavy DPI. sing-box supports REALITY as well and adds QUIC-based protocols such as Hysteria2 and TUIC that some users prefer on unstable or throttled links. There is no single 'best' answer, because censorship systems and each project evolve; pick the one whose current guide you can follow correctly, and keep the core updated.

Can I use both sing-box and Xray together?

Yes. Because both share the same protocol families (VLESS, VMess, Trojan, Shadowsocks) and both support REALITY, a common pattern is running one core on the server and a different core as the client, as long as the protocol, transport and REALITY settings match on both ends. sing-box can also act as a client to an Xray server and vice versa. The compatibility depends on the exact options you set, so cross-check the config fields against each project's docs.

Do sing-box and Xray work on a standard VPS?

Yes. Both are single self-contained binaries written in Go and run on a normal Linux VPS with a public IP, including small entry-level plans. You do not need a managed or specialised host. Typical requirements are a domain or IP, an open port, and (for REALITY or TLS transports) a target site to borrow the handshake from. Configuration syntax, not hardware, is the main hurdle.