vmess / vless link decoder and converter
A share link packs a whole proxy config into one line. Paste it here to read what is inside (server, transport, TLS or REALITY, flow), check whether it is safe to use, and turn it into a client config for Xray-core, sing-box or Clash Meta (mihomo). The link holds the server's credentials: it is decoded in your browser and never leaves it.
Runs entirely in your browser: the link and its credentials are never sent anywhere.
One link at a time. An example REALITY link is loaded: replace it with yours.
What the link contains
- Protocol
- VLESS
- Name
- example-reality
- Server
- 203.0.113.10:443
- Transport
- tcp
- Security
- reality
- SNI / Host
- www.example.com
- Flow
- xtls-rprx-vision
- ID or password (shortened)
- 1111...5555
Security review
No blocking problem found in this link.
{
"log": {
"loglevel": "warning"
},
"inbounds": [
{
"tag": "socks-in",
"listen": "127.0.0.1",
"port": 10808,
"protocol": "socks",
"settings": {
"udp": true
}
},
{
"tag": "http-in",
"listen": "127.0.0.1",
"port": 10809,
"protocol": "http"
}
],
"outbounds": [
{
"tag": "proxy",
"protocol": "vless",
"settings": {
"vnext": [
{
"address": "203.0.113.10",
"port": 443,
"users": [
{
"id": "11111111-2222-4333-8444-555555555555",
"encryption": "none",
"flow": "xtls-rprx-vision"
}
]
}
]
},
"streamSettings": {
"network": "tcp",
"security": "reality",
"realitySettings": {
"serverName": "www.example.com",
"fingerprint": "chrome",
"publicKey": "Z84J2IelR9ch3k8VtlVhhs5ycBUlXA7wHBWcBrjqnAw",
"shortId": "6ba85179e30d4fc2",
"spiderX": "/"
}
}
},
{
"tag": "direct",
"protocol": "freedom"
}
]
}A link you did not create runs on someone else's server
Whoever runs it sees your real IP and the sites you visit, and can cut it at any time. For a tunnel only you control, run VLESS REALITY on your own VPS: the Contabo entry VPS includes a public IPv4, root access and plenty of traffic.
Generate your own REALITY config →Affiliate link: we may earn a commission at no extra cost to you. The converter stays free and does not depend on it.
What a share link contains, and why hand conversion breaks
A vmess:// link is a base64-encoded JSON object: decode it and you get fields named add, port, id, net, tls, sni. A vless:// or trojan:// link is closer to a URL: the UUID or password sits before the @, the server and port after it, and every option travels as a query parameter (type, security, sni, fp, pbk, sid, flow). An ss:// link carries the cipher and password, base64-encoded or not depending on the client that produced it.
None of these names match the config files. Xray-core calls the transport streamSettings.network and the REALITY key publicKey; sing-box calls them transport.type and tls.reality.public_key; Clash Meta uses network and reality-opts. Most failed imports come from one field put in the wrong place, a path left URL-encoded, or a gRPC service name that a vmess link stores in its path field. The converter does that mapping for you, then reviews the link for the mistakes that make a connection fail or leak.
The review matters more than the conversion. A vless:// link with security=none sends your traffic without any encryption, a link with allowInsecure=1 accepts any certificate, and an old vmess link with alterId above 0 will not work with current cores. The converted configs always keep certificate checking on.
Where each link field goes
The same value has a different name in the link, in Xray-core and in sing-box. This is the mapping the converter applies.
| In the link | What it is | Xray-core | sing-box |
|---|---|---|---|
| add / host@ | Server address (IP or domain) | address | server |
| port | Server port | port | server_port |
| id / uuid@ | User ID (VLESS, VMess) or password (Trojan) | users[].id | uuid |
| net / type | Transport: tcp, ws, grpc, httpupgrade, xhttp | streamSettings.network | transport.type |
| tls / security | Transport security: none, tls or reality | streamSettings.security | tls.enabled, tls.reality |
| sni | Server name sent in the TLS handshake | tlsSettings.serverName | tls.server_name |
| fp | uTLS fingerprint the client imitates (chrome, firefox...) | fingerprint | tls.utls.fingerprint |
| pbk, sid | REALITY public key and short ID | realitySettings.publicKey, shortId | tls.reality.public_key, short_id |
| flow | xtls-rprx-vision, only over TCP with TLS or REALITY | users[].flow | flow |
| host, path | WebSocket or HTTPUpgrade Host header and path | wsSettings.host, path | transport.headers.Host, path |
| serviceName | gRPC service name | grpcSettings.serviceName | transport.service_name |
Circumventing network restrictions is restricted or unlawful in some jurisdictions. Check what applies where you are. Only use links for servers you are allowed to use.