Trojan vs VLESS + Reality: how they differ and when to use each

The short answer

Trojan and VLESS + Reality solve the same problem in two different ways. Both make a VPN connection look like an ordinary HTTPS visit. They differ in whose identity the server shows to the outside world.

Classic Trojan runs a real TLS server with its own domain and certificate. Reality has no certificate of its own. It presents the handshake and certificate of an existing, popular website. That one difference drives most of the trade-offs below. DXVPN offers both among its up to 7 protocols (availability can vary by server), and your subscription link carries both on the Free, Basic, Pro and Family plans.

How Trojan hides as HTTPS

Trojan behaves like a normal HTTPS web server, because that is what it is on the outside. The VPN part only starts once the client proves it knows the password.

1. A standard TLS handshake. The client connects, usually on port 443, and completes TLS with the server's own certificate for its own domain.
2. A password inside the tunnel. The first data the client sends is a hash of its password followed by the address it wants to reach. An observer cannot see this, because it is already encrypted.
3. Right password: tunnel. If the hash matches, the server forwards the traffic as a proxy.
4. Wrong password: website. If it does not match, the server passes the connection to a real web server behind it, often called the decoy or fallback. The visitor sees an ordinary site.

The design idea is simple: do not invent a new traffic pattern, just use the most common one on the internet. The Trojan protocol page describes the format in a few lines.

How VLESS + Reality hides as HTTPS

Reality goes one step further and removes the server's own certificate from the picture. The client puts the name of a real, well-known website in the handshake. The server answers with that site's actual certificate.

A secret key, carried in your config, is checked during the handshake. Connections with the key get the VLESS tunnel. Connections without it are forwarded to the real website, so the visitor sees that site and its genuine certificate. The client also uses a browser-like TLS fingerprint, so the handshake resembles a normal browser visit. We explain each step in VLESS + Reality explained.

How each one handles active probing

Some censors do more than watch. They connect to a suspicious server themselves and see how it responds. This is called active probing, and both protocols were built with it in mind.

• Trojan answers a probe with its decoy website. That works well as long as the decoy looks like a believable site that fits the domain and certificate.
• Reality answers a probe with the real website it imitates. The prober gets the genuine page and the genuine certificate, so there is less to compare against.

In both cases a probe that does not know the secret sees a website, not a VPN. The difference is in the details a determined censor might check. With Trojan, the domain, its age, its certificate and the decoy's content are all things the operator has to get right. With Reality, most of those details belong to a real site that already has a normal history. For a wider view of these techniques, read what deep packet inspection is.

Certificates and domains

This is the most practical difference for anyone who runs a server. For you as a DXVPN user, the provider handles it and your subscription link carries the settings.

• Classic Trojan needs a domain name that points to the server and a valid TLS certificate for it. The certificate must be renewed, and the domain itself can draw attention if it is new or obscure.
• Reality needs no domain or certificate of its own. The operator chooses a suitable real website to imitate, and the Reality documentation gives guidance on which sites work well.
• Trojan over Reality is also possible. DXVPN lists Trojan with TLS or Reality, so Trojan can borrow a real site's identity too.

Side-by-side comparison

The table sums up the main points. DPI resistance is DXVPN's own 1 to 5 rating, not a guarantee.

When to use which

Start with VLESS + Reality where filtering is heaviest. Keep Trojan as your first or second fallback. The two often fail for different reasons, so having both ready is more useful than picking a winner.

• Heavy DPI and active probing. DXVPN's DPI page recommends VLESS + Reality first for Russia, China, Iran and Turkey, with Trojan among the next options in each.
• Reality stops working on a network. Switch to Trojan. A rule that catches one disguise does not always catch the other.
• Older apps. Trojan has been around longer, so some older clients support it but not Reality. Updating the app is usually the better fix.
• Both fail. Try Shadowsocks 2022, another node, or VLESS + WebSocket. The blocked VPN checklist walks through the order.

Using both with DXVPN

You do not have to set up either protocol by hand. Create an account on the sign-up page or through the Telegram bot @dxvpnbot, then install a compatible app from the download page, such as sing-box, Streisand, v2rayNG, Hiddify or Clash Verge.

Import your subscription link and you will see entries for both protocols along with the rest of your plan. The link refreshes every 6 hours, so server changes reach your app without a new setup. Every plan includes VLESS and Trojan: Free, Pro and Family carry up to 7 protocols, and Basic carries VLESS, Trojan and Shadowsocks. Availability can vary by server; the status page lists the nodes that are online. See the pricing section for details.