One line to remember
Default to Hysteria2 for speed. Switch to VLESS Reality when Hysteria2 won’t connect. A network that blocks unfamiliar UDP kills Hysteria2 first; Reality walks through on TCP 443.
Hysteria2 vs VLESS (Xray): Which One and When?
Hysteria2 and VLESS are the two protocols people mean in 2026 when they say “a VPN that gets through”. They’re often mentioned together, but they solve the problem from opposite directions, and the right one depends on the network you’re standing on. Here’s the honest comparison.
First, the terminology
- VLESS is a lightweight proxy protocol native to the Xray ecosystem. On its own it carries no camouflage; paired with REALITY, its TLS layer presents the genuine handshake of a real, well-known website. When people say “VLESS” in a stealth context, they almost always mean VLESS + Reality.
- Hysteria2 is a separate project, not part of Xray. It runs on QUIC, the UDP transport behind HTTP/3, with its own congestion control.
- Modern clients (sing-box based apps like V2Box and Hiddify) speak both, which is why they live side by side in the same subscription.
The comparison
| Hysteria2 | VLESS Reality | |
|---|---|---|
| Transport | QUIC (UDP) | TCP, port 443 |
| What the network sees | Traffic resembling HTTP/3 | A genuine TLS session with a real website |
| Strongest at | Speed on bad networks: lossy, congested, throttled links | Maximum stealth: survives SNI filtering, TLS fingerprinting and active probing |
| Weakness | Strict networks that block unfamiliar UDP entirely | Small camouflage overhead; no special help on lossy links |
| Typical home turf | Hotel Wi-Fi, crowded mobile data, long international routes | DPI-heavy networks and countries, UDP-blocked firewalls |
Why Hysteria2 wins on speed
TCP interprets packet loss as congestion and slows itself down, which is why ordinary protocols crawl on hotel Wi-Fi even when bandwidth exists. Hysteria2’s congestion control keeps pushing at the rate the link can actually carry, so on a lossy 100 Mbps line it simply uses the 100 Mbps. On a clean network the difference shrinks; on a bad one it’s dramatic.
Why VLESS Reality wins on stealth
Reality doesn’t imitate HTTPS, it borrows the real thing: the server presents the certificate presentation of an actual well-known site. A censor inspecting the SNI sees a normal site. A censor fingerprinting the TLS handshake sees a normal handshake. A censor actively probing the server gets the real website back. That closed the hole that killed earlier protocols (including Trojan, which we retired in its favour), and because it rides TCP 443, it works even where a firewall drops all unfamiliar UDP.
The decision rule
You rarely need to make this call yourself:
- In the VPNBaron app, Baron Pathfinder tests routes and picks automatically, in exactly this order of preference.
- In a third-party client, your stealth subscription carries both entries for every location: import it via V2Box or Hiddify and switch rows when a network fights back.