Most protocol comparisons are written from spec sheets. This one isn’t: we ran Trojan in production for years, on real servers with real users behind real firewalls, and then we retired it in favour of VLESS Reality. Here’s what each protocol actually is, why the switch happened, and what to do if you’re still on Trojan today.
The short answer
Trojan and Reality share the same core idea: look like ordinary HTTPS on TCP 443. The difference is who owns the disguise. Trojan must run its own certificate and domain, and answers for itself when probed. Reality borrows a real website’s TLS presentation and lets the real site answer. That single difference is why Trojan servers get unmasked and Reality servers don’t.
| Trojan | VLESS Reality | |
|---|---|---|
| Core idea | Hide inside self-hosted TLS on port 443 | Present a real third-party site’s TLS on port 443 |
| Needs its own domain + certificate | Yes: registered, renewed, per deployment | No: it borrows the handshake of an existing well-known site |
| SNI inspection | Sees your (unknown, often young) domain | Sees a normal, reputable site |
| Active probing | Exposed: the endpoint answers for itself and can be confirmed | Survives: probes receive the genuine website back |
| Speed | Lightweight, TCP 443 | Lightweight, TCP 443, small camouflage cost |
| Operational burden (server side) | Domains, certs, renewals, rotation | No certificate estate to maintain |
| Status in 2026 | Works on lenient networks, ecosystem in decline | Current default of the Xray ecosystem |
Trojan was a genuinely good design for its era, and it carried our stealth users for years. But operating it honestly means admitting its two structural problems.
The certificate estate. Every Trojan deployment needs a real domain with a real certificate. Domains age, look suspicious when young, appear in transparency logs, and must be rotated when burned. At fleet scale that’s a permanent operational tax, and every shortcut weakens the disguise.
The probing hole. When a censor suspects an endpoint, it connects and pokes. A Trojan server ultimately answers for itself, and careful probing can confirm what it is. This is the technique that retired a whole generation of look-like-TLS protocols, and it’s rung five of the detection ladder we describe in What is deep packet inspection.
Reality solved both at once: there is no certificate to own because the server presents a real site’s handshake, and a probe gets that real site’s content back. Nothing to renew, nothing that confesses. Our old Trojan setup pages now redirect to the modern stack, and the VLESS Reality protocol page covers what replaced it.
There’s no emergency on a network that isn’t hunting you. But the practical move is to have Reality ready before you need it, and it costs nothing to set up alongside:
Your client almost certainly already speaks it: sing-box based apps (V2Box, Hiddify) and Clash Meta handle Trojan, VLESS Reality and Hysteria2 side by side. A VPNBaron stealth subscription carries Reality and Hysteria2 entries for every location: Reality for networks that inspect, Hysteria2 for speed on bad links. Import guides: V2Box, Hiddify.
And if you’d rather stop thinking about protocols entirely, the VPNBaron app runs the whole stack natively. Baron Pathfinder tests routes on your current network and settles on whatever connects, without you juggling entries:
Is Trojan obsolete in 2026? Superseded rather than dead. It connects on lenient networks, but its certificate requirement and probing exposure are why the ecosystem moved to Reality.
Is VLESS Reality faster than Trojan? Comparable: both are lightweight TCP 443 proxies. The switch buys survivability, not speed. For speed on lossy networks, that’s Hysteria2’s job.
Why did providers drop Trojan? Certificate and domain upkeep per server, plus endpoints that can be confirmed by active probing. Reality removes both.
Do I need a domain or certificate for Reality? As a user, no. Nothing to register or renew: import a subscription and connect.
My provider still hands out Trojan configs. What now? Keep them as fallback, add Reality alongside in the same client, and switch entries the day a network starts eating your Trojan connection.
