The current state of the art in self-hosted censorship circumvention, and the reason 'buy a VPN' no longer has one right answer for people behind serious firewalls. Xray-core is a hard-forked, heavily extended v2ray-core (Project X started 2020-11-23, v1.0.0 built from v2fly commit 9a03cc5) whose real innovations are VLESS, XTLS Vision flow control and above all REALITY: instead of renting a domain and buying a TLS certificate like Trojan, the server borrows the TLS handshake of a genuine major site and serves an ephemeral certificate only to clients that can prove possession of the shared secret, while everything else - including a censor's active probe - is transparently forwarded to the real site. That design, fetched from the project's own docs, is why Iranian, Russian and Chinese users report it as the last thing still standing: r/VPN voices say VLESS+Reality 'most likely can't be blocked, unless they would happy to block port 443 and kill the whole internet', and HN commenters note Russia 'all but admitted that they can not block xray+reality-style VPNs' and pivoted to talk of blanket foreign-traffic bans. The honest costs are equally clear: it is a project, not a product - you provision a VPS, you are the sysadmin on duty (the February 2026 Roskomnadzor signature wave took down personal 'samovar' VPSes exactly like public ones, and moving off port 443 or changing SNI did not reliably help), detection research is actively catching up (USENIX Security 24 shows encapsulated TLS handshakes are fingerprintable even with padding), there are no audits, no company, and RPRX runs development on his own terms - including NFT fundraising. For hands-on users in censored regions this is the best build-it option we have found; for everyone else it is what the better commercial shells are selling under the hood.
open source5 red flagsfacts verified - Xray-core and REALITY GitHub repos, GitHub releases API, xtls.github.io docs (home, Grand Chronicle news page, VLESS protocol spec), the Iran REALITY-blocking discussion #3269, net4people bbs TLS-in-TLS issue #281, the GFW Report USENIX Security 23 paper page, the USENIX Security 24 TLS-in-TLS paper page, ObjShadow's REALITY source-code analysis, Risky Biz News (Oct 2022), two Habr analyses (Feb 2026), HN Algolia and arctic-shift Reddit archives all fetched live 2026-11-03; arctic-shift body-search intermittently rate-limited (HTTP 429 and app-level 'Timeout' payloads) so only the reality and vless subreddit pools returned full data - the xray and selfhosted pools did not complete; xray.com docs domain unreachable (transport error) - noted, not counted
No security audit, no legal entity, no privacy policy - by design there is nobody to hold accountable, which is protection against subpoenas but also against bugs
Active censorship response is documented in three countries within 30 months: China's mass blocking of TLS-based circumvention including Xray/VLESS (Oct 2022, GFW Report via Risky Biz News), Iran's traffic-analysis blocking of Reality (Dec 2023 discussion #3269, with GFW Report researchers engaging), and Russia's Feb 2026 TSPU signature wave against Xray/VLESS (Habr)
Donation model leans on NFTs ('Project X NFT', 'VLESS NFT', 'REALITY NFT' on OpenSea) - unusual, unregulated fundraising for critical infrastructure
+2 more red flags - expand before signing up
The project publicly acknowledged a panel-security problem ('Why are there people managing panels using http://ip on the public web?', Grand Chronicle 2024-10-04) - misconfigured panels are a real user risk, not vendor FUD
RPRX deleted large feature sets in the 2024-09-30 release with little notice ('the deleted features were truly not being used by anyone') - rolling releases can break setups
Review
draft generated by Qwen3, fact-checked by the vpncomparison editorial desk · review version 2 · prose updated 2026-11-03 · facts as of 2026-11-03 · how we verify
Honesty note: we have not run our own tests on Xray / VLESS REALITY (modern obfuscation proxy core) yet (leak tests, speed, kill switch). Everything on this page is source-based meta-research with dated links. When we test it, results appear here and on the change log.
Xray / VLESS REALITY is not a VPN provider but a self-hosted proxy toolkit built around the Xray-core software. It enables technically skilled users to run censorship-resistant tunnels using protocols like VLESS and obfuscation tech like REALITY. There is no company, no subscription, and no customer support - just open-source code. You must rent your own VPS and configure everything yourself, meaning your privacy and uptime depend entirely on your choices and skills.
Logging & privacy
There is no central operator to log your traffic - because there is no operator at all. Xray-core runs on your own server, so any logging depends solely on your configuration; by default, it logs only warnings. The REALITY protocol enhances privacy by camouflaging traffic as legitimate HTTPS to major sites, forwarding probes to real destinations so censors see nothing suspicious. However, there is no audit, no warrant canary, and no legal entity to challenge surveillance. Your trust rests in the code and your VPS provider, not in any enforceable promise.
The software itself is free under the Mozilla Public License 2.0. You pay only for a VPS, typically $5/month (or as low as $2-3 according to r/VPN reports). There is no subscription, no renewal fee, and no billing cycle - just your server costs. Since there’s no product to buy, there’s no renewal trap. You control all expenses, but also all responsibility: no refunds, no support, and no automated billing protections.
Xray-core supports VLESS, VMess, Shadowsocks-2022, Trojan, WireGuard, and more, with advanced obfuscation like REALITY and XTLS Vision flow control to defeat TLS-in-TLS detection. It offers multihop routing, split tunneling, and runs on Windows, Mac, Linux, Android, iOS, and routers. There are no performance tests in this review, but community reports and USENIX research confirm its design resists deep packet inspection. However, enterprise SSL inspection (e.g., FortiGate) can break it, and there is no kill switch built into the core.
Ownership & track record
Xray-core is developed by a pseudonymous team led by RPRX under the XTLS GitHub organization, with no legal entity, jurisdiction, or formal governance. It is a distributed open-source project with contributors from Chinese, Russian, and Persian communities. While this shields it from legal coercion, it also means no accountability for bugs or outages. The project has faced active blocking in China, Iran, and Russia, and relies on unregulated funding like NFTs. Misconfigured web panels and abrupt feature removals (e.g., 2024-09-30) are documented risks.
Censorship resistance
REALITY is specifically designed for high-censorship environments like China, Iran, and Russia. By borrowing real TLS handshakes from major websites, it avoids domain and certificate ownership, making passive detection extremely difficult. Users report it surviving where commercial VPNs fail. However, active blocking exists: Iran uses traffic analysis, Russia deploys TSPU signatures, and China has broad TLS-based filtering. While not invincible - especially against enterprise SSL inspection - it remains one of the most resilient tools available for technically capable users.
Verdict
For hands-on users in censored regions, Xray/VLESS REALITY is the gold standard of self-hosted circumvention - what many commercial “anti-censorship” VPNs are quietly built on. It offers unmatched resistance to DPI but demands real technical effort and ongoing maintenance. For everyone else, it’s a reminder that real privacy often means doing the work yourself. And no, this project doesn’t pay review sites - because it’s not a product at all.
++ What holds up
REALITY's steal-the-handshake design needs no domain and no certificate, and presents a full real TLS handshake to the censor - active probing returns the camouflage site itself (XTLS/REALITY README + source analysis)
Free, open source (MPL-2.0), one Go binary, monthly releases, reproducible builds
The last working option in the harshest environments per both community voices (Russia, Iran, Uzbekistan, China threads 2025-2026) and the Oct 2025 Russia blocking wave documentation
XTLS Vision + REALITY specifically counter the TLS-in-TLS fingerprint that caught earlier TLS-based proxies; the USENIX paper's threat is acknowledged and the project's roadmap names 'pre-built mode' and 0-RTT as next targets
Enormous client and panel ecosystem - the README lists dozens of maintained GUIs across every platform, so 'self-hosted' no longer means no-app
No accounts, no KYC, no price, no company - jurisdiction surface is just your VPS provider
-- What to watch
It is a project, not a product: VPS provisioning, TLS/SNI tuning, core updates and log-reading are on you - Habr's Feb 2026 analysis calls the one-click era 'definitively over' and says 'if you have your own server, you are no longer just a user; you are a sysadmin on duty'
Cat-and-mouse is real and hot: Roskomnadzor's TSPU rolled new VLESS/Xray signatures in February 2026 that dropped Reality configs on port 443 (moving ports, empty SNI, or Shadowsocks-2022/xHTTP chains were the reported workarounds); Iran's GFW blocked Reality by traffic analysis in late 2023 and censors keep iterating
Academic detection research is converging on protocol-agnostic tunnel detection - USENIX Security 24 (Xue et al.) demonstrated reliable detection of encapsulated TLS handshakes with minimal collateral damage in a live ISP, and cautions that multiplexing plus random padding alone are inherently limited
REALITY inherits a documented structural exposure: a Hetzner IP claiming to be apple.com is distinguishable by reverse DNS / SOA / whois consistency checks (GitHub discussion #3269), so IP choice and camouflage-target choice matter
No third-party security audit of Xray-core exists (no auditor named in any fetched source); the codebase is a fork of a fork and RPRX has removed features unilaterally between releases
Streaming is a bad fit - a r/VPN voice points out the exit IP is still a datacenter IP, and Reality does not change that, so streaming/banking sites that block hosting ranges will not be fooled
Project governance is opaque: pseudonymous lead author, a documentation site that warns its English translations may be outdated, and community friction (the net4people #281 debate over TLS-in-TLS claims and the sing-box maintainer's public disagreement with RPRX) is visible in fetched threads
Pricing reality check
Intro price
$5 /mo
Notes
The software is free; the only cost is a VPS. r/VPN voices report renting servers 'for 2 - 3 USD per month' (2026-08) and running VLESS on a spare VPS or even a home mini PC with a dynamic IP (2026-08); a typical overseas VPS runs about 5 USD/month. No subscription, no license fee.
none - there is no account at all; your client ID is a UUID you generate yourself
Apps
windows, mac, linux, android, ios, router
Check the renewal price above before any multi-year plan - true-cost calculator.
Is Xray / VLESS REALITY legit?
Legal domicile: none - distributed OSS project under the XTLS GitHub org with no legal entity named in any fetched source; no operator to subpoena, no HQ, no registered company; lead author RPRX is pseudonymous and the developer community is international (Chinese, Russian and Persian Telegram groups documented on the project's own site) - reported, not confirmed: a distributed open-source project has no legal entity, address or terms; the lead developers are pseudonymous/anonymous (recorded here for the publishing gate - the honest answer remains: no single jurisdiction governs this project). Logging claim: no central operator exists to log anything - you run the server, you hold whatever logs you configure; Xray-core ships configurable logging, off by default at a warning level - evidence class: no logging claim at all. No incidents on file in our research - absence of evidence is not proof of innocence. Facts verified - Xray-core and REALITY GitHub repos, GitHub releases API, xtls.github.io docs (home, Grand Chronicle news page, VLESS protocol spec), the Iran REALITY-blocking discussion #3269, net4people bbs TLS-in-TLS issue #281, the GFW Report USENIX Security 23 paper page, the USENIX Security 24 TLS-in-TLS paper page, ObjShadow's REALITY source-code analysis, Risky Biz News (Oct 2022), two Habr analyses (Feb 2026), HN Algolia and arctic-shift Reddit archives all fetched live 2026-11-03; arctic-shift body-search intermittently rate-limited (HTTP 429 and app-level 'Timeout' payloads) so only the reality and vless subreddit pools returned full data - the xray and selfhosted pools did not complete; xray.com docs domain unreachable (transport error) - noted, not counted (not fully verified) as of 2026-11-03 - read the sources below.
The money trail - what review sites earn by recommending this
affiliate status not verified yet
If we sign up for this program, every link here becomes rel="nofollow sponsored" and routes through /go/. Until then our links point straight to the provider's website with zero tracking. Ranking logic physically cannot read affiliate fields - here is the proof.
On the website
Captured by our screenshot bot from the live site (or its public archive). A capture is evidence of what the page showed at capture time - not an endorsement.
Is Xray / VLESS REALITY (modern obfuscation proxy core) legit?
Based on our checks as of 2026-11-03: Xray / VLESS REALITY (modern obfuscation proxy core) scores 3.8/10 in our weighted review. We logged 5 red flags (listed above). User reports, ownership and the incident record are documented with dated sources in the meta-review below.
What do I actually get for the price?
You get free, open-source software - no accounts, no licenses. The cost is your VPS (around $5/month). You install Xray-core yourself and configure it using community guides or panels like 3x-ui.
What is the renewal price and total 3-year cost?
There is no renewal price. The software is free. Your only cost is the VPS, which runs about $5/month. Over three years, that totals roughly $180, depending on your provider.
What evidence supports the no-logs claim?
There is no logs claim to prove - because there’s no service. You run the server, so logs exist only if you enable them. The architecture eliminates centralized logging by design.
Does this work in censored countries like China or Iran?
Yes, it’s built for that. REALITY resists detection by mimicking real HTTPS traffic. Users in China, Iran, and Russia report success, though active blocking (e.g., TLS-in-TLS analysis) does occur and requires updates to bypass.
Can I pay anonymously?
Yes - there’s nothing to pay. You download the software for free. If you donate to the developers, crypto is accepted. Your server cost is the only payment, and some VPS providers accept crypto.
What happens if the project shuts down?
Since it’s open source, the code remains available even if development stops. Existing installations keep working. Forks like sing-box already implement similar protocols, ensuring continuity.
What’s the honest free or cheap alternative?
Xray-core itself is free. For a managed option, consider a flat-priced independent provider like Mullvad - but know that most commercial “anti-censorship” apps are just reskinned versions of tools like this one.
The meta-review: what the internet says about Xray / VLESS REALITY (modern obfuscation proxy core)
We do not expect you to trust us. This review is a meta-review: below you see what other review sites claim - with their conflicts of interest labeled - what users report on Reddit and forums, and who actually operates Xray / VLESS REALITY (modern obfuscation proxy core). Every claim links to its source so you can verify it yourself.
What other reviewers say (1)
Every source carries a conflict label from our review-site database. "Affiliate-funded" means the site earns money if you buy what it recommends. We include critical voices deliberately.
Fetched 2026-11-03 (HTTP 200, ~6300 words): independent source-level walkthrough of the REALITY client (Xray-core transport/internet/reality) and server (XTLS/REALITY) code - explains the SNI-whitelist censorship strategy that made pre-REALITY TLS tools unusable in parts of mainland China (China Mobile Quanzhou cited as first deployer), the Session-ID covert channel (Xray version + Unix timestamp + shortId AEAD-encrypted inside the ClientHello), the X25519/HKDF preMasterKey derivation, the server's forward-to-dest handshake completion with ephemeral ed25519 temporary certificates signed via HMAC with the shared key, and the client's three-way discrimination (temporary cert = proceed, real cert = spider mode, invalid = TLS alert disconnect).
What users say (6)
Reddit, forums, HN - paraphrased and linked, never quoted out of context. Anecdotes, not proof - but refund complaints and leak reports are the best early-warning system this market has.
Fetched 2026-11-03 (HTTP 200, 85 comments): Iranian users document Reality blocking waves on the MCI ISP - controlled A/B tests where a 200-user high-traffic Reality server died within hours while a 1-2-user server survived a week; irgfw describes a pre-existing IP graylist and reports 'IRGFW has zoomed on TLS proxies now, all kinds of them'; maintainer Fangliding notes Reality is outwardly indistinguishable from port forwarding; GFW Report researchers (gfw-report account) join the thread offering to investigate; community theories include reverse-DNS/SOA consistency attacks against camouflage targets and the USENIX TLS-in-TLS paper.
Fetched 2026-11-03 (HTTP 200, 40+ comments): the anti-censorship research forum's TLS-in-TLS debate - RPRX confirms an unpublished TLS-in-TLS characterization paper contacted him and yuhan6665 and that it motivated Vision Seed; his Trojan-killer PoC (client-after-CCS byte-count + timing conditions, ~0.1% false positive in Tun mode) versus the sing-box maintainer's skepticism that the GFW deploys ML detection; wkrp's framing that the censor detects tunnels, not TLS; diwenx (Xue) later authored the USENIX Security 24 encapsulated-TLS-handshake paper; GGFAST SIGCOMM 2023 classifier paper cited as methodology precedent.
Fetched 2026-11-03 (HTTP 200): 20 hits across 2025-2026 threads - 'only thing that works is xray vpn' (Russia, Tor thread 2025-08); XRay-based VPN worked in Uzbekistan where WireGuard was blocked; Russia 'all but admitted they can not block xray+reality-style VPNs' (2026-05); WireGuard+xray in Iran (2026-05); escalation-to-xray prediction on an Italy blocks thread (2026-07); GFW-adaptation commentary (2026-06).
Fetched 2026-11-03 (HTTP 200): the substring 'vless' matches 'vessel' in 858k comments, so this query returns noise - recorded honestly as a dead end that justified relying on the 'xray vpn' query for HN voices instead.
Fetched 2026-11-03 (HTTP 200 via curl after rate-limit cooldown; two earlier attempts hit HTTP 429 and an app-level 'Timeout. Maybe slow down a bit' payload): 2026 r/VPN voices - Reality as camouflage against DPI, version-mismatch troubleshooting, the datacenter-exit-IP caveat, router deployments, SSL-inspection defeats VLESS in enterprise networks.
Fetched 2026-11-03 (HTTP 200 via curl after rate-limit cooldown): 2026 r/VPN voices - VLESS+Reality as the standard Russian Telegram-ecosystem protocol, own-VPS-vs-commercial-IP-blocking logic, 2 - 3 USD/mo server rentals, CDN/SNI/fragmentation hardening advice, first-time 3x-ui setup friction, mini-PC dynamic-IP setups.
AI fact summary - everything we know, compressed
Generated by Qwen3 on 2026-11-03 from our fact database plus the linked sources. It summarizes - it does not add facts. Check anything that matters against the linked sources.
Bottom line: This is not a service but a self-hosted tool - free, open-source software you run on your own VPS. It offers strong obfuscation against state-level DPI using REALITY and VLESS, making it one of the few options still viable in heavily censored regions like China, Iran, and Russia. However, it requires technical skill to deploy and maintain, and active blocking efforts are evolving.
The logging truth: There is no central operator to log traffic - logging depends entirely on your VPS provider and your own server configuration. The software itself does not require or enforce logging, and by design, there is no company or legal entity that could be compelled to log. Jurisdiction is irrelevant: this is a decentralized project with no formal ownership.
Pricing reality: The software is free. You pay only for a VPS, typically $2-5/month. There are no subscriptions, renewals, or billing traps - just your server costs. No payment or account is needed to use Xray-core itself.
What reviewers say vs what users say: Users consistently report that VLESS + REALITY works where other tools fail, especially in Russia and China, calling it “undetectable” and “the last thing standing.” However, enterprise SSL inspection (e.g., university firewalls) can break it. External analyses (USENIX, GFW Report) confirm its effectiveness but also show detection methods are advancing. Conflict exists: vendor-authored content (e.g., a MegaV VPN writer) claims high survival rates, while independent researchers stress it's a temporary advantage.
Who runs it: No one company or legal entity runs it. It is a pseudonymous open-source project led by developer RPRX, with contributions from an international community. The lack of formal structure protects it from legal pressure but also means no accountability, support, or guarantees.
Sources & how this review was built
Every external source used on this page, with the date we fetched it and its evidence class [A]-[D] (A = primary/operator, B = serious press/research, C = community, D = our own measurements). Methodology: how we verify. Sources disappear or change - if a link is dead, tell us via contact.
Evidence classes on this page:[A] A: 6[B] B: 6[C] C: 6[D] D: 0(D stays empty until our own test phase)
A censorship-unblocking tool that now wears nonprofit clothes: Lantern's parent became the 501(c)(3) Brave New Software Project and the site now reads like a…
A DNS-layer filtering service that has grown up in public: born January-April 2021 out of the Windscribe team (same three founders, spun out precisely because…
open source
intro $3 /mo
Canada - CONTROLD, Inc., Toronto, Ontario; operator about-us page states 'Founded in 2021 - Toronto, Canada' and site footer reads '2026 CONTROLD, Inc.'; free-dns FAQ calls it 'based in Toronto, Canada... the sister company of Windscribe'privacy tool 9 d ago
Hysteria 2 is not a VPN provider - it is free, MIT-licensed proxy software you deploy on your own server, and this dossier treats it that way: there is no…
open source
intro $5 /mo
none - Hysteria is not a company; it is MIT-licensed open-source software (Go) developed by a volunteer community around lead developer 'Toby' (GitHub: tobyxdd), with the repo on GitHub and docs at hysteria.networkprivacy tool 9 d ago
No comments yet - be the first. Posting runs a short proof-of-work in your browser (anti-spam), no account needed.