Author: Pavel Onuchin, VPN and network security specialist

6 min read

Updated: October 23, 2026

The Trojan protocol: what it is, how it works, and how it differs from VLESS + Reality

Trojan is a proxy protocol that hides traffic inside an ordinary TLS connection, so from the outside it looks like a visit to an HTTPS site. It has nothing to do with trojan malware: the name is a reference to the Trojan horse. The authors describe the goal in one phrase: "an unidentifiable mechanism." The main difference from VLESS + Reality is whose TLS an observer sees: Trojan sets up its own TLS connection with its own certificate, while Reality presents the handshake of a real third-party site. Below: how the protocol is built, its weak spot, and when it still makes sense.

What is Trojan in plain terms?

Trojan is a way to send data through a server so that the connection is indistinguishable from a request to a secure website. The client establishes a genuine TLS connection with the server and, inside it, sends a password and the address the traffic should be delivered to.

The protocol appeared as a response to China's filtering system; the original project is in fact called trojan-gfw. The idea is not to invent unusual encryption that stands out against the rest of the traffic, but to blend in with the most common type of connection on the internet: HTTPS.

How does the Trojan protocol work?

After the TLS handshake, the client sends the server a password hash and a command resembling a SOCKS5 request. If the password is correct, the server forwards the traffic to the address; if not, it behaves like an ordinary web server.

According to the project documentation, the packet inside TLS consists of four parts:

the password hash: 56 characters, SHA-224 in hexadecimal notation;
a CRLF separator;
a request with the command, address type, destination address, and port;
the payload, meaning the data itself.

The second half of the mechanism is protection against probing. The server redirects any connection without the correct structure and password to a preset address, by default a local web server. Anyone who decides to "knock" on the server and see what is there will find an ordinary website.

Trojan has no encryption of its own: all the protection comes from TLS. That is why the server needs a domain and a valid certificate. Without them the disguise does not work.

How does Trojan differ from VLESS + Reality?

Trojan presents an observer with its own certificate and its own TLS handshake, while Reality presents the handshake of someone else's popular site. Because of this, Trojan can be told apart by two signs that the VLESS + Reality combination with XTLS Vision mode addresses.

The first sign is TLS in TLS. When a user opens an HTTPS site through Trojan, a second encrypted connection is established inside the first. The sizes and order of the packets are distinctive in this case, and traffic analysis systems have learned to recognize that pattern. The second is the handshake fingerprint: the TLS parameters of a Trojan client may not match what a real browser would send.

	Trojan	VLESS + Reality	Shadowsocks
What it imitates	HTTPS with its own certificate	A TLS session of a real third-party site	Nothing, it looks like random data
Needs its own domain and certificate	Yes	No	No
Reaction to a server probe	Serves a fallback site	The probe lands on the real site	Does not respond or drops the connection
Vulnerability to TLS-in-TLS detection	Present	Reduced in XTLS Vision mode	Not applicable
Server setup complexity	Medium: domain, certificate, web server	Medium: keys and choice of a target site	Low
Client support	Broad, including older ones	Modern clients on Xray and sing-box	Very broad

A detailed comparison of all three protocols in terms of resilience is in the article Reality, Shadowsocks, or Trojan. Exactly how Reality borrows someone else's handshake is explained in what is Reality.

What is Trojan-Go?

Trojan-Go is a separate implementation of the protocol written in Go, with additional features. It has multiplexing, meaning several streams in one connection, and transport over WebSocket, which makes it possible to put the server behind a CDN.

Compatibility with the original Trojan is preserved, but the extended modes work only between a client and a server that both run Trojan-Go. The main weak spot, nested TLS, does not go away with a change of implementation.

When does Trojan still make sense?

Trojan fits where filtering does not analyze the traffic pattern and only checks whether a connection looks like HTTPS. It is also useful as a fallback and on older devices that have no clients with Reality support.

The arguments for and against look like this:

For. A simple and well-studied design, implementations in almost every client, and a server that looks like an ordinary site with a genuine certificate.
Against. It needs a domain and a certificate that have to be renewed. Nested TLS is recognized by deep traffic analysis systems. The domain can be blocked separately from the server address.

Where carriers apply deep packet inspection (in Russia it runs on TSPU equipment, the filtering hardware installed on Russian operators' networks), VLESS + Reality is usually chosen as the primary option, with Trojan kept as a backup. What this equipment is and how it tells protocols apart is described in the article what is TSPU.

Which protocol BessyConnect uses

BessyConnect runs on VLESS + Reality. The choice follows from what is written above: Reality does not require a domain of its own and leaves no fingerprint in the form of a separate proxy server certificate.

The user, meanwhile, does not need to understand protocols or configure a server: everything is already inside the app. We recommend this route to people who were looking for Trojan as "a protocol that works" rather than as a subject to study:

A comparison with the classic protocols is in the article VLESS, OpenVPN, or WireGuard, and with newer ones in the overview Hysteria2, TUIC, and AmneziaWG.

FAQ

Is Trojan a virus?

No. The Trojan protocol is a network technology for carrying traffic over TLS. The only thing it shares with malware is the name.

Which is better, VLESS or Trojan?

On networks with deep traffic analysis, VLESS + Reality is more resilient: it does not create nested TLS with its own certificate. Trojan is simpler in design and is supported by a larger number of clients, including older ones.

Does Trojan need its own domain?

Yes. The server needs a domain and a valid TLS certificate; otherwise the connection will not look like an ordinary HTTPS site.

How is Trojan-Go different from Trojan?

It is an implementation in Go with multiplexing and WebSocket support. The base protocol is the same, and the additional modes work only between a client and a server running Trojan-Go.

Can you use Trojan without your own server?

Yes, if a service issues a key like trojan://…. It is pasted into a client the same way as a VLESS key. If you don't want to configure anything, it is easier to pick a service with a ready-made app, for example BessyConnect for Android or for iPhone.

Sign In