# VLESS Subscription Format

A VLESS subscription is the standard way clients like V2RayN, V2RayA, Clash, SingBox, [[mihomo]], and Happ consume a list of servers from a provider. It's not a fancy protocol — it's an HTTP endpoint that returns a base64-encoded list of VLESS URIs, one per line. Paste the endpoint URL into the client's "subscription" field and the client handles the rest: decode, parse each URI, build server entries, refresh periodically.

The encoding is deliberately dumb. A VLESS URI looks like `vless://<uuid>@<host>:<port>?<query>#<remark>`, and a subscription is the base64 of all URIs concatenated with newlines. No envelope, no metadata, no versioning — just base64 over a newline-separated list. Clients that pre-date the format can add support in an afternoon, which is most of why it stuck.

The query string on each URI carries all the transport and TLS knobs: `type=ws|tcp|grpc`, `security=tls|reality`, `sni=`, `pbk=` (Reality public key), `fp=` (uTLS fingerprint), `flow=xtls-rprx-vision`, etc. Different providers emit different combinations depending on which transport and anti-DPI tricks they're using. A client that consumes the subscription needs to understand all of these, which is why V2RayN/V2RayA/Clash/SingBox each ship a VLESS parser that covers the full option surface.

Subscriptions are pull-only and unauthenticated beyond the URL itself. Anyone holding the URL gets the full server list, which means the URL is the credential. Providers rotate URLs when they want to revoke access. There's no account, no token, no refresh dance — the entire auth model is "know the URL."

This simplicity is what makes subscription converters like [[happ-subscription-converter]] possible. Once you have the base64 list, you can re-emit it from anywhere. The format doesn't bind the list to a specific client, a specific device, or a specific time window. Any client-side gating (Happ's HWID counting, for example) happens at the upstream endpoint, not in the format itself — which is why moving the list behind a proxy script is enough to sidestep it.

Client-side discrimination at the endpoint is the loophole providers close by returning different payloads to different clients (see [[happ-proxy]]). The format can't defend itself; only the endpoint can.