01 the problem

DPI already fingerprints VPNs

Deep packet inspection systems — in Russia, TSPU — recognize classic VPN protocols by handshake signatures. What gets blocked is not what you do, but the very fact of connecting to a VPN.

Protocol	What DPI sees	Verdict
WireGuard	Fixed handshake, stable signature — recognizable even inside TCP.	Detected
OpenVPN	Known patterns; standard obfuscation schemes get fingerprinted too.	Detected
VLESS + Reality	A legitimate TLS handshake to a real, existing website: genuine SNI, genuine fingerprint.	Invisible

[1] Reality uses the certificate of a real website (dest / SNI), so for passive DPI the connection is indistinguishable from ordinary HTTPS. This is a property of the protocol, not a marketing promise.

02 technology

Transparency down to the last byte

No "secret protocols" and no closed config formats. Everything that can be shown is shown; everything that can be verified is verifiable.

VLESS / Reality — today

in prod

The working stack is Xray-core and Mihomo. The connection looks like ordinary TLS to a real website: genuine SNI, genuine certificate fingerprint. DPI finds nothing to grab onto.

OpenCH — tomorrow

in development

Our own development: a modular FakeTLS engine with manual control over the TLS fingerprint and SNI. Not "another client" — a different level of control over protocol-level masquerade.

Configs as-is

We hand out the real JSON connection configs (Xray-core / Mihomo) with no obfuscation or "proprietary" format. You can open them, read them, and compare with what we publish.

The client is optional

Our config works with third-party Xray, Mihomo and v2rayN — no official client needed. Vendor lock-in is not our story: connect with whatever you like.

config.json — fragment of a real Xray-core config

{
  "log": {
    "access":   "none",
    "dnsLog":  "none",
    "loglevel": "warning"
  },
  "inbounds": [{
    "protocol": "vless",
    "settings": { "clients": [{ "id": "<your-uuid>" }] },
    "streamSettings": {
      "security": "reality",
      "realitySettings": {
        "serverNames": ["<real SNI>"],
        "dest": "<real website>:443"
      }
    }
  }]
}

[2] The logging policy is baked into the config (access: none, dnsLog: none) and additionally fixed in plain text on the Privacy page — not only in the configuration.