Free V2Ray nodes: decode a vmess link before testing it

What is inside a vmess:// link, how to decode it in one command, which field combinations are worth trying and which are dead on arrival, and why vmess is no longer the first choice.

By MaoUpdated 2026-08-235 min read

Vmess was one of the first widely adopted protocols and a large share of free nodes still use it. This is about using it properly — and about deciding whether a node is worth testing before you test it.

Inside a vmess link

What you get handed:

vmess://eyJ2IjoiMiIsInBzIjoiSlAtMDEiLCJhZGQiOiIxLjIuMy40Iiwi...

Everything after vmess:// is base64-encoded JSON:

{
  "v": "2",
  "ps": "JP-01",
  "add": "1.2.3.4",
  "port": "443",
  "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "aid": "0",
  "net": "ws",
  "type": "none",
  "host": "example.com",
  "path": "/path",
  "tls": "tls"
}

Field	Meaning	What to look at
`ps`	Display name	Arbitrary. Ignore it.
`add`	Server address	IP or hostname — see below
`port`	Port	443 usually implies TLS
`id`	User UUID	Effectively the password
`net`	Transport	`tcp` / `ws` / `grpc`
`tls`	Encryption	The important one
`host` / `sni`	Disguise hostname	Determines how it looks on the wire

Decoding it

echo "eyJ2IjoiMiIsInBzIjoi..." | base64 -d

PowerShell:

[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("eyJ2Ijoi..."))

Which combinations still work

Best to worst, from my testing:

Combination	Notes
`ws` + `tls` + real hostname	The common working setup; looks like HTTPS on 443
`grpc` + `tls`	Slightly better throughput; grpc is targeted on some networks
`tcp` + `tls`	Works, less flexible than ws
`ws`, no `tls`	Do not bother
`tcp`, no `tls`	Dead end

A vmess node without TLS can be discarded on sight in 2026.

Clients

Platform	Client
Windows	v2rayN, or Clash Verge Rev (also handles vmess)
macOS	Clash Verge Rev, V2RayXS
Android	v2rayNG, FlClash
iOS	Shadowrocket, sing-box

There is little reason to run a dedicated V2Ray client any more. Clash-family clients and sing-box both handle vmess, with better routing on top.

My advice: one client for every protocol. Do not install four applications because you have four kinds of node.

v2rayN walkthrough: v2rayN setup.

Importing

v2rayN / v2rayNG

Copy the link, then import from clipboard. For batches, put one link per line, copy the lot, and most clients will take them all.

Clash-family

Support for raw vmess links varies. The reliable route is a subscription converter producing Clash YAML, or writing the entry by hand:

proxies:
  - name: "JP-01"
    type: vmess
    server: example.com
    port: 443
    uuid: a1b2c3d4-e5f6-7890-abcd-ef1234567890
    alterId: 0
    cipher: auto
    network: ws
    tls: true
    servername: example.com
    ws-opts:
      path: /path
      headers:
        Host: example.com

Map it field by field against the decoded JSON.

Why your vmess node will not connect

In order of frequency:

1. It is dead

Free nodes have a median life of days. It may have expired before it reached you. Test latency first; drop timeouts.

2. Clock skew

Vmess is time-sensitive. More than about two minutes of difference between your clock and the server's and the handshake fails.

Check that automatic time sync is on. This one is sneaky, because the error usually just says the connection failed.

3. UUID or alterId typo

A missing character or a trailing space when typing by hand. Watch for whitespace when pasting.

4. TLS settings wrong

Wrong sni / servername, or skip-cert-verify set incorrectly.

If the log shows a certificate error, temporarily setting skip-cert-verify: true will tell you whether that is the cause. It weakens security — use it to diagnose, not to run.

5. Transport mismatch

The node is ws, you configured tcp. Decode and read it properly.

Where vmess sits now

Usable, but not the best answer.

Its traffic signature is well understood. New deployments lean toward VLESS + Reality, Trojan and Hysteria2. Vmess remains common among free nodes largely for historical reasons — the old servers are the ones that got shared.

Rough preference order:

Hysteria2 ≈ VLESS+Reality > Trojan > VMess+ws+tls > Shadowsocks > everything else

Full comparison: SS vs VMess vs Trojan vs Hysteria2.

Questions people keep asking

What is that long string after vmess://?

Base64-encoded JSON. Decode it and you get the server address, port, user UUID, transport, TLS setting and disguise host. Worth doing — plenty of nodes advertised as premium lines decode to a cheap box with no TLS.

Are V2Ray and Clash nodes interchangeable?

Yes, the format differs but the underlying node is the same. One server can be expressed as a vmess:// link for V2Ray-family clients or as a YAML entry for Clash-family ones. Most modern clients read several formats; a subscription converter handles the rest.

Why are there fewer vmess nodes than there used to be?

Because vmess traffic has been studied thoroughly and is not especially hard to identify. Newer deployments favour VLESS with Reality, Trojan and Hysteria2. Vmess still works, it is just no longer the first thing you would choose.

What is the difference between VMess and VLESS?

VLESS is a stripped-down VMess with its own encryption layer removed, leaving that job to TLS, which lowers overhead. VLESS is usually paired with Reality, which disguises the handshake far better than vmess ever did.