See what real-site cover, Vision and transport selection mean for your connections. Umbra is a self-hosted CLI client and server, not a managed proxy service.
TLS 1.3 / QUIC01 — 03
umbra
Your device
Open internet
Private transport
Unauthenticated → real site
Your traffic uses the authenticated path; other requests go to the real site.
01
Cover with a real destination
REALITY authentication separates your traffic from unauthenticated requests, which are forwarded to the configured real site. You need keys and a reachable TLS 1.3 destination, but no CA-issued certificate for the node. Cover does not guarantee invisibility.
02
Reduce double encryption where it applies
TCP mux shares a connection across streams. With mux=false, Vision removes redundant outer encryption only after authentication and only for eligible inner TLS 1.3 traffic. Non-TLS traffic stays encrypted.
03
Choose TCP or QUIC for your network
Transport selection is explicit, not automatic failover. QUIC needs open UDP and a reachable real QUIC fallback destination. It does not guarantee higher speed or the absence of all head-of-line blocking.
How to choose among mainstream options
Umbra and Xray are software platforms; VLESS, VMess, Trojan and Shadowsocks are protocols, while REALITY and Vision are mechanisms. Implementation and configuration determine behavior. There are no like-for-like competitor benchmarks here to support a speed ranking. The short version: Umbra is worth choosing when you want cover, both transport paths and SOCKS5 shipped as one configured pair you administer; the others win when you need their ecosystems.
01
Umbra
An integrated, self-hosted alpha: REALITY-style real-site cover, TCP mux/Vision, QUIC and SOCKS5 ship as one client and server pair you administer end to end.
Strengths
One endpoint covers both paths: TCP Vision and QUIC UDP sit behind a single local SOCKS5 node, so clients configure one hop.
No certificate paperwork: identity keys and temporary certificate binding replace obtaining and renewing a public CA certificate.
Trade-offs
Alpha software and CLI only today; it does not import VLESS, VMess or Trojan nodes.
Protocol changes between releases mean upgrading both endpoints together.
02
Xray + VLESS + REALITY
The closest alternative: REALITY and Vision are available here too, so the choice is about packaging and workflow, not exclusive technology.
Strengths
Mature multiprotocol platform with rich routing, many ready-made clients and extensive community documentation.
Trade-offs
You assemble and maintain the stack yourself: core config, transports, routing rules and matching clients.
Shared mechanisms do not make it interoperable with Umbra.
03
VMess
An AEAD proxy protocol worth considering when your clients already support it. TLS and WebSocket are additional deployment choices, not prerequisites for encryption.
Strengths
Very wide client support across platforms, including older and low-power devices.
Trade-offs
The protocol encrypts but does not camouflage: cover depends entirely on the transport you add on top.
Legacy non-AEAD modes are deprecated; pin clients that implement AEAD.
04
Trojan
A TLS-based proxy protocol for those who prefer a conventional TLS deployment; fallback behavior depends on the implementation and configuration.
Strengths
Real TLS handshake with documented fallback behavior and a design that has been stable for years.
Trade-offs
Typical setups maintain a domain and renew a publicly trusted certificate.
UDP rides inside TLS over TCP, so UDP timing follows the TCP path.
05
Shadowsocks
A lightweight encrypted proxy for simpler deployments; browser impersonation and real-site cover are not built into the base AEAD or 2022 protocols.
Strengths
Minimal moving parts: keys and a matching client, no domain or certificate required.
Trade-offs
Base protocols provide encryption, not camouflage; assess plugins separately if you need cover.
A TCP-only SIP003 plugin must not be treated as UDP camouflage.
06
Hysteria 2
A QUIC-focused solution with its own congestion-control design; consider it where UDP is reliably reachable.
Strengths
Unreliable datagram UDP path designed for lossy networks, with congestion control tuned for harsh conditions.
Trade-offs
Blocked or restricted UDP removes its main advantage, and its design is not a guarantee of speed on your network.
TCP still travels as QUIC streams, so loss can stall streams like any reliable transport.