Obfuscated VPNs: What Each Stealth Mode Runs On and How It Scores

Four kinds of stealth mode behind the label

VLESS with Reality borrows the TLS handshake of a genuine website, so an active probe sees that site, not a VPN. Hysteria2 runs over UDP (QUIC), which some networks throttle or drop, so treat it as a backup. Own protocols such as Proton's Stealth, which tunnels WireGuard through obfuscated TLS, work exclusively in their own apps.

The three highest page scores

Both leaders stack a range of open protocols, the trait this ranking pays best. Xeovo's weak spot is security paperwork: no published kill switch or DNS leak protection (sub-score 1.1), and no trial to test the proxies first. Proton is the opposite bet: one in-house protocol, an audited no-logs policy and a huge network, but a low bypass figure because a single own protocol earns the base 2 points and little more.

How the censorship bypass sub-score is counted

The sub-score's maximum is 10.5 points, scaled to 10: a stealth feature earns 2, VLESS Reality 1.5, Trojan, Hysteria2, Shadowsocks and AmneziaWG 1 each, obfs4, TUIC and NaiveProxy 0.5 each, plus small amounts for mirror sites, working calls in the UAE and manual config files. The bypass block counts for 40% of the page total; privacy 21%, security 14%, price and terms 11%, network and apps 7% each.

A stealth feature with none of the counted protocols earns only the base 2 points, which scales to 1.9; NordVPN, Surfshark, ExpressVPN and PureVPN sit there. Mullvad, IVPN and Proton pick up half a point more and sit at 2.4. The median across the page is 2.4; only 21 of 192 entries reach 5 or more, and just 9 of those make the main ranking. Client apps score 6.7 to 7.1, above every big brand listed, but they supply no servers and none of them is in the main ranking.

What a stealth mode cannot promise

The site scores published facts, not live connections: nobody here verifies whether a mode survives a specific firewall in a given week. A disguised tunnel on a blocklisted IP still dies. Streaming platforms block by IP, not by traffic shape, so obfuscation does not unblock them. The extra wrapper usually costs throughput. And disguise says nothing about logging: of 192 entries, 150 publish a no-logs policy but only 23 have had it independently audited.

Obfuscated VPN FAQ

Which stealth setup fits your network

Hotel or office Wi-Fi that kills WireGuard: any vendor's stealth toggle usually gets the connection through. Heavy national filtering: take a service with VLESS Reality plus a second protocol in reserve, prefer 5 or higher on the bypass sub-score, check the refund window, and bookmark the mirror site or Telegram channel for fresh connection details (42 of these providers run one). China specifically: see the China ranking page. Want just the protocol without a subscription network: a client app plus a key from a provider does the job, and the VLESS ranking page lists options built around Reality.