SecureFox runs four protocols. The app picks one automatically based on your network — you don't have to choose unless you want to force a specific one in advanced settings.
WireGuard
The fastest option on clean networks. Lightweight UDP-based tunnel, very low overhead. Used when the network doesn't actively block VPN traffic.
VLESS + XTLS-Vision
The default on hostile networks. Carries the data path inside a TLS connection that looks indistinguishable from regular HTTPS to deep-packet-inspection systems.
REALITY
An obfuscation layer that sits on top of VLESS. The TLS handshake mirrors a real, non-VPN destination (e.g. cloudflare.com), so passive observation doesn't reveal a VPN target. See REALITY: bypass DPI on hostile networks for more.
XTLS-Vision (zero-copy splice)
A data-path optimisation inside VLESS. The kernel splices bytes between sockets without copying through user space, so the throughput cap is the CPU's memory bandwidth, not crypto.