Paste one or more vless://, vmess://, trojan://, ss://, hysteria2://, or tuic:// links, pick SOCKS proxy or native TUN, and get a ready-to-run xray-core config.json. Everything runs in your browser — nothing is uploaded anywhere.
01 INPUT
02 PARSE
03 CONFIGURE
04 EXPORT
01Paste links
One link per line. Subscription blobs (a single base64 string containing multiple links) are also detected automatically.
Import an existing config.json instead
Paste a config.json this tool (or xray-core itself) already produced. It'll pull the active server, inbound mode, and every advanced option back into the form below so you can tweak and re-export. Only the outbound tagged proxy (or the first non-infrastructure outbound) is imported — configs with multiple proxy outbounds/balancers aren't supported yet.
02Choose active server
The generator builds a config with one active outbound. Select which parsed server it should connect through.
03Inbound mode & options
SOCKS + HTTP proxy
Local proxy on 127.0.0.1. Point apps/browser at it manually, or via a system proxy setting.
TUN (system-wide)
Native xray-core TUN inbound — captures all device traffic. Needs elevated/admin privileges to run.
TUN mode needs to run xray-core with elevated privileges (admin/root) since it creates a system network interface. On a fresh box, also double check your OS lets the process create wintun/utun/TUN devices.
Advanced options
Traffic sniffing (inbound)
Inbound access & authentication
Heads up: listening on 0.0.0.0 exposes this proxy to your whole LAN (and any network you join) with no password. Turn on the username/password requirement above before using this outside a trusted localhost-only setup.
TLS / REALITY security
Overrides the fingerprint field on both tlsSettings and realitySettings for every server, regardless of what each individual link specified. Useful for making a batch of servers behave consistently, or matching a specific browser's TLS ClientHello shape.
Cert pinning replaces normal certificate-chain trust with an exact match against this hash — get it with xray tls hash --cert <cert.pem>, xray tls ping <host:port>, or openssl x509 -noout -fingerprint -sha256 -in cert.pem. Stronger than allowInsecure since it still refuses anything that isn't this exact certificate, rather than accepting anything. ECH hides the SNI from network-level observers (deeper than REALITY's camouflage, which still leaks the disguise domain in plaintext at the TCP/TLS layer for some analysis methods). Only applies to plain TLS security, not REALITY — REALITY already has its own SNI-camouflage mechanism.
Mux (connection multiplexing)
Heads up: this server uses XTLS Vision flow, which is generally recommended to run without Mux (Mux breaks Vision's direct TCP splicing). Consider leaving this off unless you know you need it.
Fragment (TLS ClientHello fragmentation, anti-censorship)
DNS & routing strategy
Custom domain routing (optional — one entry per line, or comma-separated)
Paste bare domains (example.com), or prefixed matchers (domain:/full:/keyword:/regexp:/geosite:). Full URLs like https://example.com/ are auto-cleaned to just the hostname — domain routing matches against sniffed SNI/Host values, which never include a scheme or path.