Subscription URL: what a VPN profile subscription is and how to update it
Subscription URL (also called a VPN subscription, subscription link, or remote profile) is an HTTPS address from which a VPN client downloads its own profile with the server description and updates it. Instead of entering each server manually, you add one link — and that is all.
This mechanism is supported by most modern multi-platform proxy clients: Hiddify, sing-box, v2rayNG, NekoBox, Streisand, FoXray, and dozens of others. The content format varies (plain-text base64, YAML for Clash, JSON for sing-box), but the idea is the same: the client fetches the URL on a schedule and updates the list of nodes.
If a subscription URL has “expired” or “does not update”, the issue is almost always either with the provider’s subscription or with the subscription host being unavailable. Below we will look at this in detail.
In short
- A subscription URL is a link like https://example.com/sub/abc123.
- The client pulls a profile from this link (server list, protocols, keys).
- The client updates the profile automatically on a schedule (every N hours / on startup).
- The format inside is usually plain-text base64, YAML (Clash), or JSON (sing-box).
- “Profile expired” means either the paid period ended or the link stopped returning configs.
- The stability of the subscription host = your ability to receive updates at all.
How a subscription URL works and what it contains
Technically, a subscription URL is just an HTTPS endpoint at the provider. The client makes a GET request, and the provider returns the profile content. This content describes which servers to connect to, through which protocols, and with which keys.
Plain-text base64 (classic format)
The oldest and most common format: each line is a VLESS/VMess/Trojan/SS URI, and the whole set is encoded in base64. It is supported by almost all clients based on Xray/v2ray.
Clash YAML
A YAML config for clients in the Clash and Hiddify families. In addition to the nodes themselves, it defines routing rules (what goes through the VPN and what goes directly). It is well suited for split-routing.
sing-box JSON
A JSON format for the sing-box engine (see the sing-box repository). Modern clients — Hiddify, NekoBox — understand it natively. If you have a Clash subscription, converters such as clash → sing-box translate the format on the fly.
What is inside a single node
Server address, port, protocol (vless/vmess/trojan/shadowsocks/hysteria/wg), security parameters (TLS, REALITY, SNI), UUID or key, and possibly a WebSocket / gRPC path. The client assembles all of this into a ready connection without showing you the gears.
What “profile does not update” means — decoding the symptoms
| Symptom | Possible cause | What to check |
|---|---|---|
| Profile update: failed to fetch | The subscription host is unavailable | Open the subscription URL in a browser — text should download |
| Profile updated, but no nodes | The subscription returned an empty response | The provider’s paid period ended or the link was changed |
| Nodes exist, but all timeout | The provider’s servers are down / blocked | Ask the provider, try backup nodes |
| HTTP 401 / 403 during update | The token in the link is invalid | Get a new subscription URL |
| The profile updated, but the format is not recognized | Incompatible format (Clash in a client for Xray) | Use a converter or another client |
| All requests to the subscription come only from RU and are blocked | The subscription host is on the RU blocklist | The subscription should live on a stable foreign host |
How to check right now
The fastest way to check a subscription URL is to open the link in a normal browser. A file should download or text should appear (base64, YAML, JSON). If the page does not open or returns 404/403, the problem is with the link itself.
If the link works in the browser, but the client says “failed to fetch”, the subscription host has most likely been blocked by your operator. Comparing availability across other operators/networks through Freedom Checker helps identify this.
Failure or blocking?
A failure is a local story: the provider moved the subscription to a new domain, its certificate expired, or the backend went down. Signs: the link does not open for anyone and recovers within an hour or two.
Blocking is different. When a subscription URL is available for some users and unavailable for others, and those users are customers of the same operator, this is already filtering of the subscription host. In this case, neither the client nor the server will help you — the provider needs to move to a host that is not blocked. This is why stable providers keep subscription URLs on neutral domains with backups.
What to pay attention to
- Do not post your subscription URL in public chats — it is the key to your VPN.
- A good provider gives several subscription mirrors (sub1, sub2, sub3) — this is insurance against blocking.
- The profile usually updates automatically every 24 hours; if you need it urgently, press Update manually.
- If you have your own VPS, run the subscription endpoint on a stable domain, not on an IP address.
- Do not mix subscriptions of different formats in one client — choose the one that is supported natively.
- A subscription URL with tracking parameters (UTM tags) is normal; this is how the provider counts users.
- If the link contains base64 or a long token, this is normal; this is how credentials are passed.
Conclusion
A subscription URL is a “dynamic” way to configure a VPN: one link that returns the current server list and updates without your involvement. This is the main mechanism used by modern clients such as Hiddify, NekoBox, and sing-box.
Most “profile does not update” situations come down either to a problem at the provider (payment, host migration, new keys) or to the subscription host being blocked by your operator. Before changing the client, check whether the link itself opens in a browser.