Reality
Reality solves what plain TLS could not: making a connection indistinguishable from a visit to a real, popular website. Ordinary disguise required your own domain and certificate, and that was the weak point — a domain can be blocked wholesale, and a self-signed certificate is visible to an inspector immediately. Reality instead performs the handshake with a real third-party site and presents that site genuine certificate. To an outside observer the connection looks like a visit to that site, because the certificate in it really does belong to it.
In short
Reality removes the main handle blocking relies on — the need for a domain of your own that can be listed. The cost is that the cover site cannot be arbitrary: it must support TLS 1.3 and be popular enough that visiting it does not look odd.
Frequently asked
Does Reality forge someone else certificate?
No, and that is the point. The certificate is genuine and belongs to the cover site — Reality obtains it through a normal handshake with that site rather than issuing a fake. A forgery would be visible: browsers and certificate validation reject it.
What does Reality not protect against?
Analysis of traffic volume and rhythm. The connection looks like a visit to the chosen site, but if video streams through it for hours, the picture stops matching a typical visitor. That is costlier to implement than header inspection, yet entirely possible.
Do I have to pick the cover site myself?
In ready-made configurations it is already chosen and arrives inside the subscription link. Picking it yourself only matters for a self-hosted setup, where two conditions apply: TLS 1.3 support and enough popularity.