Trojan
Trojan rests on a move that sets it apart: the server has a fallback answer. The connection runs over ordinary TLS with a real domain and a real certificate, so it looks like the most unremarkable HTTPS site. The password travels inside the already-encrypted channel. If it is correct, the server acts as a proxy. If it is wrong or absent, the server returns a normal web page, exactly as any site would. An inspector probing the address to find out what it is sees a website: not a refusal, not silence, not odd behaviour, but a page.
In short
Trojan strength is how it behaves under probing: active testing cannot tell it from an ordinary server. Its weakness is the prerequisites: a domain of your own, a genuine certificate and a working cover site that does not look empty. Reality solves the same problem without domain or certificate, so new setups tend to pick that, leaving Trojan where a cover site already exists.
Frequently asked
What does someone opening the server address in a browser see?
A normal web page — whichever one is configured as the cover. That is the whole point of the scheme: the server does not betray itself with a non-standard response. Which is why the cover should look plausible: a blank page or a default web server greeting stands out on its own.
How does Trojan differ from VLESS with Reality?
In whose domain and certificate get used. Trojan needs its own: buy the domain, issue the certificate, put content on the site. Reality borrows someone else, performing the handshake with a real popular site. Trojan is simpler in design and older, so support for it is nearly universal.