Official Manual · Getting & Configuration

Shadowrocket
Setup Guide

A cross-platform rule-based proxy client. Start with an existing subscription, check Global Routing, then use Config rules to see where requests go.

Download Shadowrocket All platforms

Current version · iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, Android, and Linux: free

First-time setup: view the guide →
VLESS On Demand Config

Configuration checks

From connection setup to request routing

Connection controls, server details, and routing rules belong to different layers. First check whether the configuration can connect, then identify which rule determines where a request goes. Change one variable at a time and keep the results for comparison.

View settings guide

Rule-based routing: check match order first

Rule-based routing determines which policy handles a request; it does not fill in missing connection parameters for a server. In Home, set Global Routing to Config, then open the currently selected Config and review its Rule section. Rules are generally matched from top to bottom. Put specific domain rules before broader ones, and use FINAL to catch requests that did not match earlier rules. If a website takes an unexpected route, note its domain and the rule that matched, then check the rule order and policy name. Do not change all requests to PROXY to mask the issue. The example on the right shows rule syntax; it is not a complete configuration for every network.

Rule · Example
DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXY
Policy meanings

DIRECT connects directly; PROXY uses a proxy policy; REJECT rejects matching requests. A successful match does not guarantee that the destination service is available.

On Demand: check automatic triggers

On Demand triggers connections based on configured conditions. Set it up after verifying that a manual connection works. Find On Demand in Settings and review each condition to understand which network changes should trigger a connection and which should be skipped. If the connection turns back on after being disabled, check this section before repeatedly deleting servers. To troubleshoot an unstable connection, temporarily disable automatic triggers and use manual operation as a comparison. Restore the previous conditions after identifying the cause. Background scheduling and network changes affect trigger timing, so automatic triggers do not guarantee a continuously available connection.

Settings path

Settings → On Demand

Verify a manual connection first, then add automatic trigger conditions.

Troubleshooting order

Temporarily disable On Demand → connect manually → test a network change → restore the verified trigger conditions.

Multiple protocols: choose Type based on your server details

When adding a server, Type must match the protocol actually provided by your existing server. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireGuard, and other protocols use different fields; changing only the protocol name does not convert a configuration. In Add Server, choose Type first, then check Host, Port, and the corresponding authentication and transport parameters. Review the fields after importing from a link or QR code, especially any trailing parameters that may have been lost during copying. A protocol name describes the communication method, not speed or availability. Check server status, parameter compatibility, and current network conditions separately.

Protocol reference
ShadowsocksVMessVLESSTrojanHysteria2WireGuard
Add Server

Type → Host → Port → corresponding authentication parameters. See the glossary for field definitions.

Importing subscriptions: distinguish URLs from configuration content

Subscriptions provide a centralized way to retrieve and update your existing server entries. Before importing, get the complete URL from your own service provider. Check for extra spaces, line breaks, or truncation, then select Subscribe in Add Server and enter the URL. After saving, return to Home and check the entry; update it manually if needed. If the list is empty after an update, distinguish between an inaccessible URL, a response that is not in subscription format, and a failure to parse server entries. Updating a subscription does not update the routing rules in Config, nor does it make the currently selected server usable automatically. Subscription URLs may contain access credentials; hide the full URL when sharing screenshots of an issue.

Import checks

Add Server → Subscribe

Check the complete URL, save result, manual update, and server selection in order.

Different functions

A subscription maintains the server list; Config manages rules and related settings. Check them separately so a list update is not mistaken for a rule update.

Config: confirm which file is in use

Saving a configuration file and enabling it are two different things. Open Config, confirm which file is selected, then review sections such as General, Rule, and Hosts. Keep a restorable copy before making changes. After updating a remote configuration, check again whether local changes are still present so a sync or overwrite is not mistaken for a rule failure. If you use iCloud sync, confirm that the content has reached the target device and check the selected file again there. Syncing a configuration does not sync the current network state or replace checks of server credentials. Change one setting at a time and record the results before and after.

Config sections
GeneralRuleHostsURL Rewrite
iCloud

Confirm the file has synced, then check which item is selected. Keep a copy before making changes and restore the last working configuration if an issue occurs.

Diagnostic tools: isolate the affected layer

Connectivity Test, Diagnostics, and Data provide entry points for connectivity checks, diagnostic clues, and traffic monitoring. First test the basic network with the connection off, then turn it on and test the same destination again. A single timeout does not prove that all requests are failing; the test destination, DNS resolution, and server status can all affect the result. Traffic changes in Data can help show whether requests are being made, but do not prove on their own that a request succeeded. When reporting an issue, include the network type, Global Routing mode, current Config, and reproducible steps. Hide server credentials, subscription URLs, and personal browsing records before sharing.

Diagnostic tools
Connectivity TestDiagnosticsData
Issue index

Check switch behavior, server timeouts, DNS issues, and post-update problems using different paths. See the troubleshooting guide.

GLOBAL ROUTING

What to check in each of the three modes

Config / Proxy / Direct in the interface correspond to configuration, proxy, and direct connection. The selected mode determines how requests are handled; it does not change server authentication parameters.

Config: route traffic using the current configuration

When requests need to be handled differently based on domains, IPs, or other conditions, select Config and confirm which file is selected on the Config page. If a request takes an unexpected route, check the first rule it matches and whether the referenced policy exists. The same server can behave differently with different rule files, so keep the server fixed and compare only rule changes while troubleshooting. If a rule example refers to PROXY, also confirm that the corresponding policy can find an available server in the app. Do not overwrite the current file with a complete configuration you have not reviewed.

Get by device

Shadowrocket for all platforms

iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, Android, and Linux: free. Installation packages are available at /dl/shadowrocket/ on this site. The homepage links to the download guide, where you can choose your device.

iPhone iPad

iPhone / iPad

App Store: $2.99 one-time; Mac, Windows, Android, and Linux: free.

Check the product page using your own purchasing account, then complete the download. Both devices share the same purchase record; check the App Store page for system requirements. Before first use, prepare your own subscription or server details. Installation does not create a connection configuration automatically.

View App Store and purchase details

Mac

Free · Apple Silicon / Intel

Check the chip information in About This Mac. The download page provides separate Apple Silicon and Intel installation options. If you see “Apple cannot verify the developer” when opening the app for the first time, confirm the download source, then follow the download guide to check Privacy & Security. Do not repeatedly switch to files from unknown sources.

View Mac installation options

Windows

Free

The download page provides a 64-bit Windows installer. If SmartScreen appears on first launch, confirm the file is from this site, then select “More info” and “Run anyway.” Installer prompts and connection issues require different troubleshooting steps. Check connection parameters separately after the app opens successfully.

View Windows download details

Android

Free

Use the arm64 installation option on the download page. If the system asks for installation permission, allow “Install unknown apps” only as needed for the download app you are using. You can restore the previous setting afterward. If a download will not continue inside WeChat, open this site's download page in your system browser and follow the instructions there.

View Android installation guide

Linux

Free · deb / rpm / AppImage

Choose deb or rpm according to your distribution's package manager. For AppImage, grant the file execute permission first. The download guide provides the corresponding steps. If dependency or launch errors appear, keep the complete error message. Resolve startup issues before importing an existing configuration.

View Linux installation options

View all platforms →

First-time setup

Add a configuration, choose a mode, test the connection

The steps below use the iPhone / iPad interface as an example. First verify a repeatable manual connection, then configure automatic triggers and more specific routing conditions.

Step 01 · Add Server

Import an existing server or subscription

In Home, open Add Server and choose the protocol based on your existing details, or use Subscribe to import a complete subscription URL. After saving, check the SERVER list to confirm the entry appears, then select the server you want to use. After importing with a QR code, check the protocol and key fields too; do not rely on the entry name alone to confirm the configuration.

Step 02 · Global Routing

Check the mode and Config

For rule-based routing, select Config and check which file is selected on the Config page. If using Proxy temporarily for comparison, note the original setting. The server list determines the connection destination; Config manages the rules. Check both. Avoid adding multiple unfamiliar rule sets during initial setup, or it will be difficult to tell which change affected the result.

Step 03 · Connectivity Test

Connect and compare results

Follow the system prompt to allow the VPN configuration, then turn on the connection. Visit a known test destination first, then use Connectivity Test as an additional check. A connected status means the connection state changed; it does not mean every destination is accessible. If a test fails, record the mode, server, and error message, then narrow down the cause using the troubleshooting guide.

View the complete guide →

Product verification and access

Check product details before purchase or recovery

Shadowrocket is a closed-source commercial app. This is the official website and manual. Access, configuration, and troubleshooting are separate steps and should be checked independently.

Developer Shadow Launch Technology Limited App ID 932747118 2 access options · App Store and this site's installation packages

Developer, icon, and App ID

Before getting Shadowrocket on iPhone / iPad, check the product name, Shadowrocket; the developer, Shadow Launch Technology Limited; and App ID 932747118. Compare the official icon shown on the product page as well. Matching text in search results alone is not enough to verify a product. Open the specified product page from the download guide and check each detail. Do not assume that the price or feature descriptions of similarly named listings apply to Shadowrocket.

The official icon uses a blue-purple outlined design on a white background, and the same icon appears in the site header. Verify the complete product details rather than relying on color, search ranking, or a single promotional image.

Store availability and account region

This app is currently unavailable on the mainland China App Store. If you cannot find it, check the store region for your Apple ID before trying different search terms. The store region affects product availability, local currency pricing, and payment options. Before changing regions, read the account's region-change requirements and resolve any restrictions involving existing balances or subscriptions, then follow Apple's account settings process.

Check the App Store page for iPhone / iPad system requirements. If the page says the device is incompatible, check the system version and product requirements first. Account-region issues and system compatibility issues are different problems.

Pricing tiers and purchase records

iPhone / iPad: $2.99 one-time on the App Store, with prices shown in local currency by storefront. Mac, Windows, Android, and Linux versions are free. The same purchase record can be used on iPhone and iPad with the purchasing account. When changing devices or reinstalling, check your purchased items first instead of buying again before verifying the account.

Re-downloading the app does not restore local configuration. Restore saved subscriptions, server details, and Config files from your own backups or available sync content, then confirm the selected item on the new device.

App purchase ≠ server plan

The app purchase covers access to the app, not server access. The import guide assumes that you already have your own subscription or server details. This site does not provide, sell, or recommend nodes or subscriptions; it explains how to enter, update, and troubleshoot information you already have. An empty list after installation does not mean the app was not obtained successfully.

For an expired server, changed authentication details, or an invalid subscription URL, check with your existing service provider. Re-purchasing the app cannot resolve these issues, and repeatedly overwriting Config is not a suitable fix.

Keep a comparable configuration when updating the app

Manage iPhone / iPad app updates through the App Store. For other platforms, get the appropriate new installation package from this site's download guide; Mac packages are separated for Apple Silicon and Intel. Installation packages are available only through this site's /dl/shadowrocket/ path. Before updating, keep your existing server details and a working Config. After updating, test with the previous configuration before changing settings one at a time. If a new issue appears, record the exact message in the app, device system, network type, and sequence of actions. Do not change the server, subscription, rules, and DNS all at once, or you will lose the before-and-after comparison.

View product verification and purchase recovery details →

More to read

Installation formats and App Store instructions

Read the article that matches your current issue: Linux package formats, verifying the App Store listing, or first-launch prompts on desktop. After installation, return to the setup guide to import your existing configuration.

View all articles →