Before installing Shadowrocket, check your processor architecture and distinguish a first-launch confirmation from a genuine security warning. This guide is for first-time Shadowrocket users on Mac or Windows. Follow the steps to choose the right installer, complete setup and any required permissions, then import a subscription you already have. Use Global Routing to separate installation, connection, and rule-related issues.
Check your system and processor
Choose a Mac version based on the chip information in About This Mac—not the computer’s size, purchase year, or appearance. Open the Apple menu → About This Mac. If it lists “Chip” and an Apple M-series name, choose the Apple silicon version. If it lists “Processor” and Intel, choose the Intel version. Both versions are free; download the DMG that matches your Mac’s architecture.
On Windows, open Settings → System → About and check “System type.” The EXE installation steps here are for 64-bit x64 Windows. If your processor is ARM-based, don’t assume that “64-bit” means x64; check the download page’s compatibility notes first. A 64-bit installer also won’t run directly on a 32-bit system.
Mac installation checklist
- Where to check
- Apple menu → About This Mac
- Apple silicon
- Choose the Apple silicon DMG
- Intel processor
- Choose the Intel DMG
- Install location
- Applications
Don’t run the app long-term from the mounted DMG. Copy it to Applications first.
Windows installation checklist
- Where to check
- Settings → System → About
- Processor architecture
- Check whether it’s x64
- Installer type
- 64-bit EXE
- First launch
- Check the file source and system prompt
If you see “This app can’t run on your PC,” check the architecture and download integrity first; don’t bypass security checks.
Choose your platform on the Get the app page. iPhone and iPad versions are available from the App Store for a one-time $2.99 purchase; see the App Store listing for system requirements. The Mac (Apple silicon and Intel), Windows, Android, and Linux versions are free. The Get the app page links to on-site downloads for desktop and mobile installers; this guide does not include direct download links.
Installing and opening for the first time on Mac
Installing an app on Mac and approving its first launch are two separate steps. Copying the app completes installation, but macOS may still need to approve its first launch. Copy it first, then open it from Applications to avoid treating the mounted DMG as the installation location. If the downloaded file still has a temporary browser extension, wait for the download to finish—don’t rename it to DMG yourself.
-
Choose the right version
On this site’s Get the app page, select Mac, then choose Apple silicon or Intel based on About This Mac. Don’t default to trying the other architecture if the app won’t open the first time.
-
Copy the app
Double-click the downloaded DMG and copy Shadowrocket to Applications. Wait for the copy to finish, then find the app in Finder → Applications. Before replacing an existing app, quit any running instance.
-
First launch
Open Shadowrocket from Applications. If macOS only asks whether you want to open an app downloaded from the internet, check the app and its source, then continue. If it says the developer can’t be verified, close the alert and address it in System Settings first.
-
Approve the app
In System Settings → Privacy & Security, look for the entry for the app that was just blocked. Check its name. If macOS offers “Open Anyway,” select it, authenticate if prompted, then confirm. In older macOS versions, the equivalent setting may be under System Preferences → Security & Privacy → General.
If Privacy & Security doesn’t show an entry for the app, make sure you tried opening it from Applications and check the exact wording of the system alert. A Mac managed by a company or school may be restricted by device policies; contact your administrator in that case. Some macOS versions let you confirm via Finder by Control-clicking the app and choosing Open, but behavior varies—follow the options your system actually provides.
Installing and handling warnings on Windows
Windows SmartScreen displays a reputation check before an app runs. Its appearance alone doesn’t mean the installer is faulty, and not all security warnings are the same. Continue with the steps below only after confirming the file came from this site’s Get the app page, matches your system architecture, and the prompt is a SmartScreen run confirmation.
-
Download the installer
Choose Windows on this site’s Get the app page and wait for the 64-bit EXE download to finish. If your browser reports a download failure, download it again. Don’t run a file that is still downloading, has an unusually small or large size, or comes from an unverified source.
-
Review the prompt
Double-click the EXE. If SmartScreen displays “Windows protected your PC,” select “More info,” review the app information shown, and confirm that this is the file you just downloaded from this site.
-
Confirm and run
Only after checking the source, select “Run anyway” if Windows offers it. If Windows Security reports a detected threat, stop the installation. Don’t turn off antivirus protection as a workaround.
-
Finish installation
Follow the installer prompts to choose a location and complete setup. If User Account Control appears, check which app is requesting permission. If administrator approval is required, have an authorized account approve it; don’t set the app to always run as administrator for everyday use.
If “Run anyway” isn’t available under “More info,” device management policies or current security settings may be responsible. Don’t keep changing the file extension or turn off SmartScreen. On a managed device, ask your administrator which installation method is allowed. On a personal device, note the full prompt and check whether Windows has also reported a threat or architecture incompatibility.
- “This app can’t run on your PC”: Check the difference between x64 and ARM, and make sure the installer downloaded completely.
- Permission denied: Determine whether the issue is write access to the installation folder, User Account Control, or an organization policy. The word “permission” alone doesn’t identify the cause.
- Nothing happens after clicking: Check Task Manager for an installer or app process that’s already running before trying again.
Check the first connection
If the app’s main window opens, installation and launch are working. Website access also depends on your existing service, subscription status, system network permissions, and routing choice. Don’t reinstall the client just because a subscription update failed, and don’t assume installation automatically configures a service.
First-run checks for both systems
Mac
- On Mac, open the app from Applications—not from the mounted DMG.
- If the system asks to add a VPN configuration, confirm that your action prompted the request before approving it.
- Change one network setting at a time and keep the original configuration so you can restore it.
Windows
- Once installation is complete, make sure you’re launching the app, not running the installer again.
- If a firewall prompt appears, choose the appropriate network scope; don’t allow access on every network by default.
- End any existing proxy or VPN session to avoid simultaneous changes to system network settings.
Check that the app launches first, then test the connection, and finally troubleshoot rules. Handle each stage separately.
If you already have a provider and subscription, go to Home, tap “+” in the upper-right corner → Type → Subscribe, paste the complete link, and save. Then update the subscription from Home and select a valid entry. The add button may be in a different place in other desktop layouts; use the feature with the same name. Don’t split a subscription URL into a server address and port, and don’t use a website login URL as a subscription URL.
Subscription links often contain access credentials, so treat them like passwords. Before sharing a screenshot, hide link parameters, usernames, and passwords. This site does not provide, sell, or recommend connection services or subscriptions. The client installation and the validity period and device limits of your existing service are managed separately.
- Home: Check that the subscription has been updated and an entry selected, then enable the connection. Connectivity Test can help with diagnosis, but a successful test doesn’t guarantee access to every website.
- Config: Check which configuration file is active. Importing a file without enabling it doesn’t mean its rules are in effect.
- Settings → On Demand: For initial troubleshooting, connect manually. If the device reconnects automatically, check whether On Demand is enabled before treating it as an installation issue.
How to choose Global Routing
A common first-launch mistake is assuming that turning on the connection switch means every request will use a proxy. Global Routing determines how Shadowrocket handles traffic it has taken over. The options below compare three modes within Shadowrocket. Note the original setting before switching temporarily, then restore it.
Config
RecommendedHandle requests according to the rules in the active Config. Rules are generally matched from top to bottom; the matching rule’s policy applies, and the final rule handles requests that don’t match. Recommended for everyday use with a verified configuration.
Best for: Using an existing valid configuration to route traffic by destination.
Proxy
Route requests taken over by the client through a proxy. This can help check whether the current connection works, but it won’t fix an inactive service or guarantee that traffic from programs the client hasn’t taken over will use the same route.
Best for: Briefly checking the connection itself against rule selection.
Direct
Send requests taken over by the client directly. Even if the connection switch appears on, that doesn’t mean websites are being accessed through a proxy. Don’t leave this mode selected when testing proxy connectivity and mistake the result for a failed service.
Best for: Comparing with a direct local connection to check basic network status.
If a destination works under Proxy but not under Config, first check which rule matches it, whether that rule’s policy is working, and whether the right Config is selected. Don’t rewrite all your rules straight away. If both modes fail, check the subscription’s validity, the selected entry, and your network environment first; changing rules usually won’t fix a connection problem. Scene is for choosing among configured scenarios; avoid enabling it during initial diagnosis unless you’ve checked what those scenarios contain.
First-launch FAQ
On Mac, if the app says it’s damaged, should I still choose “Open Anyway”?
No. Don’t use the bypass steps for an unverified developer warning. Delete the downloaded file, return to this site’s Get the app page, and choose the version that matches your Mac’s processor. Make sure the download completes. If the same warning appears, note your macOS version, processor type, and the full alert, then troubleshoot further. Don’t use unknown Terminal commands to modify the app or system protections.
On Windows, what if “Run anyway” isn’t available?
First confirm that the window is from SmartScreen, not a threat detection or organization policy alert. On a managed computer, contact your administrator. On a personal computer, note the exact wording and check the relevant information in Windows Security. Don’t disable all security features just to make the button appear.
Installation is complete, so why are there no entries to select in Home?
Installing the client doesn’t create a connection service. Add a Subscribe URL you already have and update it to get the corresponding entries. If the update returns nothing, check the complete URL, service validity, and response. Reinstalling usually won’t change what the subscription returns.
The connection turns back on after I switch it off. Did installation fail?
Check Settings → On Demand for automatic connection conditions, then check the VPN auto-connect settings in your system. Note the original settings, temporarily disable automatic triggers, and test manually. If the network still behaves oddly after quitting the app, check the system proxy or VPN status; deleting a desktop shortcut won’t address the issue.
To investigate further, gather four details: device architecture, the exact system prompt, whether the failure occurred during installation or connection, and the current Global Routing selection. “SmartScreen appeared after I double-clicked the EXE” is more useful than simply saying “it won’t open.” Then follow the steps in this site’s Troubleshooting guide. Hide subscription credentials before sharing screenshots.
Get the app and guides
The iPhone and iPad versions cost $2.99 as a one-time App Store purchase; see the App Store listing for system requirements. The Mac (Apple silicon / Intel), Windows, Android, and Linux versions are free. Choose your platform on the Get the app page, then follow the guide to import a service configuration you already have.