Cross-platform rule-based proxy client for importing existing services and configuring rule-based routing. iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, Android, and Linux: free.
Current version Loading · iPhone / iPad: $2.99 one-time; Mac, Windows, Android, and Linux: free
Getting started: setup and connection guide →
Start by understanding the roles of servers, Config, and the connection switch. A server determines which existing route handles a request; Config determines which policies apply; the switch establishes the connection. The steps below follow the actual setup sequence, keeping a successful import, active rules, and a working network connection distinct.
Check Rule in Config to direct requests by domain, keyword, or IP range. Rules are matched from top to bottom; the first match determines whether to use PROXY, DIRECT, or REJECT, while the final entry, FINAL, handles the remaining requests. For everyday use, set Global Routing to Config and check which file is active. A temporary choice of Proxy or Direct does not indicate whether the original rules are correct. Keep a copy before making changes, place specific domain rules before broader ones, and verify the result with an actual request.
DOMAIN-SUFFIX,example.com,PROXY
On Demand uses configured network conditions to determine when to connect, which is useful when switching between familiar networks. First connect manually from Home and verify access. Then review the On Demand conditions in Settings, checking which networks apply and how each condition is triggered. Its role differs from Rule: the former controls when to connect; the latter determines where requests go. If the connection resumes automatically after you turn it off, check these conditions instead of repeatedly deleting servers. Temporarily disabling automatic triggers during troubleshooting helps keep test conditions stable.
On Demand
In Add Server, choose a Type based on your existing server details, then enter Host, Port, and the authentication fields required by the protocol. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different parameter structures; changing only the protocol name while reusing the rest of the fields will not work. When entering details manually, check the transport, security, and authentication settings against those provided by the service. Check key fields after importing a QR code, too. Saving only adds the details to the client; it does not confirm remote access. If a connection times out, first verify the protocol and address, then check the network and server status.
Shadowsocks / VMess / VLESS / Trojan / Hysteria2 / WireGuard
If you already have a subscription, follow the guide to add its address to Shadowrocket, update the corresponding group, and select a server. Subscribe retrieves the server details returned by the address; it does not load a Rule configuration file. Before updating, check that the address is complete and has no added spaces or line breaks. If the update fails, note the error first, then check whether the address has expired and whether it is reachable on your current network. Keep the original address before deleting a group so you have what you need to restore it. Subscription addresses may contain personal credentials; hide the full address and authentication details when submitting an issue or sharing a screenshot.
Subscribe
Config organizes settings such as General, Rule, and Hosts in a single file. Confirm which configuration is in use before changing individual settings. After importing a new file, make sure it is selected; a file's presence alone does not mean it is active. Routing follows the corresponding configuration only when Global Routing is set to Config. Proxy or Direct selects a different overall routing mode. To move settings between devices, use an available iCloud sync option in the app, then check the active status again on the receiving device. Syncing a configuration does not transfer a store purchase or replace a server connection test.
[General] → [Rule] → FINAL
Start with Connectivity Test on Home to check basic server connectivity, then visit the actual destination to narrow down the issue. Diagnostics in Settings helps collect troubleshooting details. Data can help show traffic activity, but a change in statistics alone does not prove that a website is reachable. If the test succeeds but a page does not load, continue by checking DNS, the current Config, and the matched policy. If every server times out, check the local network and existing service status first. Change one variable at a time and record the result before and after each change so you can identify the cause.
Connectivity Test / Diagnostics / Data
iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, Android, and Linux: free. Choose an option for your device, then check the chip or package format. Desktop and Android installers are available from this site at /dl/shadowrocket/. Download buttons and first-launch instructions are on the Get the app page.
$2.99 one-time on the App Store; Mac, Windows, Android, and Linux versions are free.
For phones and tablets. Check the App Store page for system requirements. The first time you connect after installation, follow the system prompt to allow a VPN configuration. Importing server details and allowing the system configuration are separate steps.
Free · Apple silicon / Intel. iPhone / iPad: $2.99 one-time on the App Store; other platforms are free.
Check your chip in About This Mac, then select the matching dmg. If you see “Apple cannot verify the developer” the first time you open it, confirm the installer came from this site, then choose “Open Anyway” under “Privacy & Security.” Follow the download page for other prompts.
Free. iPhone / iPad: $2.99 one-time on the App Store; other platforms are free.
Choose the 64-bit exe installer. If SmartScreen appears, first check the source and filename, then select “More info” to find “Run anyway.” On a computer managed by your organization, follow administrator policies and do not change its security restrictions.
Free. iPhone / iPad: $2.99 one-time on the App Store; other platforms are free.
Use the arm64 apk. After downloading, follow the system prompt to allow “Install unknown apps” for the browser or file manager that opens the file. You can revoke this permission after installation. The first connection also requires you to approve the system VPN connection request.
Free · deb / rpm / AppImage. iPhone / iPad: $2.99 one-time on the App Store; other platforms are free.
Choose a package format that matches your distribution's package manager. deb and rpm packages use the relevant package manager to handle dependencies; AppImage requires execute permission. If startup fails, keep the terminal output and check the runtime environment against the installation guide.
The steps below use iPhone / iPad as an example. Before you begin, have your existing subscription or server details ready and make sure the device can access the internet with the proxy connection off. Start with the shortest working setup, then add options such as automatic connection and configuration sync. If something goes wrong, this makes it easier to find what changed.
To add a server manually, open Add Server from Home, choose a Type based on your existing server details, and enter Host, Port, and the relevant authentication information. For an existing QR code, use Scan QR Code. To add a subscription, follow the guide to import the complete address. After updating, check that servers appear in the group and select one. Do not treat a Config file containing rules as a server subscription, or enter a subscription address in Host.
If the list is empty after import, first check whether the returned content is in a format the client can read, then check that the address is complete and its credentials have not expired. Repeatedly toggling the connection switch will not help while the server list is empty. After adding a server manually, reopen its entry and compare each field with the original details, especially the port, protocol, transport, and security settings.
For everyday rule-based use, select Config and confirm that the expected file is enabled. Proxy is for testing all requests through the proxy; Direct is for routing all requests directly. These modes change how requests are handled; they do not fix server parameters. If the same destination works with Proxy but fails with Config, check the matched rule and DNS before importing the subscription again.
Keep the configuration simple during the first test. Check the policy used by FINAL, then see whether an earlier entry matches the destination domain. PROXY, DIRECT, and REJECT in a configuration are rule policy keywords; Config, Proxy, and Direct in Global Routing are interface options. Distinguish where each term appears when following instructions.
Return to Home, turn on the connection switch, and confirm the system's VPN configuration request. Once connected, run Connectivity Test, then visit the destination you need. The test result and website access are separate checks: a successful test means the corresponding test request received a response, while a website may still be affected by DNS, rules, or the remote service.
If the switch will not turn on, check system permissions and other VPN configurations. If every server times out, check the local network. If only some destinations fail, check the rules and DNS resolution. Keep one test destination, one server, and one configuration at a time, and record the exact error. This separates connection, resolution, and routing issues instead of repeatedly changing several settings.
Shadowrocket is closed-source commercial software. Check the correct platform source before getting it, and understand how the purchase differs from access to an existing service. This is the official Shadowrocket site and manual, with download information, setup guides, and troubleshooting focused on using the client.
Check the name, icon, and App ID together in the store; do not rely only on the first search result.
See the authenticity checks →On the App Store product page, confirm the name is Shadowrocket and the developer is Shadow Launch Technology Limited, then check that the product URL contains App ID 932747118. The official icon is a rocket with a blue-purple outline on a white background, matching the official icon shown on this page. Similar names and graphics are not enough to confirm authenticity. Open the product details from search results and check them carefully to avoid confusing information about different products.
Desktop and Android users can choose an installer from this site's Get the app page without using a mobile store listing. The file format, operating system, and chip architecture must match. If the system blocks the app from opening, return to the Get the app page to confirm the source, then follow the instructions for your system. Do not assume every system prompt is related to a subscription or server.
Store availability for iPhone / iPad depends on the region of the Apple ID used for “Media & Purchases,” not directly on the website or device language. The mainland China App Store does not offer this app. If it does not appear in search, check the account region and product page instead of repeatedly changing your search terms. To change regions, use the country or region option in system account settings, and first review the store's requirements for balances, subscriptions, and payment methods.
Check the App Store page for system compatibility requirements. One device being able to install the app does not mean another device meets the requirements, and store availability is different from device compatibility. The Get the app page covers store checks, account region, and system requirements separately, so you can review each item before paying or reinstalling.
The iPhone / iPad version costs $2.99 as a one-time App Store purchase; each storefront may display the price in local currency. The Mac, Windows, Android, and Linux versions are free. iPhone and iPad share this purchase under the same purchasing account. When changing devices or reinstalling, first confirm that “Media & Purchases” uses the original purchasing account, then find Shadowrocket in purchased items and download it again as shown in the store.
If you see a price button instead of a redownload option, check your purchase history and current account before paying again. Restoring purchase eligibility and restoring configuration are separate tasks. After redownloading, check whether your original server details, subscription address, and Config have been restored. Desktop and Android users can return to this site's download page for an installer. Keep necessary configuration before moving devices and protect any personal authentication details it contains.
Buying the client grants the right to use the app; it does not create a server or subscription. The import steps in this guide assume that you already have your own subscription or server details. This site does not provide, sell, or recommend nodes, subscriptions, or invitation codes. Ask your own service provider about server addresses, authentication details, availability periods, and remote service status.
If the app is installed but no server has been added, that does not mean proxy connectivity is ready to use. Likewise, a successful subscription update only means that a set of details was retrieved; it does not mean every item can currently connect. Troubleshooting is clearer when you separate app access, server details, connection establishment, and destination access into four steps. This helps distinguish a client purchase issue from a service connection problem.
Check for iPhone / iPad app updates in the App Store. For Mac, Windows, Android, and Linux, download the relevant updated installer from this site's Get the app page. App updates, Subscribe updates, and Config updates are separate operations: the first replaces the program, the second refreshes server details, and the third changes rules or other settings. Completing one does not mean the others have changed too.
Before updating, keep a copy of the configuration in use and note the Global Routing option and selected server. If something goes wrong after an update, reproduce it with the original test destination, then check connection permissions, the active configuration, and resolution results. When sharing troubleshooting details, include the exact error, steps taken, and system prompts, but hide subscription credentials, passwords, and personal addresses. Avoid changing every parameter at once so you can compare results against a stable baseline.
Continue with the guide that matches your current issue. If the system blocks the app on first launch, start with the installation guide. If store listings are hard to distinguish, check authenticity first. If the app is imported but you are unsure how to connect, read the beginner guide. Interface terms remain in English so you can match each step to the app.
Check whether your Mac has Apple silicon or Intel, then choose the matching dmg; for Windows, choose the 64-bit exe. Follow the system prompts to distinguish “Apple cannot verify the developer” from SmartScreen, and check the source and approval settings step by step without mixing installation issues with connection settings.
Read the installation guide →Learn how to verify Shadow Launch Technology Limited, the official icon, and App ID 932747118 on the product page. When listings have the same or a similar name or icon, check all three rather than relying on the name, search position, or description alone.
Read the verification guide →Answers to common questions about the connection switch, Global Routing, subscription updates, and using multiple devices. First understand the difference between purchase eligibility, server details, and Config, then decide what to check. If you already have an error message, go directly to the relevant troubleshooting steps.
Read the beginner guide →