Cross-platform rule-based proxy client. Get the app, then import an existing subscription; use Global Routing and routing rules to choose how requests are handled. iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, Android and Linux: free.
Current version Loading · iPhone / iPad: $2.99 one-time; Mac, Windows, Android and Linux: free
First-time setup: import and connect step by step →
Rules determine how different requests are handled. View Rule in Config and set Global Routing to Config to route traffic using the selected configuration. Rules are usually matched from top to bottom; the matching rule's policy is applied. Put more specific conditions before broader ones. Keep a copy of the configuration before editing, then test with a specific domain. DOMAIN-SUFFIX matches a domain suffix, DIRECT means a direct connection, PROXY applies the proxy policy, and FINAL handles requests that did not match any earlier rule.
DOMAIN-SUFFIX,example.com,PROXYOn Demand triggers a connection based on configured network conditions; it does not replace Rule when deciding how each request is routed. Before checking On Demand conditions in Settings, connect manually once to confirm the server, permissions and configuration work. Then add conditions one at a time. If the connection returns after being disconnected, review this setting before repeatedly deleting servers. Network changes may also be affected by system scheduling. For troubleshooting, temporarily turn off On Demand and use the manual toggle to establish a consistent baseline.
On Demand → Connection conditions
Global Routing → Request handlingShadowrocket supports protocols such as Shadowsocks, VMess, VLESS and Trojan. A protocol name describes the connection method; it does not guarantee speed or availability. In Add Server, select Type first, then enter Host, Port and the required authentication fields using the information from your service provider. TLS, transport settings and server name must match the server configuration. A successful import does not eliminate the need to verify them. If a connection times out, check the protocol and port first, then check the network and authentication details. Avoid changing several parameters at once.
Type → Host → Port → Authentication and transport parametersGet the subscription URL from your service provider. In Add Server, select Subscribe, enter the URL and a recognizable note, then save and check that the expected entries appear in the server list. Updating a subscription retrieves a remote server list; it does not connect to a server. Once entries appear, select a server and turn on the connection. If import fails, check that the URL is complete and contains no spaces, then confirm the subscription is valid. Links may contain access credentials, so hide the full URL and authentication parameters before sharing screenshots or support records.
https://example.com/sub?token=xxxxConfig files store rules and related settings; Subscribe retrieves a server list. They are not interchangeable. To use rule-based routing, first confirm which configuration file is active, then check whether Global Routing is set to Config. Keep a copy of the original file before editing Rule, Hosts or other content so you can revert if something goes wrong. iCloud sync can transfer configurations between devices that support it, but check that syncing has finished and the correct file is selected. A synced configuration does not validate server details or replace a local connection test.
GEOIP,CN,DIRECT
FINAL,PROXYConnectivity Test helps assess connectivity, while traffic readings in Data show whether requests are generating data. Neither alone proves that every website is accessible. When troubleshooting, note the network, selected server and Global Routing setting, then compare results using the same destination. If the connection toggle will not turn on, check system permissions; for a server timeout, verify its parameters; if only some domains fail, check rules and DNS. Diagnostics in Settings can help locate the issue. Remove subscription URLs, passwords and other authentication details before sharing records.
Connection permission → Server connectivity → Rule / DNS → Target requestTwo ways to get it: iPhone / iPad costs $2.99 one-time on the App Store; Mac, Windows, Android and Linux are free. These links lead to the download page, where you can choose installation instructions for your device.
$2.99 one-time on the App Store; other platforms are free. The purchase is shared between the two devices. Check the App Store page for system requirements.
Before installing, verify the developer, icon and app ID. If you have already purchased the app, check your purchase history before repeating the process.
Free · Apple silicon / Intel. Check your chip type in About This Mac, then choose the matching installer.
If a system prompt appears the first time you open the app, follow the Privacy & Security instructions on the download page. You do not need to change server or subscription details.
Free. The download page provides a 64-bit installer. Before installing, confirm that the file came from this site's download page.
If SmartScreen blocks the file, verify its source first, then select “More info → Run anyway” to continue. Follow your organization's device policies on managed computers.
Free. An arm64 installer is available. After downloading it from the download page, grant permission to the current installation source when prompted by the system.
“Install unknown apps” permission and VPN permission when connecting are separate. You can turn off installation-source permission after installation if you wish.
Free · deb / rpm / AppImage. Choose a format for your distribution's package manager and confirm your system architecture first.
Install deb and rpm packages with the corresponding package manager; AppImage requires execute permission. See the download page for commands and first-run prompts.
This overview uses the interface terms from iPhone / iPad as a guide. Make one manual connection before setting up automatic connections or complex rules. Change one variable at a time to identify what caused a difference.
Prepare your subscription URL or server parameters. Get the URL from your service provider, then select Subscribe in Add Server and enter it. For an individual server, select the correct Type and fill in the corresponding fields. If you use Scan QR Code, verify the protocol, address and port after scanning; successful recognition does not mean the connection is working.
After saving, return to Home and check that the expected entry appears under SERVER. If the imported subscription contains several servers, test one first. Avoid updating the list, changing rules and switching servers all at once.
For rule-based request handling, choose Config and confirm that the required configuration file is selected. Proxy sends requests through the proxy policy and is useful for a temporary comparison; Direct provides a direct-connection comparison. A mode is not a server protocol and cannot fix incorrect connection parameters. Switching modes without checking the configuration can make it seem as if saved rules are not working.
If you are just getting started, note the current mode and file name. If some websites behave differently later, revisit these settings instead of immediately reinstalling the app or clearing all configurations.
Turn on the connection toggle and allow the VPN configuration when prompted by the system, then check the connection status. Run Connectivity Test and visit a specific destination page. Consider the test and actual access together: an enabled toggle only indicates that the connection process has reached a particular state. It does not guarantee that rules, DNS and remote services work for every domain.
Use the same network and server during verification. If the toggle will not turn on, check permissions; if all requests time out, check the server; if only certain destinations fail, check rules and DNS. Adjust the setting at the layer where the issue occurs.
Shadowrocket is a closed-source commercial app. This section distinguishes app identity, app access costs and your own connection service to help avoid confusion before installation.
iPhone / iPad users should verify the developer name, Shadow Launch Technology Limited, the official icon and app ID 932747118. A similar name in search results is not enough to confirm the app's identity. Open the product page and check each detail. The icon helps with recognition; the developer and app ID distinguish listings with similar names. Do not rely only on search ranking or promotional copy to decide whether to install.
If Shadowrocket does not appear in the mainland China App Store, first check the region of the Apple ID used for the store and any existing purchase history. Region can affect app availability, currency and payment terms; it does not mean the device cannot use the app. If you need to change your region, check Apple's official region-change process in your system account settings and review prerequisites such as balances and subscriptions. Check the App Store page for iPhone / iPad system requirements.
Shadowrocket costs $2.99 one-time on the App Store for iPhone / iPad, with the purchase shared between the two devices. Mac, Windows, Android and Linux versions are free. When changing devices or reinstalling, iPhone / iPad users should use the original purchasing account to check purchased items before downloading again. Restoring the app does not restore all local settings. Save any configuration files you need separately and keep your subscription details secure.
Installers for Mac, Windows, Android and Linux are provided on this site's download page and served through /dl/shadowrocket/. Choose the correct Apple silicon or Intel build for Mac, and the appropriate package format for Linux. Save your configuration before updating, then follow the installation instructions for your system on the download page. Manage iPhone / iPad app updates in the App Store; do not mix up these update paths.
Distinguish four stages—“app installed,” “details imported,” “connection established” and “destination accessible”—before deciding what to do next.
Importing retrieves a server list. You still need to select a server, check Global Routing, allow the system VPN configuration and turn on the connection. Confirm the list is not empty, test the current server, then check rules and DNS for the destination request. A successful subscription update is not a connection test. Follow the subscription import steps to check each item.
Choose Config when using rules, and confirm the configuration file is selected. Proxy and Direct are useful for temporary comparisons between proxy and direct connections. Return to your usual setting afterward so later traffic is not handled using a temporary mode. Note the original mode and server before switching to compare results under the same conditions. See the quick-start guide for details.
A latency test reflects a response under specific test conditions; it is not download bandwidth and does not indicate whether every destination is available. Keep the same network and test the same destination, then check whether only some requests are affected. If only certain domains are slow, check matching rules and DNS first. Continue by symptom in Troubleshooting.
The system may ask to add a VPN configuration the first time you turn on the connection. Confirm that the prompt was triggered by Shadowrocket, then grant permission as requested. If permission was previously denied, retry the connection and check the prompt again. Also check whether device management policies restrict VPN access. Permissions and subscription validity are independent; changing a subscription will not fix a system permission issue. See the connection and verification guide for the steps.
More on traffic statistics, system permissions and server selection. Establish a basic connection first, then use these guides to interpret specific readings and system prompts.
Compare readings by server and by app, understand the statistics scope and reset conditions, and check routing against request results. An increase only indicates that traffic was generated; verify that the destination is accessible as expected.
Read the Data statistics guide →Learn how first-connection authorization, VPN profiles and the app's connection toggle relate. If permission was denied by mistake or a profile is missing, restore access in order instead of mistaking a system restriction for a server problem.
Read about VPN permissions →Understand server selection through latency tests, region and protocol parameters. Learn why lower latency does not always mean faster access, and how to compare results using the same destination and network.
Read about choosing a server →