Rule-based proxy client for all platforms with rule-based routing. iPhone / iPad: $2.99 one-time purchase through the App Store; Mac, Windows, Android, and Linux versions are free.
Current version Loading · Free for Mac, Windows, Android, and Linux
Getting started: import and connection steps →Routing rules assign a connection path to different requests. In Config, check Rule and set Global Routing to Config to apply the active configuration. Rules are generally matched in order; place specific domains before broader conditions. DIRECT, PROXY, and REJECT mean direct connection, proxy, and reject, respectively. Save a backup before editing, change one condition at a time, then use the connection log to check the destination, matched rule, and final policy. The syntax on the right is an example, not an app screen or a configuration already imported on a device.
Config / Rule
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXYOn Demand establishes connections based on configured conditions. See the related options in Settings. For first use, turn off automatic triggers, confirm that a manual connection and your existing configuration work, then enable only the conditions you need. On Demand determines when to connect; it does not choose routing policies through Global Routing or fix invalid server details. If a connection returns after being turned off, check On Demand and the system VPN settings before treating it as a fault. Retest the triggers after switching Wi-Fi or cellular networks.
Settings / On Demand
On Demand
Global Routing
Config / Proxy / DirectShadowrocket supports Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireGuard, and other protocols. To add an existing server, check Type in Add Server, then enter the address, port, and authentication fields from your server details. TLS, transport methods, and other options vary by protocol; changing only the type does not make all existing parameters compatible. A successful import only means the content could be read, not that the remote connection works. If a connection times out, check server status, network conditions, and whether all fields are complete.
Add Server / Type
Shadowsocks / VMess / VLESS
Trojan / Hysteria2
WireGuard / HTTP / SOCKS5Subscriptions help manage a set of server details you already have. Get the subscription URL from your own provider, enter and save it under the Subscribe type in Add Server, then update and check the returned content. A single share link and a subscription URL serve different purposes; do not identify them by appearance alone. If an update fails, keep the existing list and check the URL, its validity period, and your network before trying to delete and recreate it. Subscriptions may contain access credentials; remove the full URL and authentication details before copying logs, taking screenshots, or syncing configuration.
Add Server / Subscribe
Type: Subscribe
URL: https://example.com/sub
Remark: PersonalConfig stores rules and related request-handling settings, while the server list stores the information needed to connect remotely. They are related but are not the same content. After switching configurations in Config, check that Global Routing is set to Config if needed. Keep the original file before editing General, Rule, or Hosts, and avoid changing several variables at once. For iCloud sync, check the sync switch, account, and target file, then verify the actual content on the other device. Always review the sync result instead of overwriting the only usable local backup.
Config
[General]
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTConnectivity Test provides an initial check of an existing server's reachability; its numbers do not replace real browsing results. For connection issues, troubleshoot in this order: local network, server parameters, Global Routing, then DNS. Next, view relevant details under Diagnostics in Settings. Traffic records in Data can help show whether requests pass through the client, but are not a provider usage bill. When documenting an issue, note the network, destination, and steps to reproduce it. Remove passwords, subscription URLs, and personal access records before sharing.
Connection check order
Connectivity Test
Global Routing / DNS
Settings / Diagnostics
DataiPhone / iPad: $2.99 one-time purchase through the App Store. Mac (Apple Silicon / Intel), Windows, Android, and Linux versions are free. The download page provides platform selection, installation instructions, and links to downloads hosted on this site. When switching devices, check the platform and processor type again.
Check the App Store listing for system requirements. Before purchasing, verify the developer and app ID. If you already own it, check Purchases under the same Apple ID you used to buy it. iPhone and iPad share the purchase; configuration does not automatically appear on the other device. After migration, verify server details and Config.
Check your chip or processor in About This Mac, then choose the matching DMG installer. Each architecture has a separate download; you do not need to identify it by the computer's appearance. If developer verification appears on first launch, confirm the file came from this site, then follow the Privacy & Security steps on the download page.
Use the Windows installer on the download page. If SmartScreen blocks it, first confirm the download source and file, then select More info → Run anyway. After installation, import your own server details and check that the connection works before restoring personal rules. This keeps installation issues separate from configuration issues.
Check your device architecture in system settings, then use the APK from this site's download page. If installation requires permission, allow installation from unknown apps only for the browser or file manager you are using. You can turn off this permission afterward. Before allowing a VPN connection in the app, check whether another VPN connection is already using the system tunnel.
Choose a package format for your distribution: Debian / Ubuntu usually use deb, Fedora and some other distributions use rpm, and other environments can check whether AppImage is suitable. AppImage needs execute permission before its first run. See the download page for specific commands and system prompts; do not reuse installation commands across different distributions.
Desktop and Android installation packages are provided through this site's /dl/shadowrocket/ path. If the system blocks installation, verify the source first, then see the instructions for that platform. Do not disable all system protection just to continue.
The steps below use the iPhone / iPad interface labels. Before starting, prepare your own subscription URL or server details and confirm that your local network works normally. Make a manual connection first, then configure automatic triggers, refine rules, or migrate between devices. This makes it easier to identify what changed when troubleshooting.
Open Add Server from Home. For an individual server, enter the address, port, and authentication details under Type. For an existing subscription, select Subscribe, save the URL, and update it. When using Scan QR Code, confirm the content comes from your own configuration. Check the protocol and fields after scanning; do not rely only on whether a name appears in the list.
After updating a subscription, confirm that the list contains actual entries before selecting a server. If the response is a webpage, sign-in prompt, or error, check the URL and access conditions first. Repeatedly tapping the connection switch will not fix an invalid subscription format. A full subscription URL may contain credentials; do not post it publicly.
Config in Global Routing applies the active configuration's rules, Proxy uses the proxy mode, and Direct connects directly. For rule-based routing in everyday use, confirm that the Config file is selected and set Global Routing to Config. Importing a server does not automatically select or verify a complete set of rules for you.
For comparison, you can temporarily switch modes while troubleshooting, but change only one option at a time and note its original value. If Proxy works but a destination fails under Config, check the matched rule and related DNS settings before assuming the entire server is unavailable. Restore the intended mode after testing.
Return to Home, select a server, and turn on the connection. When the system first requests VPN permission, read the prompt and confirm. Then run Connectivity Test and try a destination you use regularly. A connected status only shows that the connection was established; it does not mean every request will succeed.
If access still fails, note the network, selected server, Global Routing mode, and specific error. Check the local network first, then review parameters, rules, and DNS. Retest the same destination after each check. A latency test reflects response under specific test conditions, not real download speed or sustained access performance.
This is the official Shadowrocket site and manual. Shadowrocket is a closed-source commercial app. Before getting started, verify the source, understand the purchase terms, and keep your configuration safe.
Open the product page and confirm the name is Shadowrocket, the developer is Shadow Launch Technology Limited, and the product URL contains app ID 932747118. The app icon should match the official icon in this site's header. Search results may include similar names, so do not rely on a keyword in the name alone. The US App Store price for iPhone / iPad is a one-time $2.99; storefronts show local currency. Mac, Windows, Android, and Linux versions are free and available from this site's download page.
For iPhone / iPad system requirements, refer to the App Store listing. The app is not currently available on the mainland China App Store. If it does not appear in search, first check your account's storefront and whether the product page is visible. If you need to change your account region, review your balance, active subscriptions, and payment requirements through Apple ID settings and Apple's official process. Do not assume that a missing search result means your device is unsupported, and avoid repeatedly resetting the client configuration.
iPhone and iPad share a purchase under the same Apple ID. When changing devices, reinstalling, or using another device, first check Purchases in the App Store, then confirm the signed-in account matches the purchase record. The one-time $2.99 purchase covers client use on iPhone / iPad. Mac, Windows, Android, and Linux versions are free; get them again by choosing the appropriate platform on this site's download page.
Reinstalling the app does not necessarily restore the server list, subscription URLs, or Config. Before deleting anything, back up content that still works and note exactly what the backup contains. For iCloud sync, also check the accounts, sync options, and files on both devices. After restoring, verify the selected Config, Global Routing, and server before testing the connection. Do not treat a working state on an old device as verification on a new one.
There are two pricing tiers: iPhone / iPad costs $2.99 once through the App Store; Mac, Windows, Android, and Linux versions are free. Mac has separate installers for Apple Silicon and Intel. For Windows, Android, and Linux, choose the architecture or format specified on the download page. Installation packages on this site are under /dl/shadowrocket/; do not identify the product based on an unchecked filename.
Desktop and Android packages are not code-signed, so the system may block them on first launch. On macOS, after verifying the source, use Privacy & Security → Open Anyway. In Windows, follow the More info option in the SmartScreen prompt. On Android, grant only the permissions required for the source you are using. Detailed requirements and Linux commands are in the installation guidance on the download page. Read the relevant instructions for each prompt rather than applying steps from another system.
App Store manages iPhone / iPad app updates. For Mac, Windows, Android, and Linux, get the current installer again from this site's download page. Before updating the client, save the active configuration and any information needed for recovery. Before updating a subscription, make sure the original list still has a usable backup. App updates, subscription updates, and Config edits are separate operations; if something goes wrong, identify which one changed most recently.
After an update, retest using the same network and destination. First confirm the connection, then check rules and DNS. If an issue occurs only on one network, note the difference between Wi-Fi and cellular. If it affects only one destination, check the matched rule and DNS records. Data can help determine whether traffic passes through the client, but its statistics are not a provider bill and cannot by themselves confirm that the whole connection path is working. Before submitting diagnostics, hide passwords, full subscription URLs, and personal browsing details.
This manual keeps interface labels such as Home, Config, Global Routing, and On Demand in English so you can match them on your device. Interface locations may change between versions; follow the options shown in the app. If a term is unclear, look it up before changing a setting. For connection issues, use the troubleshooting guide for the relevant symptom rather than changing every option at once.
These articles cover common first-use questions, choosing among existing servers, and the difference between share links and subscriptions. Before reading, identify whether your issue is importing, mode selection, or connection testing, then follow the relevant steps instead of conflating symptoms from different stages.
What do the connection switch, Config, and Rule each do, and what should you check after a subscription update? This guide answers ten questions in first-use order, distinguishes connection status from request results, and helps identify what to check next.
Read the beginner guide →When choosing from your own subscription, how should you compare test results, region, and protocol type? This article explains what latency numbers can tell you and how to compare results using the same network and destination.
Read how to choose →A single share link usually represents one server, while a subscription URL retrieves and updates a set of server details. Identify what the content is for before choosing an import method. This article explains common prefixes and update behavior without recommending configuration sources.
Read about link formats →