This guide is for anyone installing Shadowrocket on a computer for the first time. On Mac, identify whether your device has Apple silicon or an Intel processor, then drag the app from the DMG into Applications. On Windows, verify the download source and distinguish a SmartScreen reputation warning from a malware alert or an organization policy block. After installation, import a subscription you already have and check Global Routing and the connection. A successful installation does not mean your network is configured.
1. Check your platform, chip, and download source
Get Mac and Windows installers from our download guide. Mac downloads are available for Apple silicon and Intel. Choose based on your computer’s hardware, not your browser or whether you’ve installed an app for another architecture before. Don’t rely on the year you bought the computer: Macs with the same appearance may use different chips.
There are two ways to get Shadowrocket: the iPhone / iPad app costs $2.99 as a one-time purchase on the App Store; system requirements are listed on the App Store page. The Mac versions (Apple silicon and Intel), Windows, Android, and Linux versions are free. Getting the app is separate from any service you already use; installing it does not create a subscription.
Before installing: check the Mac chip or Windows system type
Mac
- Open the Apple menu in the top-left corner of the screen → About This Mac.
- If the Chip field shows an Apple M-series chip, choose the Apple silicon version.
- If the Processor field shows Intel, choose the Intel version.
- Check the system requirements for the relevant package in the download guide, then download the DMG.
Windows
- Open Start → Settings → System → About and check System type.
- Choose an installer based on the architecture and system requirements listed in the download guide.
- If the guide doesn’t list your device’s architecture, check compatibility before proceeding. Don’t guess based on the filename.
- On a work-managed computer, check software installation permissions and organization policies first.
Check your hardware before downloading. The two Mac versions are alternatives; you don’t need to install both.
2. Install on Mac: move the app from the DMG to Applications
A DMG is a disk image. Double-clicking it opens it in Finder as a temporary disk; the app inside hasn’t yet been copied to your Mac’s Applications folder. Copy the app before launching it so you can still find it after ejecting the image or cleaning up the downloaded file.
-
Check your chip
Open Apple menu → About This Mac and note the Chip or Processor field. Choose the Apple silicon version for an Apple M-series chip, or the Intel version for an Intel processor.
-
Download the disk image
Go to Download guide → Mac on this site and choose the DMG for your hardware. Wait for the browser to finish downloading, then open the file in Finder → Downloads.
-
Copy the app
Open the DMG and drag Shadowrocket to Applications. If the disk image window has no Applications shortcut, open Finder → Applications in a separate window and drag the app there.
-
Open it for the first time
In Finder → Applications, double-click Shadowrocket. If a security alert appears, read it in full and follow the guidance in the next section. Don’t keep double-clicking the installer.
-
Eject the disk image
After confirming that the app launches from Applications, eject the disk image in the Finder sidebar. Keeping or deleting the downloaded DMG won’t affect the copied app.
If you see a message that the app isn’t supported on this Mac, return to About This Mac to check the architecture, then verify the system requirements. Renaming the file won’t fix compatibility. To replace an installed copy, quit Shadowrocket first. Keep your existing configuration before replacing the app, and don’t treat deleting user data as a routine installation step.
3. Mac can’t verify the developer: proceed only with an app from a confirmed source
“Can’t verify the developer” and “will damage your computer” are different alerts. The first may relate to the system’s checks of an app’s identity or notarization status; the second is a more serious risk warning. Follow the steps below only for an app downloaded from this site, whose source you’ve confirmed, and when macOS offers an option to open it anyway. Button names and locations may vary by macOS version.
Developer verification warning
- Typical message
- “Cannot verify the developer” or “Apple cannot check it for malicious software”
- Where to find the setting
- Apple menu → System Settings → Privacy & Security
- Where to proceed
- In the Security section, find the app that was just blocked. Confirm its name, then choose Open Anyway.
- Confirm the action
- Authenticate if required by macOS, read the confirmation dialog, then choose Open.
The entry usually appears only after you’ve tried to open the app once. If it isn’t there, check the type of alert and whether the device is managed.
Risk or file integrity warning
- Typical message
- “Will damage your computer,” “contains malware,” or “app is damaged”
- First step
- Stop and note the exact system message
- Check the source again
- Return to this site’s download guide, confirm the platform and architecture, and download the complete file again.
- If it still fails
- Keep a screenshot of the alert and your system details, then contact support or your device administrator.
Don’t disable system-wide protection or use commands to remove security attributes in bulk instead of investigating the cause.
Open Anyway applies only to the app recorded by the system in this instance. It doesn’t mean you can ignore future alerts. If Settings says the device is managed by your organization, or the relevant button is disabled, ask your administrator to handle it. Installation troubleshooting does not require disabling System Integrity Protection or adding an exception for the entire Downloads folder.
4. Windows SmartScreen blocks the app: read the alert before deciding whether to continue
The SmartScreen “Windows protected your PC” warning is often related to a downloaded file’s reputation, but the warning alone doesn’t prove that a file is safe or dangerous. First confirm the download source and inspect the file details. Then identify the type of block before deciding whether to proceed. If you can’t verify the source, stop here.
-
Confirm the source
Use this site’s download guide to reach the Windows download. If the file came from a forwarded chat message, an unfamiliar file-sharing service, or a download you can’t trace, don’t run it. Return here and download it again.
-
Check the file details
Right-click the file → Properties and check its file type and any available digital signature information. If a permission prompt appears, read the program name, publisher, and file source. Pause if anything looks unusual or can’t be verified.
-
Expand the details
If the window specifically shows the SmartScreen message “Windows protected your PC,” click More info and review the app name and publisher shown.
-
Review each detail
Choose Run anyway only if you’ve confirmed the source and file details, there are no other risk alerts, and the window offers that button. If it isn’t available, don’t edit the registry or change system-wide security policies to bypass the block.
-
Complete the installation
Follow the installer to choose a folder and finish setup. If User Account Control appears, check the program details again. On a work computer, ask your administrator to review any request for administrator credentials.
After installation, open Shadowrocket from the Start menu. There’s no need to run the installer again. If the app opens but you can’t connect, troubleshoot the configuration and connection. Reinstalling repeatedly usually won’t fix an expired subscription, incorrect server settings, or an unsuitable routing mode.
5. First launch: import a subscription you already have and test the connection
Seeing the main window means only that the app has started. You still need your own server details or subscription. This site only explains client operations and does not provide or recommend connection services; the steps below are only for content you already have. Subscription URLs contain access credentials, so don’t post the full URL in a public forum.
- Import your details: From Home, open the add menu and go to Add Server. Set Type to Subscribe, paste a subscription URL you already have, and save it. The desktop layout and button locations may vary by version. An address like
https://example.com/sub?token=xxxxis only a format example and won’t connect. - Check the result: Update the Subscribe entry, then return to Home and check whether any servers appear. If the list is empty, troubleshoot a failed subscription request or a parsing issue before changing routing settings.
- Check the settings: When adding a server manually, use the protocol and port from your existing details. If the server specifies
443, enter443; if it specifies another port, use that value. Don’t change the port to443just because the protocol uses TLS. - Choose a routing mode: Global Routing → Config routes traffic according to the selected configuration. It doesn’t create suitable rules automatically. In Config, check that the intended configuration is selected and that its policy references are available.
- Grant required permissions: When enabling the connection, if the system asks to add a VPN configuration or authorize a network extension, verify the app name before confirming. System proxy settings and VPN or tunnel routing cover different traffic; use the mode actually enabled on your platform.
Change one variable at a time when testing the connection. Select a server you already have and connect, then visit one destination expected to use the proxy and another expected to connect directly. If needed, briefly compare Global Routing → Proxy and Direct, then restore Config. Proxy and Direct describe how traffic within the client’s coverage is handled; they don’t guarantee that every type of traffic on your computer is routed through the app.
Scene in Global Routing lets you configure routing behavior for different situations; you don’t need to change it during initial setup. On Demand controls what triggers a connection; it isn’t a way to import a subscription or repair network access. Connect manually and verify that it works first. Then set On Demand conditions using the controls available on your platform, so automatic reconnections don’t interfere with troubleshooting.
6. Common issues: wrong architecture, missing override button, and repeat installs
I installed the Intel version on an Apple silicon Mac. Do I need to reinstall?
Quit the app and back up your existing configuration first. Then choose the Apple silicon version from the download guide and replace the copy in Applications. Even if an Intel app can run using system compatibility features, choose the version that matches your hardware when available. You don’t need to keep both versions for everyday use.
There’s no Open Anyway button in Privacy & Security. What should I do?
Try launching the app from Applications once, then return to System Settings and check for the corresponding entry. If it still isn’t there, check whether the alert is actually about system incompatibility, a damaged file, or an organization policy. Note the exact message before proceeding; not every app that won’t open has a developer verification issue.
SmartScreen shows no Run anyway button after I expand the details. What now?
Don’t follow instructions to find a hidden switch. Check whether an organization policy is blocking the app, or whether the alert comes from Smart App Control, malware detection, or another mechanism. On a work computer, contact your administrator. On a personal computer, keep the alert details and confirm the download source; don’t disable system-wide protection.
The app is installed and I’ve imported a subscription, but websites still won’t load. What should I check?
Check the server list on Home, the connection toggle, Global Routing, and the configuration selected in Config—in that order. If only some apps can’t connect, check whether they use the system proxy or fall within the current tunnel’s coverage. If nothing connects, verify the server details and that your existing service is still active.
There are several icons on my desktop and in Downloads. Which one should I open?
On Mac, launch the app from Finder → Applications and eject any old installation disk image. On Windows, open the installed app from the Start menu. Make sure the Dock or taskbar shortcut points to the installed copy before deleting old installer files, so you don’t end up in the installation process again.