Official user manual · All platforms
A rule-based proxy client for all platforms. Start by importing an existing subscription, then configure Global Routing and rule-based routing. iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, Android, and Linux: free.
Current version Loading · Mac, Windows, Android, and Linux are free
First-time setup: follow the steps to import and connect →
Setup index / From connection to routing
Establish a working connection first, then adjust rules and automatic connection conditions. Servers provide the connection; profiles determine where traffic goes. Check these separately: successfully importing a server does not mean the current Config meets your needs.
For everyday use, select Config in Home under Global Routing so requests are matched against the active profile. Proxy sends proxy-eligible traffic through the proxy policy; Direct provides a direct-connection comparison. These modes can help isolate issues temporarily, but should not be confused with the PROXY and DIRECT policy names inside a profile. Rules are usually evaluated from top to bottom, so place specific domain rules first and FINAL last. After making changes, retest the same destination and check which rule matched rather than relying only on the connection toggle.
The PROXY policy in the example must refer to a valid policy in the active profile. Valid rule syntax and an available policy are separate checks.
On Demand starts a connection when the configured system conditions are met. First complete a manual connection and access test, then review the conditions in Settings under On Demand and enable them as needed. Do not use automatic connections to mask incorrect server parameters. After switching between Wi-Fi and cellular, check whether the system connection status matches actual access. If connections repeat, disable On Demand and retest manually with the same server. Automatic triggers determine when to connect; Config rules below determine how to route traffic after connecting. They serve different purposes.
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTShadowrocket supports protocols including Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard, and Hysteria2. In Add Server, first select the Type that matches your existing server, then enter Host, Port, and the corresponding authentication and transport fields. Do not infer TLS, transport settings, or server names from the port, or reuse settings across different protocols. Test one entry after importing it, then configure routing with Config rules. The protocol determines how a connection is established, not whether a domain should use PROXY or DIRECT.
DOMAIN,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXYAn existing subscription is an update URL for a group of servers, not a share link for a single server. In Add Server, select Subscribe, enter your full subscription URL, and save. Then check Home for the corresponding group. To update it, keep the original subscription entry and refresh it instead of repeatedly importing duplicates. If an update fails, check that the URL is complete, the network is reachable, and the subscription is still valid before deleting any existing servers. Subscription URLs may contain access credentials; avoid sharing screenshots that expose them. See the server management manual for management and backup guidance.
DOMAIN-SUFFIX,example.com,PROXY
FINAL,PROXYThe rule snippet illustrates routing after import and is unrelated to subscription URL formats.
Config manages profiles, with sections such as General, Rule, and Hosts serving different purposes. Back up the working profile before editing a copy. After saving, confirm that the intended file is selected and that Global Routing is set to Config. Adding a file without enabling it will not change current routing. For iCloud sync, check the same account and sync status on a supported device, then verify the file contents. Do not assume that syncing a profile automatically transfers all server credentials. Change one rule at a time to make it easier to compare results and revert changes.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXYConnectivity Test can help check connection status. The Test Method in Settings affects how tests run, so results from different methods are not directly comparable. After a successful test, try accessing the actual destination and use logs to identify whether the issue lies with DNS, the connection, or rule matching. Data shows traffic recorded by the client and does not replace usage records from your service provider. During troubleshooting, keep the server and destination fixed and change one condition at a time. If Proxy works but Config does not, focus on rule order and policy references rather than re-entering all credentials.
DOMAIN,example.com,PROXY
FINAL,DIRECTFor details on each setting, see Shadowrocket Settings. For subscription updates, QR code and clipboard imports, and backups, see Subscription and Server Management.
2 ways to get it / Choose your device
iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, Android, and Linux: free. Download desktop and Android installers from this site's download page; files are hosted under /dl/shadowrocket/ on this site. Choose the file that matches your device's processor and system format.
$2.99 one-time on the App Store; other platforms are free. Both devices share the purchase. Check the App Store listing before installing; system requirements are as shown on the App Store page. On first connection, follow the system prompt to confirm the VPN configuration, then return to Home to verify.
Free · Apple Silicon / Intel. Check About This Mac and choose the matching DMG. If you see a warning that the developer cannot be verified when opening the app for the first time, confirm the file came from this site, then follow the prompt in Privacy & Security and choose Open Anyway.
Free · 64-bit installer. Download the file, then run it. If SmartScreen blocks it, confirm it came from this site, select More info, then choose Run anyway if appropriate. On organization-managed devices, follow your administrator's policies.
Free · arm64 APK. Allow installation for your browser, then turn the permission off afterward. If downloading in WeChat fails, open this page in your system browser. See the download guide for full steps.
Free · deb / rpm / AppImage. Choose the package format for your distribution. For AppImage, allow the file to run as a program in its properties before launching it. The download guide covers installation commands and permissions; do not mix instructions for different formats.
First connection / Three checks
Have your existing subscription URL or server details ready. For the first setup, get one connection working before adding automatic updates, complex rules, or On Demand. This makes it easier to tell whether an issue is with importing, configuration, or the connection.
In Home, open Add Server. For an existing subscription, choose Subscribe, enter the full URL, and save. For a single server, select the matching Type and enter its fields. QR code and clipboard imports should also use your existing information. After importing, check the server type, address, and port.
Return to Home and confirm the entry appears and that the server you intend to use is selected. If the list is empty, check the subscription update result and whether the URL was truncated. A single share link usually creates one server; it is not an automatically updated subscription URL.
In Config, confirm which profile you want to use. Then return to Home and set Global Routing to Config. Rules in the profile are matched in order, the PROXY policy must be valid, and FINAL handles requests that do not match an earlier rule.
For an initial test, do not change DNS, rules, transport settings, and server authentication at the same time. To compare modes, temporarily switch to Proxy or Direct and record the result for the same destination. Restore your usual mode when done. Switching modes does not fix incorrect server parameters.
Turn on the connection toggle at the top of Home. The first time, follow the system prompt to allow the VPN configuration. Run Connectivity Test, then visit the destination you actually need. A connected status only means the connection configuration is enabled; it does not confirm that every request succeeded.
If access still fails, troubleshoot in this order: local network → server status → authentication and TLS parameters → Config rules. Keep any error messages and check Diagnostics if needed. Before sharing troubleshooting details, hide subscription URLs, passwords, and other authentication fields.
Verify the app / Purchase and usage
On the App Store product page, confirm the developer is Shadow Launch Technology Limited, then compare the official icon and app ID 932747118 on the listing. A similar name alone is not enough; check all three together. Shadowrocket is a closed-source commercial app. When getting it, verify the product identity and channels listed here.
The iPhone / iPad app costs $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. Desktop and Android versions do not use the App Store purchase flow; choose the appropriate platform in this site's download guide. If you opened a page forwarded from another source, return to this site and select the matching installer.
Whether the App Store displays the app depends on the store region for your account. The app may not appear in the mainland China App Store. If you cannot find it, first check Country/Region in your account settings and verify the product page rather than choosing a similarly named listing. System requirements are as shown on the App Store page.
If you need to change your account region, first review the balance, active subscription, and payment method requirements shown in your account settings, then follow the system steps. Changing the region and configuring the client are separate tasks; changing Shadowrocket's language or Global Routing will not change your App Store region.
The purchase can be shared between iPhone and iPad. When moving to a new device or reinstalling after deletion, first confirm that you are signed in to the original purchasing account, then look for Shadowrocket in your purchased items. The store's redownload status is a more reliable check than the app name. If you are prompted to pay again, check the account and purchase history first.
The Mac, Windows, Android, and Linux versions are free and can be downloaded again from this site's download page. On any device, reinstalling the client and restoring server settings are separate tasks. Before deleting the app, save your subscription URL and any necessary configuration. After installation, check the import result rather than assuming server information will be restored automatically.
The client manages existing servers, establishes connections, and applies routing rules. Availability of a connection and validity of a subscription depend on the user's existing service. This is the Shadowrocket website and official user manual; it does not provide node or subscription services. After getting the client, import your own existing subscription or server details.
If a subscription update fails, check your URL, its validity, and the update response. If the server connects but a particular destination is inaccessible, check the current mode and matching rules. Keeping client downloads, subscription management, profiles, and connection diagnostics separate can help prevent configuration loss from repeated reinstalls.
App Store manages updates for iPhone / iPad; use automatic or manual updates in system settings as needed. For other platforms, get the new installer from this site's download page and follow the instructions for your system. Keep a copy of the working profile before upgrading. After the update, check your existing servers, selected Config, and On Demand, then test actual access. Client updates, subscription updates, and profile updates are separate operations and should not be treated as interchangeable.
See full app verification and recovery guidance →Practical guidance / Read by topic
Handle installation, imports, and rule settings separately. These three articles cover desktop installation, identifying links, and choosing Global Routing modes. Read them as needed after establishing a basic connection. Before following a procedure, confirm your device and the relevant interface, keep a working profile, and check each setting in turn.
Check About This Mac to identify Apple Silicon or Intel, then choose the matching file. If the system blocks the first launch, review the macOS Privacy & Security or Windows SmartScreen prompt, and verify the file came from this site before proceeding.
Read the desktop installation guide →A share link describes one server, while a subscription URL provides an update entry point for a group of servers. Identify the type of information you have before choosing an import method. Future updates depend on keeping a valid Subscribe entry.
Read the link format guide →Config routes traffic according to profile rules; Proxy and Direct can be used for a temporary comparison. Test the same server and destination to identify differences between modes, then check rule order, policy references, and server connectivity.
Read the mode selection guide →