Cross-platform rule-based proxy client with guidance on importing existing subscriptions and configuring rule routing. iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, Android, and Linux versions are free.
Current version Loading · iPhone / iPad: $2.99 one-time; Mac, Windows, Android, and Linux: free
Already have a subscription? Follow the guide to connect →Understand the purpose before configuring
Servers provide connections to destinations; Config determines how requests are handled. First identify whether your existing information is a server, subscription, or configuration file, then choose the corresponding entry point. The dark area below is a text configuration example, not an app screenshot.
DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXYRule routing evaluates conditions such as request domains and addresses against rules, then applies a policy such as PROXY, DIRECT, or REJECT. In Home, select Config under Global Routing to process requests using the active configuration. Proxy and Direct are two other modes for switching all traffic. When editing Rule in Config, put more specific match conditions first and check the fallback direction set by FINAL at the end. To verify the result, visit a known destination and check the matching entry in the request log; the connection toggle alone cannot confirm that a rule is working.
Learn about rule order and mode selection →On Demand triggers connections when specified network conditions are met; it does not select a server or replace rule routing. First complete a manual connection and confirm that an existing server works. Then check the trigger conditions under On Demand in Settings. After enabling it, test on your usual Wi-Fi and cellular networks and observe whether the connection starts as expected. If a connection reappears after you turn it off manually, check these conditions before repeatedly deleting configurations. Global Routing still determines how requests are handled once connected, so check the two settings separately.
Learn when to use On Demand →Multiple protocols mean the client can read server parameters in different connection formats; fields from different protocols are not interchangeable. To add a server manually, select Type under Add Server, then enter Host, Port, and the relevant authentication details provided by your service provider. Check TLS, transport methods, and additional parameters individually rather than guessing based on similar names. Test one server after importing it, before adding it to your everyday configuration. A protocol alone does not guarantee speed: your local network, server load, and connection route all affect performance. Keep other conditions unchanged when troubleshooting.
See how to enter server details →A subscription imports and updates a server list in bulk. Get its link from your service provider. In Add Server, select Subscribe, enter the complete address, save and update, then check that the expected entries appear in the SERVER group. A subscription address is different from a link for a single server; link length alone does not identify its type. If a refresh fails, first check for spaces and confirm that the address is still valid, then distinguish network access issues from an incompatible content format. Subscriptions may contain personal credentials. Hide the full address in screenshots and reports, and do not include it in public posts or shared configurations.
Learn about subscription refreshes and failures →[General]
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT
[Host]Config organizes rules and related network settings in a configuration file; it is separate from a subscription that stores a server list. Keep a recoverable copy before making changes, confirm which file is active, and adjust only one category of settings at a time. Saving a file does not automatically make it the active configuration; return to Global Routing and confirm Config is selected. When using iCloud sync, check sync status and the selected file on each device. Seeing a file does not mean the connection is ready. Check synced server details and configuration references to avoid missing policies despite having a server name.
Learn how Config works with policies →When diagnosing an issue, first distinguish whether the client connects, whether the server is reachable, and whether the target request matches the expected rule. Connectivity Test in Home provides a way to check reachability. Diagnostics in Settings helps investigate further; Data helps you observe traffic changes but cannot by itself confirm that requests take the correct route. When an issue occurs, note the network type, current mode, and failed destination, then repeat the test under the same conditions. Different tests have different meanings: one successful test does not mean every website and app will work. Check the actual request log as well.
Troubleshoot by symptom →Choose an access option by device
Two ways to get Shadowrocket: iPhone and iPad are $2.99 one-time on the App Store; Mac, Windows, Android, and Linux versions are free. The links below open instructions for each platform. Desktop and Android installers are available from this site's download page.
$2.99 one-time on the App Store.Import existing subscriptions, switch Global Routing modes, and manage Config on mobile devices. Purchases are shared between the two devices. When reinstalling, check the account used for the purchase. System requirements are as listed on the App Store page; Mac, Windows, Android, and Linux versions are free.
Free · Apple Silicon / Intel.Check your chip or processor in About This Mac, then choose the matching installer. If you see “Unable to verify developer” the first time you open the app, follow the download page's Privacy & Security steps to allow it. Do not guess which version to choose based on appearance.
Free.Use the 64-bit installer provided on this site. If SmartScreen appears on first launch, confirm the file came from this site and follow the “More info → Run anyway” instructions. Devices managed by an organization must follow administrator policies. After installation, import your existing server details.
Free.The download page provides an arm64 installer. If Android reports a permission restriction after the browser download, follow the instructions to allow unknown app installs only for the browser or file manager you used for this installation. You can turn off that permission afterward, then import an existing subscription and test access.
Free · deb / rpm / AppImage.Choose a package format based on your distribution's package manager and check your system architecture before installing. AppImage requires execute permission; install deb and rpm packages using their respective package managers. Commands and first-run instructions are on the download page. You do not need to install every format.
Steps for your first connection
This basic workflow uses Home, Add Server, and Global Routing. Before you begin, prepare a subscription or server details from your service provider. Installing the client does not create a usable server list.
First identify the type of information you have. For a subscription address, choose Subscribe; enter individual server details in the fields for the selected Type; use Scan QR Code to read a QR code. After saving, check the SERVER group and confirm the server names and count. Seeing a name means the details were saved; also check Host, Port, authentication, and transport parameters.
Do not import the same details repeatedly using multiple methods. Keep one clearly named test entry, verify the connection, then organize your groups. If a subscription cannot be read, check the complete address and its validity before replacing an existing working list.
The configuration, proxy, and direct modes correspond to Config, Proxy, and Direct. For everyday rule-based handling, select Config and confirm that the active file contains the required rules and policy references. Proxy can help check how requests behave when routed through the proxy; Direct provides a comparison using your local network. These are three modes, not three servers.
Do not overwrite your current file directly with a configuration from elsewhere. Save a copy first, review its DNS, Rule, and FINAL settings, and confirm they are expected. During troubleshooting, keep one server and one destination fixed, changing only one setting at a time so you can identify which change affected the result.
Select the server you want to use and turn on the connection. On the first attempt, allow the VPN configuration when prompted by the system. Then run Connectivity Test and visit a known destination. A connected status only indicates a change in connection state; it does not mean every request is being routed as expected.
If the test or actual access fails, turn off the connection first and confirm your local network works. Then check server reachability, Global Routing, rule logs, and DNS. Before reporting an issue, hide subscription addresses and authentication fields. Include the error message, network type, and steps taken to help diagnose the problem without exposing personal details.
Purchases, recovery, and configuration are separate
Shadowrocket is a closed-source commercial app. This is the official site and guide. Download instructions and configuration instructions are organized separately: verify the app source, import your existing server details, then test rules and the connection.
Open the App Store product link on the download page and verify the name Shadowrocket, the developer Shadow Launch Technology Limited, and app ID 932747118 in the product URL. Compare the official icon shown on the page as well. Do not identify the app by name in search results alone; similar names are not a substitute for checking all three details.
iPhone and iPad: $2.99 one-time on the App Store; Mac, Windows, Android, and Linux versions are free. The store may display local currency based on your region; check the confirmation screen before purchasing. System requirements are as listed on the App Store page. Do not rely on outdated requirements in search snippets.
This app is not available in the mainland China App Store. If you cannot find it, first check your account's store region, then open the correct product page from the download page. Change your region through your Apple ID's country or region settings. Before doing so, review the notices about your balance, existing subscriptions, and payment method. Do not repeatedly switch regions to troubleshoot configuration issues.
Whether the product page opens or your account can make a purchase is separate from whether an imported server can connect. Check store and account requirements for the former; troubleshoot the network, server parameters, and rules for the latter. Keeping the two issues separate can prevent a connection problem from being mistaken for a need to purchase the app again.
View app verification steps →Purchases are shared between iPhone and iPad under the same purchasing account. When you switch devices or reinstall, look for Shadowrocket in the App Store's purchased items. If you see a purchase prompt again, check that you are signed in to the original purchasing account. iPhone / iPad: $2.99 one-time; Mac, Windows, Android, and Linux versions are free and can be downloaded again from this site.
Restoring the app and restoring configuration are separate steps. After reinstalling, check that your servers, subscriptions, and Config are all present. If you used iCloud sync, wait for it to finish, then check the selected file and policy references. If you do not have a usable backup, get your own details from your service provider and import them again.
Mac has separate Apple Silicon and Intel versions. Windows, Android, and Linux also have their respective installers, all available through this site's download page and /dl/ paths. If the system blocks the app on first launch, follow the platform-specific instructions to allow it. Do not leave system-wide protections disabled just to start the app.
Manage iPhone / iPad app updates through the App Store. For computers and Android, return to the download page to get a newer version. Save important configurations before updating, then check the active server, Global Routing, and Config. App updates, subscription refreshes, and rule file updates are three separate actions; success in one does not mean the others are complete.
Learn about switching devices and restoring data →If the app opens but cannot reach a destination, you do not need to reinstall it straight away. Check whether your local network works and whether the current server is reachable, then compare the same destination in Proxy and Config modes. If only Config has an issue, first check rule order, policy references, and DNS. If both modes fail, check server parameters and the network layer. The error message is more useful for diagnosis than changing several options in succession.
An expired subscription does not change the client's purchase history, and restoring purchase history does not restore an expired subscription. For connection issues, read the troubleshooting guide. For help adding details for the first time, follow the setup guide step by step. Include only the necessary error information in reports, and hide passwords, keys, and complete subscription addresses.
Continue with a specific question
After your first connection, explore settings based on the issue you encounter. Protocol selection, speed troubleshooting, and everyday modes each have their own checks. Avoid changing every advanced option before you have a working connection.
Learn about Hysteria2 through QUIC transport and congestion control. Understand potential benefits and limitations on high-loss, high-latency networks, and review the parameters to enter in Shadowrocket.
Read the article →Answers to common questions about the connection toggle, Global Routing, subscription imports, and rule checks. Covers how to get the computer and Android versions and distinguish client status from connection service status.
Read the article →Break speed issues down into four layers: server, route, protocol, and local network. Compare results using the same destination and network conditions instead of changing the entire configuration based on one test.
Read the article →