Shadowrocket FAQ
Find guidance by device, import method, or connection issue. Check your current settings first, change one thing at a time, and keep the original configuration for comparison.
Purchase and app authenticity
Check how to get the app for your platform, and distinguish purchase records from configuration backups and existing connection details.
Can I use Shadowrocket on a computer or Android device? How do I get it?
Yes. Shadowrocket is available for iPhone, iPad, Mac, Windows, Android, and Linux. The iPhone and iPad versions cost $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. Mac downloads are available for Apple silicon and Intel. Choose the Windows, Android, or Linux package that matches your device. Get desktop and Android versions from this site’s all-platform downloads page; installers are served from /dl/shadowrocket/. See the installation section below for steps to allow the app to open for the first time.
Can I install Shadowrocket on iPad? How do I verify the App Store listing?
Yes. iPhone and iPad share the same app purchase record. Check the App Store listing for the system requirements. The iPhone and iPad versions cost $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. On the product page, verify the name Shadowrocket, the official icon, developer Shadow Launch Technology Limited, and app ID 932747118. Don’t rely only on a translated nickname or a similar-looking icon in search results. Install using the Apple Account that holds the app purchase.
Can’t find Shadowrocket in the App Store? What should I check?
Open the App Store product page linked on this site to tell whether search is failing or the app is unavailable in your current storefront. The app is not listed in the mainland China storefront. On your device, go to your Apple Account’s Media & Purchases settings and check the account and Country/Region. Also review content rating restrictions under Screen Time. If you need to change regions, follow Apple’s official account settings process and meet its requirements for account balance, active subscriptions, and payment information. Changing your device language alone won’t change the storefront. Availability depends on the product page shown for your account.
Do I have to buy Shadowrocket again after switching devices or reinstalling?
On iPhone or iPad, sign in with the original purchasing account, open the App Store’s purchased apps list, find Shadowrocket, and download it again. The original purchase may not appear if you use a different account. The iPhone and iPad versions cost $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free and can be downloaded again from this site. A purchase record doesn’t back up your configuration. Before removing the app from an old device, save your existing server details and Config separately, and keep any credentials secure.
Do I need my own connection details after purchasing the app?
Yes. A one-time app purchase is not a connection service. The iPhone and iPad versions cost $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. These prices cover the app only. Before use, have your own subscription or server details ready, including the protocol, server address, port, and authentication fields. This is the Shadowrocket website and Official Manual; it does not provide, sell, or recommend servers or subscriptions. Import and troubleshooting instructions assume you already have connection details you’re entitled to use.
Installation and first launch
Check your device architecture and the file source before handling system permissions. Follow your administrator’s instructions on managed devices.
Which Mac version should I choose: Apple silicon or Intel?
On your Mac, open the Apple menu and choose About This Mac. Check whether it lists a Chip or a Processor. If it shows Apple silicon, choose the Mac Apple silicon dmg on the downloads page. If it shows an Intel processor, choose the Mac Intel dmg. Don’t guess based on the computer’s appearance or purchase date. Open the dmg, move Shadowrocket to Applications, then launch it. If macOS says it can’t verify the developer, first confirm the installer came from this site, then follow the macOS steps in this section to allow it to open. Don’t keep trying builds for the wrong chip.
Windows SmartScreen warns that the app may be unsafe. What should I do?
First confirm the file came from this site’s downloads page and that its filename matches the Windows installer you selected. If Windows SmartScreen says “Windows protected your PC,” select “More info,” verify the source, then choose “Run anyway.” If installation requires administrator permission, check the program and path shown in the User Account Control prompt before proceeding. If security software reports a specific threat or you can’t verify the file’s source, stop and investigate. Don’t leave system-wide protection disabled just to install the app. Contact your administrator if the device is managed by an organization.
Mac says the developer can’t be verified or the app is damaged. How do I open it?
Confirm the dmg came from this site and that you moved the app to Applications. If macOS says it can’t verify the developer, try opening the app once, then go to System Settings > Privacy & Security. Find the blocked app notice, select “Open Anyway,” and follow the prompts. If macOS says the app is damaged, check that the download completed. Once you’ve confirmed the source, you can run xattr -cr /Applications/Shadowrocket.app in Terminal, then try opening the app again. This command removes extended attributes from the specified app. Run it only on this path after confirming the source; don’t apply it to an entire folder or disk.
What should I know when installing Shadowrocket on Android or Linux for the first time?
On Android, use the arm64 apk from this site’s downloads page. If the system blocks installation, allow your browser or file manager to install unknown apps for this installation, then revoke that permission afterward. On Linux, choose deb, rpm, or AppImage for your distribution. On Debian or Ubuntu, use apt to install the local deb; on Fedora-based systems, use dnf to install the local rpm. For an AppImage, first enable execution in the file properties or with chmod +x, then run the downloaded file. Replace any command path with the actual file path. Follow your distribution’s guidance if you encounter missing dependencies or runtime libraries.
The connection switch won’t turn on, or turns off right away. What should I check?
First check that Home contains a valid server entry and that the one you want to use is selected. On iPhone or iPad, the first connection requires you to allow the VPN configuration in the system prompt and complete device authentication if requested. If you denied permission, tapping the switch alone usually won’t connect. Try connecting again and check the system VPN settings. Also check whether another VPN connection is still running and whether On Demand is taking over based on its conditions. Ask your administrator to check restrictions on managed devices. If an error persists, note its exact wording before troubleshooting further.
Subscription and server import
Check what Subscribe, Add Server, and Config are for. Keep existing working entries for comparison.
A subscription won’t import. Should I check the link or the Config first?
Check the input first, then the response. In Add Server, choose Subscribe and paste your complete existing subscription link. Make sure the beginning, path, and query parameters are all present, and remove any spaces or line breaks added when copying. Links may contain credentials, so don’t share them in public chats or screenshots. If the request succeeds but the import fails, check that the response is supported subscription content—not a login page, expiration notice, or regular webpage. Also confirm the subscription is still valid and the device date is correct. If existing entries work, keep them; don’t delete all your configuration just to test.
When should I use Scan QR Code or enter details manually in Add Server?
If the QR code comes from your own connection details and uses a supported format, choose Scan QR Code on Home and allow camera access. After scanning, check the protocol, address, and port. If the code is blurry or unsupported, don’t keep scanning; go to Add Server and enter the details manually. Select the correct Type, then enter the password, UUID, TLS, SNI, or other fields exactly as provided. Fields vary by protocol and aren’t interchangeable. Don’t use a configuration file download link as a server address or enter a subscription URL in the password field.
A Subscribe update changed entries or failed. What should I do?
Before updating, confirm which Subscribe group you’re refreshing. If needed, note the names of the entries in use and the policies they reference. An update changes entries based on the subscription response; changed names, removed entries, or updated addresses don’t mean the app is damaged. If the update fails, check your network, subscription validity, and response format in that order, and make sure the link wasn’t truncated during editing. Afterward, return to Home to check the selected server, then confirm that the policy names referenced in Config still exist. Don’t assume the previous selection or rule references will always be preserved automatically.
What’s the difference between Subscribe and Config? Do I need to import both?
Subscribe retrieves or updates existing server entries. Config manages rules, policy references, and related settings; they serve different purposes. If you have only a server list, check Global Routing and the currently enabled Config. If you have only a configuration file, confirm that its referenced servers and policies exist. Before importing a new Config, keep a copy of the one that works and check the source, rule order, and referenced names. Policy labels such as PROXY must match their actual definitions; similar wording alone doesn’t mean they’re linked correctly.
The interface is in English. Which options should I use to import details and connect?
Identify interface labels by their function: Home shows servers and connection status; Add Server adds an existing server; Subscribe imports a subscription; Scan QR Code scans existing connection details; Config manages configurations; Global Routing selects how connections are handled; Settings opens settings; and Data shows traffic information. The Official Manual keeps these labels in English so you can match them directly to the interface. Locations may vary by platform, so look for the label rather than a fixed screen position. Don’t confuse Proxy, a mode name, with PROXY, a policy label in a configuration.
Rules and troubleshooting
Separate local network issues from server connections, DNS, and rule matches. Test results apply only to the conditions tested and don’t replace checking real-world access.
Which Global Routing mode should I use: Config, Proxy, or Direct?
For everyday rule-based routing, choose Config. Connections are handled according to the rules in the active Config. Proxy sends connections through the current proxy route and is useful for a temporary comparison test. Direct bypasses the proxy route for comparison. Switching modes won’t fix incorrect server details or confirm that a subscription is valid. For troubleshooting, test the same destination in Direct and Proxy, then return to Config to check the rules. Avoid changing the server, DNS, and mode at the same time, or you’ll lose a clear basis for comparison.
It says connected, but I can’t access the internet. What should I check first?
Connected usually means the device established a local VPN or proxy handling channel; it doesn’t confirm that the remote server, DNS, or destination site is reachable. Disconnect Shadowrocket and check that your Wi-Fi or mobile network works on its own. Then verify the selected server and authentication details on Home. Compare Direct, Proxy, and Config using the same destination, and run Connectivity Test if needed. Finally, identify whether the error is a connection timeout, authentication failure, or name resolution failure, and troubleshoot accordingly. Don’t keep changing every setting just because the switch stays on.
Only some sites fail in Config. How do I check rules and DNS?
Note the affected domain, then check the connection log for the matched rule and policy. See whether an earlier DOMAIN, DOMAIN-SUFFIX, or IP-CIDR rule is taking precedence. Rules are generally matched in order, and FINAL should remain as the fallback. Check whether the matched rule’s PROXY, DIRECT, or REJECT policy is what you expect. For name resolution errors, check the DNS settings in Config and whether the network can reach the configured DNS service. Change one thing at a time and retest. Don’t delete rules in bulk because one page won’t load; a single site may request several different domains.
Battery use increases after connecting. How should I configure On Demand?
Battery use depends on actual traffic, signal strength, reconnection frequency, protocol implementation, and background activity—not just the protocol name. Check the system battery usage for the relevant period, then look for ongoing downloads, repeated reconnects on a weak signal, or frequent tests. On Demand starts connections based on the network conditions you set. Before configuring it, decide which Wi-Fi or mobile network situations should trigger a connection; conflicting conditions can cause repeated switching. For comparison, temporarily turn off On Demand and connect manually. Once things are stable, restore conditions one at a time. Avoid repeatedly running a full set of tests.
Does Connectivity Test prove that sites are reachable? What should I include when reporting a problem?
No. Results depend on the test method and destination. A successful test doesn’t guarantee that every site or app will work, and it isn’t a measure of actual transfer speed. Before reporting a problem, note your device’s operating system, platform, current Global Routing mode, the steps that trigger the issue, and the exact error message. Include a comparison of the results in Direct and Proxy. Before sharing logs or screenshots, remove subscription URLs, passwords, keys, UUIDs, server addresses, and other account details. Provide the smallest steps needed to reproduce the issue; don’t publish a complete Config or full connection log.