Get the client for your platform, import an existing subscription and configure routing rules. iPhone / iPad: a one-time $2.99 App Store purchase; Mac, Windows, Android and Linux editions are free.
First distinguish server details, configuration files and routing modes, then check the connection. The sections below explain where to find each feature and how to use it; exact locations vary by device interface.
Rule: match conditions and policies
Rules are checked in the order specified in the configuration. When a rule matches, its specified policy is applied. Open Rule in Config, first confirm that the domain or network range is correct, then make sure policies such as PROXY exist. Put specific conditions before broader ones; FINAL handles requests that did not match earlier rules. For rules to take effect, set Global Routing to Config mode. After temporarily switching to Proxy or Direct, do not use the same rule results to infer where a connection is routed. Keep a copy of the original configuration before making changes so you can compare each item.
DOMAIN-SUFFIX,example.com,PROXY
On Demand: test manual connections first
On Demand triggers connections according to network conditions; it does not fix incorrect server parameters. Find the relevant setting in Settings, review its existing conditions, then adjust them for your network. We recommend disabling automatic triggers first, selecting a server manually and running a connection test. Enable the feature only after confirming the configuration works. When switching between Wi-Fi and mobile networks, check whether the conditions behave as expected. If a connection starts again after you turn it off, review these settings instead of repeatedly changing the password. Trigger conditions and Rule have different roles: the former determines when to connect, while the latter determines how requests are handled.
IP-CIDR,192.168.0.0/16,DIRECT
Subscribe: import your existing details
A subscription keeps a set of server details together and requires a valid subscription link that you already have. In Home, use the add option, choose Subscribe, paste the complete URL and save. After updating, check that the expected items appear in the list. Query parameters are part of the URL, so do not omit trailing characters when copying it. If an update fails, distinguish an unreachable URL, an unexpected response format and a change in subscription status before considering deletion and recreation. Updating a subscription mainly changes server details; it does not necessarily replace every Rule. Record the current server and configuration separately when troubleshooting to avoid confusing the two sources.
FINAL,PROXY
Config: manage configurations and routing modes
Config stores rules and related settings. After selecting a configuration file, also check Global Routing. Config mode processes traffic according to rules; Proxy mode handles requests using the current proxy selection; Direct mode connects directly. Switching modes does not update a subscription. Back up files before editing, then check rule references and fallback policies. For iCloud sync, check the sync toggle on the current device, the signed-in account and the items actually being synced. Do not assume that a completed sync means every device has selected the same configuration. Server permissions and system connection authorization must still be checked on each device.
DOMAIN,example.com,DIRECT
Type: match the protocol before entering parameters
Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard and Hysteria2 use different parameter structures. In Add Server, first make sure Type matches the server details, then enter Host, Port and the authentication fields required by that type. TLS, transport method, path and certificate settings must also match; the port alone does not identify the type. A protocol name does not guarantee speed or battery performance; results also depend on the server, network and device status. If you have a complete link, import it from your details first, then compare the original parameters. See the technical reference for guidance on choosing field values.
DOMAIN-SUFFIX,example.com,PROXY
Diagnostics and Data: check results in stages
An enabled connection switch indicates the system connection state, but does not replace an actual access test. First use Connectivity Test to check reachability, then look in Diagnostics for records corresponding to the failure time, and finally check traffic changes in Data. A successful test does not mean every destination is reachable, and increased traffic alone does not prove that a Rule matched correctly. If only one domain fails, check DNS and the matching policy; if all requests fail, first check the current server, network and authorization. Before sharing troubleshooting information, hide subscription URLs, passwords and keys. Include only the error type and necessary setting names.
iPhone / iPad: a one-time $2.99 App Store purchase; Mac, Windows, Android and Linux editions are free. The links below lead to the download page, with installers provided on this site under /dl/shadowrocket/.
Get from the App Store
iPhone / iPad
The App Store edition costs $2.99 as a one-time purchase; editions for other platforms are free. The purchase can be used on both devices. Check the App Store page for system requirements. Confirm the Apple Account used for the purchase, then verify the app name, developer and icon on the product page. If an app with the same name is already installed, check its app ID rather than relying on a translated nickname.
When you first enable a connection, follow the system prompt to allow adding a VPN configuration. This authorization establishes a connection; it does not fill in server details automatically. You still need to import your own subscription or enter existing parameters in Add Server.
Open About This Mac and check whether it lists Apple Silicon or an Intel processor, then choose the matching DMG. The two installers are provided separately. Do not guess the chip type from your browser, or treat an App Store mobile purchase as a Mac installation step.
If you see “Cannot verify developer” the first time you open the app, confirm the file came from this site, then look for “Open Anyway” in Privacy & Security in System Settings. If you see “is damaged,” read the download page's targeted instructions instead of lowering the security settings for the entire system.
The download page provides a 64-bit Windows installer. Save the file, confirm its source and file type, then run the installer. Installation does not complete connection setup; you still need to import existing details and check the current routing selection.
If SmartScreen blocks the installer, verify its source, then use “More info → Run anyway” to continue. If the device is managed by an organization, the option is unavailable or your account lacks permission, follow the device management rules instead of repeatedly trying to bypass system restrictions.
Use the arm64 installer provided on the download page and check your device architecture. If the system requests authorization during installation, open the “Allow from this source” setting for the browser or file manager you are using. You can revoke the permission after installation if that suits your device management preferences.
If an in-app browser prevents downloads, open this site's download page in the system browser. The first connection also requires system VPN authorization. If another VPN app is using the connection, check which connection configuration is currently active in the system.
For Debian / Ubuntu, choose deb; for Fedora-based distributions, choose rpm. For other distributions, check the AppImage runtime requirements. The package format and processor architecture must both match; do not download based on the distribution name alone and run it without checking.
Use the corresponding package manager to handle dependencies for deb and rpm. AppImage files need execute permission before running. If the desktop environment blocks execution, the mount directory does not allow execution, or runtime dependencies are missing, identify the specific error first and follow the installation instructions on the download page.
When using multiple devices, handle “installing the client” and “migrating configuration” separately. Permission prompts, file access and background behavior vary by system. After importing existing details, check the server, Config and connection results on each device.
Verify the app and understand configuration limits
Shadowrocket is a closed-source commercial application. This is the official website and manual, covering how to get and use the app. The client, server details and network connection are three separate things to check.
Check the product page, not just search results
After searching for Shadowrocket on iPhone / iPad, open the product page and verify the developer, Shadow Launch Technology Limited, the official icon and app ID 932747118. Search result position, name similarity and nicknames are not proof of identity. If an entry has the same name but a different developer, do not treat it as the same product. You can also return to the product page from the App Store record for an installed app. Get desktop and Android editions from this site's download page; their installers are under /dl/shadowrocket/.
Store availability and account region
App Store content depends on the region of the account used for store purchases, not just the phone's location or system language. This app is not available in the mainland China App Store. If it does not appear in search, first check the account's store region, age-rating restrictions in Screen Time, and whether the account is in good standing for purchases. If you need to change the region, use the official Apple Account settings and review requirements such as balance, subscriptions and payment methods first. Repeatedly changing the system language or resetting the device will not replace checking the store region.
Two price tiers and restoring purchases
The iPhone / iPad edition costs $2.99 as a one-time App Store purchase. The US storefront displays this price; the currency and actual amount on other storefronts depend on the store page. Mac, Windows, Android and Linux editions are free. The iPhone and iPad editions share a purchase under the same Apple Account used to buy the app. When changing devices or reinstalling, first check App Store purchase history and confirm you are signed in to the account that made the purchase. If a price appears again, do not rush to pay twice; check the purchase record, account and product page first. System requirements are as listed on the App Store page.
Prepare your details before importing
If you already have a subscription URL, keep the complete address, including the parameters after the question mark. For an individual server, prepare its protocol type, address, port and required authentication fields. Use Scan QR Code to add it by scanning, or Add Server to enter it manually; either way, the details must match the original. example.com in this guide is only an example and is not a connectable server. Subscription URLs may contain access credentials. Take care when copying them to a device, including what is captured in the clipboard or screenshots. Do not disclose the full URL when describing an issue to someone else.
Check Global Routing separately from the connection switch
Config, Proxy and Direct are the three Global Routing modes. The connection switch controls whether a system connection is established. To route traffic by Rule, first select the correct Config file, then set Global Routing to Config. Temporarily switching to Proxy can help distinguish a rule issue from a server issue, but it is not a universal fix for all requests. Switching to Direct does not mean server parameters have been restored. Change one factor at a time and record the mode and result before and after each change to identify what caused the difference.
Handle updates and backups separately
Manage iPhone / iPad client updates in the App Store. Get updated Mac, Windows, Android and Linux installers from this site's download page. Client updates, Subscribe updates and Config file edits are three different things: the first changes the program, subscription updates change the existing server list, and configuration edits affect rules and related behavior. Keep a copy of necessary configuration before updating, then check which items are selected afterward. With iCloud sync, check what actually appears on each device; do not assume everything has synced just because the accounts match.
Record reproducible failure conditions
When troubleshooting, note which network and destination were involved, which mode was active, and whether only one server was affected. If a connection works but some content does not load, the cause may involve DNS, Rule or the destination itself. If no connection can be established, first check system authorization, server details and the basic network connection. Connectivity Test indicates reachability under a particular test condition; it does not replace an actual access test. If the log shows a specific error, record its name and timing, then check the relevant sections one by one instead of changing the protocol, rules and network all at once.
Frequently asked questions
How do I choose between deb, rpm and AppImage on Linux?
First identify your distribution and processor architecture. Choose deb for Debian / Ubuntu and rpm for Fedora-based distributions. AppImage is an option when you can check its runtime requirements and execute permissions yourself. These are different package formats, not different subscription types. Installation and permission details →
Why can't I connect after a successful import?
A successful import only means the client received the details. Also check whether the server is available, the correct item is selected, Global Routing is set as expected and the system allows a connection. Keep the original configuration and check the network, server and rules in that order. Follow the first-connection steps →
Are PROXY in a rule and Proxy in the interface the same thing?
Do not treat them as interchangeable just because their capitalization looks similar. PROXY in a rule is a policy reference that must be valid in the current configuration. Proxy in Global Routing is a routing mode. The former appears in a rule; the latter changes the overall routing mode. Rule and troubleshooting FAQ →
Guides
Installation, App Store and rules
Find an article by issue. The installation guide covers system and chip differences, the App Store guide checks account requirements, and the rules guide explains matching behavior. First identify which layer your issue belongs to.
Learn which Mac installer matches Apple Silicon or Intel, and where to check when the first launch says the developer cannot be verified. For a Windows SmartScreen warning, verify the source before proceeding with the available system option. Distinguish installation blocks from in-app connection failures to avoid changing settings at the wrong stage.
Check the store region, Screen Time restrictions and account purchase status one by one, then verify the product page with app ID 932747118. Search visibility and purchase restoration can be separate issues. First determine whether you are looking for the app, restoring a purchase or resolving a payment prompt, then follow the relevant steps.
Understand how REJECT combines with DOMAIN-SUFFIX and how rule order affects matching. Domain rules target request destinations and cannot inherently distinguish different content on the same domain. Consider the wider effects before making changes. If something is blocked by mistake, find the matching rule instead of adding broader conditions.
