Rule-based proxy client for all platforms, with rule-based routing and multiple protocols; the iPhone / iPad version is a $2.99 one-time purchase on the App Store, while Mac, Windows, Android, and Linux versions are free.
Current version Loading · Mac, Windows, Android, and Linux versions are free
Identify your device, then follow the relevant download instructions. iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, Android, and Linux versions are free. Desktop and Android installers are provided on this site at /dl/shadowrocket/.
$2.99 one-time on the App Store. Mac, Windows, Android, and Linux versions are free. System requirements for iPhone / iPad are as listed on the App Store page.
Open the product page and verify the developer, app icon, and app ID before getting the app. The same purchasing account can restore the download on compatible iPhone and iPad devices.
Before opening it for the first time, have your own subscription URL or server details ready; when connecting for the first time, allow the VPN configuration when prompted by the system.
If the listing does not appear in search results, first check the store region for your purchasing account. Do not identify the product by name or a similar icon alone, and do not treat an app purchase record as proof of a network service.
Free · Apple Silicon / Intel. iPhone / iPad: $2.99 one-time on the App Store; Windows, Android, and Linux versions are also free.
Check About This Mac for the chip or processor name, then choose the matching installer. The Apple Silicon and Intel versions appear side by side on the download page. Do not identify the version by the computer's appearance or purchase year. If you change computers, select the right architecture again instead of reusing an installer from another device.
If you see “Apple could not verify the developer” on first launch, confirm the file came from this site, then go to Privacy & Security in System Settings and select “Open Anyway.” For other prompts and steps, see the installation approval table on the download page.
Free · 64-bit installer. iPhone / iPad: $2.99 one-time on the App Store; Mac, Android, and Linux versions are also free.
Select the Windows installer on the download page, then open the client after following the system prompts. If SmartScreen appears, first verify the download source. Once you confirm it came from this site, expand “More info” to see “Run anyway.” You do not need to disable system protection entirely.
Installing the client and connecting to a service are separate steps. After installation, import your own existing subscription or server details and confirm the selected server is reachable. When troubleshooting, keep the original system prompt; this helps identify the issue more effectively than repeatedly reinstalling.
Free · arm64 installer. iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, and Linux versions are also free.
Open this site's download page in a browser, save the installer, then follow the system prompts to install it. If you need to “Allow installation of unknown apps,” grant permission only to the browser or file manager you use to open the installer. You can revoke that permission in System Settings afterward.
When connecting for the first time, confirm the VPN connection authorization prompt from the system. If the installer did not download correctly, distinguish between a browser block, an incomplete download, and an incompatible device architecture, then follow the relevant instructions. Avoid starting multiple downloads at once.
Free · deb / rpm / AppImage. iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, and Android versions are also free.
Choose a package format based on your distribution: Debian and Ubuntu systems usually use deb; distributions with RPM package management use rpm; for direct execution, see AppImage. The format depends on the system environment, not on different feature levels.
The download page lists package installation commands and AppImage execution permission settings. Check the system architecture before installing, and keep terminal error messages if execution fails. Missing dependencies, insufficient execution permissions, and server connection failures occur at different stages and should be checked separately.
First distinguish servers, subscriptions, and Config, then choose a Global Routing mode. The instructions below use iPhone / iPad interface terms; options may vary in the current app interface.
Open Global Routing from Home and choose Config, Proxy, or Direct. Config matches destinations according to the order of rules in the current configuration file. Typically, put specific domain rules first and FINAL at the end. Proxy and Direct switch the overall connection mode; they do not replace rule editing. After making changes, check which rule matches the destination, then confirm the actual route. An enabled connection does not mean every request goes through the proxy. The syntax below is an example; use policy names that match your own configuration.
DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXYCheck On Demand in Settings and set connection conditions for your network environment. It controls when a connection starts; it does not fix an unavailable server or replace Global Routing rules. For initial setup, connect manually and confirm access works before enabling automatic conditions. Test on both Wi-Fi and cellular networks to check whether the conditions behave as expected. If the connection restarts unexpectedly, check these settings too. If you only want to disconnect temporarily, also check whether existing conditions will trigger another connection instead of repeatedly toggling the Home switch.
Settings
On Demand
Global RoutingChoose Type in Add Server, then enter the connection details for your existing server. Shadowrocket supports Shadowsocks, VMess, VLESS, Trojan, Hysteria2, WireGuard, and other protocols. Each Type requires different fields; do not enter one protocol's parameters as another's. After importing a share link, check Host, Port, and the relevant authentication details. If TLS is enabled, also check the server's requirements. A protocol name only describes the connection method, not whether a server is available; verify it with an actual connection.
Shadowsocks / VMess / VLESS
Trojan / Hysteria2 / WireGuard
Type / Host / PortGet a subscription URL from your own service provider, choose Subscribe in Add Server, and save it. A subscription retrieves server entries in bulk and reads the remote list again when updated; it is not the same as a configuration file that controls routing rules. After the list changes, confirm the current selection is still valid before testing the connection. Subscription URLs may contain access credentials, so hide the full URL in screenshots and troubleshooting records. If an update fails, first check that the URL is complete, the service is active, and the network is working; then review the error. Avoid deleting manual entries you still need.
Add Server
Type: Subscribe
SERVERSelect and manage configuration files in Config, distinguishing settings such as General, Rule, and Hosts. Importing a configuration does not automatically make it active; before connecting, confirm which item is enabled, then set Global Routing to Config. Keep a recoverable copy before making changes and adjust one category at a time, making it easier to identify the effects of rule order or DNS changes. iCloud sync can help manage configurations under the same account, but should not replace a separate backup. After switching devices, check sync status, server selection, and local permissions; a file name alone does not confirm the configuration is active.
Config
General / Rule / Hosts
Global Routing: ConfigCheck reachability with Connectivity Test first, then use actual access, Data, and Diagnostics in Settings to identify the issue. Results depend on Test Method, the target, and the current network, so results from different methods are not directly comparable. Data shows traffic changes, but does not replace usage records from your service provider; traffic alone does not confirm a successful connection to the destination. During troubleshooting, note the network type, Global Routing mode, selected server, and error. Change one condition at a time to distinguish server, DNS, rule, and permission issues.
Connectivity Test
Data
Settings / Test Method / DiagnosticsShadowrocket is a closed-source commercial application. This is the official website and manual; verify the download channel, app identity, and network service separately.
iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, Android, and Linux versions are free. The client connects to services you already have. This site does not provide, sell, or recommend nodes or subscriptions.
Before getting the iPhone / iPad version, open the Shadowrocket App Store product page and confirm that the developer is Shadow Launch Technology Limited, the app ID is 932747118, and the icon matches the official icon used in this site's header. Check the name, icon, developer, and product page together; do not identify the app by a similar name in search results alone. The app ID in the product page URL distinguishes listings with the same name; store search ranking does not establish product identity.
Before purchasing, also review compatibility and the local price shown in the store. System requirements for iPhone / iPad are as listed on the App Store page; do not rely on system version numbers in older guides. For Mac, Windows, Android, and Linux, use the matching installer on this site's download page rather than selecting a desktop version from mobile store search results. Keep a record of the download source. If an installation prompt appears, verify the source first, then follow the approval steps for that platform.
App Store availability depends on the store region for your purchasing account, not directly on the device's current language. If Shadowrocket does not appear in your store, check the country or region for “Media & Purchases” in your account settings, then review the region change requirements shown by the system. Conditions such as account balance, active subscriptions, and payment methods may affect the process; follow the guidance on your account page. Repeatedly changing the device language or restarting the phone will not resolve a store-region mismatch.
Confirm the product page before purchasing. You do not need to enter purchasing account details in Shadowrocket's server fields. The app store account is used to get the client; server credentials are used to connect. If the store reports a payment or account restriction, resolve it in the store account. If the app reports a server connection failure, troubleshoot the network and connection details instead; do not confuse the two types of errors.
The iPhone / iPad version costs $2.99 one-time on the App Store; other storefronts may display prices in local currency. Mac, Windows, Android, and Linux versions are free. iPhone and iPad can share a purchase under the same purchasing account, and downloads can be restored from purchased items on compatible devices. After changing devices, first confirm you are signed in with the original purchasing account, then check your purchase history. If the app appears with a new price, verify the account and product identity before purchasing again.
Restoring the client and restoring its configuration are separate tasks. Reinstalling the app does not automatically restore your subscription URL, manual servers, or local changes. Before changing devices, save configurations you want to keep and check sync status. Afterward, check the server list, current Config, and connection permissions one by one. Mac, Windows, Android, and Linux users can get the appropriate version again from the download page; preserve existing configurations before updating instead of treating an app update as a data backup.
Before configuring the app, have your own subscription URL or server details ready. A single share link, QR code, subscription URL, and Config file each contain different information; do not assume they use the same import method just because they are all links or files. A single server entry establishes one connection, a subscription maintains a list of servers, and a configuration file controls rules and related settings. After importing, check which item was added before choosing a server and routing mode.
An app purchase is not a network service plan. The app purchase record does not include a server address, connection credentials, or service validity period; free versions for other platforms also require service details you already have. This site only explains how to import and use that information. Subscription links, QR codes, and exported configuration files may contain credentials. Before sharing a troubleshooting screenshot, hide access parameters, passwords, and other authentication details in the URL; the error and setting names are usually enough.
On iPhone / iPad, for example, select a server from Home, check Global Routing, then turn on the connection switch. The first time you connect, the system may ask for permission to add a VPN configuration. After allowing it, return to the app and check the status. A system message that the connection is established only confirms that the local connection process reached that stage; it does not by itself prove that a website is accessible or that a destination matched the expected rule.
To verify, first confirm the regular network is working, then run Connectivity Test and visit the destination you want to test. If only some destinations fail, check DNS, rule order, and which rule matched the destination. If all destinations fail, first check the server status and parameters. Traffic in Data can be a useful clue, but should be considered alongside actual access results. Note the current settings and change one item at a time; this makes it easier to identify the cause than changing the server, rules, and DNS simultaneously.
Manage iPhone / iPad app updates through the App Store; get new installers for Mac, Windows, Android, and Linux from this site's download page. Before updating the client, save your current configuration. Afterward, check the selected server, Global Routing, and required permissions. A subscription update rereads your existing remote server list; an app update does not confirm that the list was retrieved successfully, nor does it automatically maintain the rules in Config.
For routine maintenance, track changes to the app, subscription, and configuration separately. If entries disappear after a subscription update, check the remote list and service status first. If access changes after editing a configuration, check the rules first. If the connection fails after a system update, check permissions and the network environment. For more detailed steps, follow the chapters in the full manual in order. Avoid deleting all settings and losing the original information needed to troubleshoot.
The client and network service are set up separately. First get your own subscription URL or server details, then import them using the appropriate type. After entries appear in the list, select a server and check Global Routing. Installation alone does not complete connection setup. See the first-import steps.
Subscribe reads and updates a server list; Config stores rules and related settings. A successful subscription update does not mean the rules have changed, and selecting a configuration file does not mean a usable server is available. Before troubleshooting, determine whether you need to change the server source or the traffic route. See interface terms and configuration terminology.
Mac, Windows, Android, and Linux versions are free. Choose the system and architecture on this site's download page. The iPhone / iPad version costs $2.99 one-time on the App Store. For Mac, check whether you need Apple Silicon or Intel; for Linux, choose the package format for your distribution. Follow each platform's system prompts the first time you open the app. See installation approval instructions.
Check Global Routing first, then confirm which rule matches the destination and review DNS results. A successful server test and access to a destination are not the same thing. Test methods and destinations can also affect results. Keep a record of failed destinations, error messages, and network type, then troubleshoot in order. See connection troubleshooting Q&A.
Continue with the topic that matches your current issue. For initial setup, start with the guide; focused articles explain a specific installation step, link format, or connection problem.
Check the regular network and server reachability first, then review routing mode, DNS, and rule matches. The article covers cases where all destinations fail or only some fail, what to record at each step, and why you should avoid changing several settings at once. Useful when a service has been imported but the connection does not behave as expected.
Distinguish a single server from a bulk subscription by what each link contains, and understand how protocol fields, authentication details, and import methods relate. Identify the type of information you have before choosing an import option. The article also explains why links should be redacted before sharing and what to verify after importing, so a format issue is not mistaken for a network failure.
Choose a package format for your distribution, then follow the steps for apt, dnf, or AppImage. If it will not run, distinguish dependency, architecture, and execution permission issues before checking the client's connection. Use the commands with the actual downloaded file, and troubleshoot package installation errors separately from subscription or server status.