Get the client for your platform, import an existing configuration and set up rule routing. iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, Android and Linux: free.
Current version See the download page · Mac, Windows, Android and Linux: free; iPhone / iPad: $2.99 one-time
First-time setup: import a configuration and connect →
First distinguish server details, configuration files and client settings. The server determines the connection destination, Config controls how requests are routed, and Settings adjusts resolution, testing and on-demand connection behavior. These areas are related, but changing one does not automatically configure the others.
In Global Routing, the Config, Proxy and Direct options correspond to configuration-based routing, proxying and direct connections. For everyday rule-based routing, select Config and make sure the current configuration file is enabled. Rule checks requests from top to bottom and applies the first matching policy. Put specific domain rules before broader rules, and leave FINAL at the end. PROXY uses the selected proxy, DIRECT connects directly, and REJECT denies the request. The example below shows syntax only; it cannot replace your own server details or imply that every request should use the same policy.
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-KEYWORD,example,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT
GEOIP,CN,DIRECT
FINAL,PROXYOn Demand asks the system to establish a connection when specified conditions are met. It does not select which websites use a proxy; that is still determined by Global Routing and the active rules. For initial setup, start with the manual switch. Confirm that the server, DNS and rules work before setting network conditions as needed. If the connection starts again after you turn it off, check whether On Demand still has a matching condition instead of repeatedly deleting the server. Widget provides shortcuts, while iCloud syncs configurations. Keep a local copy before syncing, then check the selected server and configuration after switching devices.
If you already have details for an individual server, select Type in Add Server, then enter Host, Port and authentication fields for that type. Parameters differ between Shadowsocks, VMess, VLESS, Trojan, Hysteria2 and WireGuard; changing only Type while reusing all the old fields will not work. Use Scan QR Code for an existing QR code, then verify the protocol and address after importing. A successful save only means the entry was added to the list; it does not confirm remote reachability. Select the entry, run Connectivity Test, then verify it by opening a webpage.
If you already have your own subscription link, use Subscribe to import the server list. Check that the link is complete before pasting it, without any explanatory text, spaces or line breaks. Updating a subscription usually reloads the remote list, so do not keep important local changes only in entries that may be overwritten. If an update fails, first check that the device can reach the subscription address, then confirm the link is still valid and the response uses a supported format. A subscription and a Config file serve different purposes: the former manages server entries, while the latter describes routing and other behavior. Check each one after importing.
DNS translates domain names into addresses needed for connections. If Connectivity Test succeeds but a webpage will not open, check name resolution separately from server reachability. First note the DNS settings in the current configuration and keep existing working values. Then determine whether all domains fail or only specific ones. Avoid changing the resolver, routing rules and protocol parameters at the same time, or it will be difficult to identify what caused the result. Configurations can override default behavior, so check the active configuration and app interface for current defaults. If your setup is stable, there is no need to replace all DNS settings just because a test result changed slightly.
Connectivity Test checks reachability using the current test method; it does not replace an actual browser test. Test Method in Settings affects the target and method, so keep them and the network consistent when comparing results. If the connection fails, check the local network first, then the server parameters, DNS and matching rules. Data can help you observe traffic changes during a connection, but traffic does not mean the destination page loaded successfully. If you need to review Log or Diagnostics, record only what is needed to reproduce the issue. Remove subscription links, server credentials and personal browsing records before sharing.
For initial setup, leave options unchanged unless you know they need adjustment. Test, logging, sync and port settings in Settings affect different parts of the process; enabling everything does not necessarily improve the connection. First complete a manual connection and note the server, Global Routing mode and configuration file. Then change one item at a time and repeat the same access test. This separates parameter errors, resolution failures and rule mismatches, and makes it easier to return to the last working state.
If other local programs need to use the Proxy port, read the relevant chapter and check the listening scope and access permissions. If the port is for local use only, do not widen its listening scope just to try to connect. iCloud sync does not sync connection status either: after another device receives a configuration, check its network permissions, selected entry and local settings. The manual explains each option by its path; if interface labels or option order change between versions, refer to the current app interface.
Two ways to get it: iPhone / iPad costs $2.99 one-time on the App Store; Mac, Windows, Android and Linux are free. Desktop and Android installation packages are provided on the download page and served from this site at /dl/shadowrocket/. Each device link below opens the relevant download section. Check your system and processor before choosing a file.
App Store: $2.99 one-time; other platforms are free.
Use the App Store product page to verify the app and purchase it. Check the App Store page for system requirements. The same purchasing account can redownload it on eligible iPhone and iPad devices. After installation, import your own server or subscription.
Free · Apple Silicon / Intel; iPhone / iPad: $2.99 one-time.
Check About This Mac for the chip or processor, then choose the Apple Silicon or Intel version. If the first launch says the developer cannot be verified, confirm the file came from this site, then follow the download page steps: “Privacy & Security → Open Anyway.”
Free; iPhone / iPad: $2.99 one-time.
The download page provides a 64-bit Windows installer. If SmartScreen blocks it, first confirm the download source and file purpose, then select “More info → Run anyway” to continue. Connection settings and installation permissions are separate issues; do not change server parameters to address a system warning.
Free · arm64; iPhone / iPad: $2.99 one-time.
Get the arm64 installation package from the download page. If Android asks for installation-source permission, enable “Allow from this source” only for the browser or file manager performing the installation, then revoke it afterward if you wish. When connecting for the first time, confirm the system VPN permission prompt.
Free · deb / rpm / AppImage; iPhone / iPad: $2.99 one-time.
Choose deb or rpm according to your distribution's package manager. For AppImage, grant the file execution permission first. The download page lists the relevant installation and permission instructions. If prompted about permissions, check the file path and execution permission rather than changing the entire configuration or system network settings.
See all platforms →Steps when the system blocks installation →
The steps below use the iPhone / iPad interface. Before you begin, prepare your own server details or subscription link and confirm the device can access the internet. Installing the client, importing an entry and enabling the connection are three separate steps.
For an individual server, use Add Server and enter the relevant parameters for its Type. For an existing subscription, use Subscribe to import the complete link. After importing, check that the expected entries appear in the SERVER list, then verify the address, port and authentication fields. A failed link update and a failed server connection are different problems and should be checked separately.
Scan QR Code can read a QR code, but verify its contents after scanning. A subscription address may contain access credentials; do not include it in public screenshots or issue reports. This site explains how to import your own configuration and does not provide servers or subscriptions.
To route traffic by rules, select Config and confirm that the required configuration file is enabled in Config. Proxy uses the proxy mode, while Direct connects directly; these modes can help with troubleshooting under specific conditions but do not replace a complete rule configuration. Adding a server alone does not generate routing rules for your needs.
If a domain does not use the expected policy, first confirm that Config is selected, then check the rule order and FINAL. Do not move FINAL above specific domain rules; a broader rule that matches first prevents later, more specific rules from taking effect.
Select the server you want to use and run Connectivity Test, then turn on the connection switch on the Home page. When the system first asks to add a VPN configuration, read the prompt and authorize it. Once the connection status changes, use a browser to visit the intended page and check the actual result rather than relying on a single test value.
If the test succeeds but a page will not load, note the current mode and configuration, then check the network, server parameters, DNS and rules in that order. Change one condition at a time and keep its previous value. This helps identify the source of the issue instead of losing the point of comparison by changing several things at once.
Shadowrocket Manual is the official Shadowrocket website and guide. Shadowrocket is a closed-source commercial app. When getting the client, verify its identity on the App Store and platform details on this site's download page. Do not rely on similar names or search-result position.
On iPhone / iPad, open the App Store product page and check the name Shadowrocket, the developer Shadow Launch Technology Limited and App ID 932747118. The official icon is a rocket with a blue-violet outline on a white background; compare it with the icon in this site's header. Similar names do not indicate the same app, and price information cannot replace checking the developer and App ID.
The US App Store price for iPhone / iPad is $2.99 one-time; other storefronts display local currency. Mac, Windows, Android and Linux are free. Check the App Store page for iPhone / iPad system requirements. Before purchasing, confirm device compatibility and the current storefront; do not rely on outdated information in search snippets.
This app is not available on the mainland China App Store storefront. If the product page is unavailable, first check the region of the Apple Account used for “Media & Purchases”; the device's display language does not determine the storefront region. Changing an account's region may affect its balance, existing subscriptions and payment methods. Read the conditions shown in the system before deciding whether to make a change.
In device settings, open “Media & Purchases” under your Apple Account and check the account and country or region information. Changing the device language or repeating the same search will not change availability in the current storefront. The purchase button and purchased status shown in the store depend on the currently signed-in purchasing account.
iPhone and iPad can share the same purchase. When changing devices or reinstalling, use the original purchasing account and find Shadowrocket in App Store purchases. It can be redownloaded when the purchase record and storefront conditions allow. If the store still shows a price, first check the account and purchase history rather than purchasing again immediately.
Redownloading the app and restoring its configuration are separate tasks. After restoring, check your server entries, current Config and VPN permissions. If you use iCloud sync, verify the synced content before connecting. Mac, Windows, Android and Linux users can return to this site's download page to get the package for their platform.
Client purchase ≠ service plan. The iPhone / iPad App Store purchase costs $2.99 one-time; Mac, Windows, Android and Linux are free. None of these options includes servers or subscriptions for connecting. Check the validity period, traffic allowance and credentials for an existing service with your own service provider.
This site does not provide, sell or recommend servers or subscriptions. Import instructions in this manual assume you already have your own configuration. Check separately that the client is installed, the subscription is imported and the remote service is still active. For connection issues, verify these basics before adjusting resolution and testing options in Settings.
Updates also vary by platform: check for app updates through the App Store on iPhone / iPad; get updated installation packages for Mac, Windows, Android and Linux from this site's download page. Keep your working configuration before updating, then verify the existing connection before changing any other settings.
For the complete setup sequence, start with Quick Start. If the connection already works and you only need to find a setting, go to the settings manual. The three articles below cover pricing, desktop installation and rule order to help keep separate issues from being addressed with the same settings change.
The iPhone / iPad version costs $2.99 one-time on the App Store. Mac, Windows, Android and Linux are free. Understand the costs by separating client purchase, an existing connection service and redownloading, and distinguish purchase history from server validity.
Read the pricing guide →First check About This Mac to identify Apple Silicon or Intel, then select the matching file. The article also explains macOS developer verification prompts and the Windows SmartScreen steps. Confirm the download source before allowing the app to run.
Read the installation steps →Use DOMAIN-SUFFIX, GEOIP and FINAL to understand matching order, and distinguish PROXY, DIRECT and REJECT. Before changing rules, confirm Global Routing is set to Config and check which file is enabled so you do not edit an inactive configuration.
See rule examples →