Shadowrocket FAQ

Yes. Shadowrocket is available for iPhone, iPad, Mac, Windows, Android, and Linux. The iPhone and iPad versions cost $2.99 as a one-time App Store purchase. The Mac, Windows, Android, and Linux versions are free. Mac downloads are available for Apple silicon and Intel. Get installers for other platforms through this site's download guide at /dl/shadowrocket/. Choose the version for your device, then follow the installation guide; do not use an installer intended for a different operating system.

Open the App Store product page from the download guide, then check the region of the Apple Account used for Media & Purchases. Shadowrocket is not available in the mainland China App Store. To check the region, open Settings, tap your Apple Account, then Media & Purchases, View Account, and Country/Region. If you need to change regions, follow Apple's official process and resolve any balance, active subscriptions, and payment details first. Changing the storefront in a web product-page URL does not change your account region.

On the product page, check the app name (Shadowrocket), developer (Shadow Launch Technology Limited), and app ID 932747118 in the page URL. Compare the listing with the official icon shown in this site's header. Don't rely on a matching name or similar-looking icon in search results alone. The iPhone and iPad versions cost $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. For other platforms, use this site's download guide to choose an installer from /dl/shadowrocket/.

Sign in to the App Store with the Apple Account used for the purchase, find Shadowrocket in your purchase history, and download it to a compatible iPhone or iPad. The purchase covers both device types; check the App Store listing for system requirements. If you see a purchase button, first verify the account used for Media & Purchases and check your purchase history instead of paying again. The iPhone and iPad versions cost $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. Restoring the app does not restore your server details, so back up your configuration separately.

A one-time app purchase is not a service plan. Shadowrocket reads configurations, establishes connections, and handles requests according to rules; installing it does not provide a server. The iPhone and iPad versions cost $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. These prices cover the app only. Further setup assumes you already have your own subscription or server details. This is the official Shadowrocket website and manual. It does not provide, sell, or recommend servers or subscriptions.

Open About This Mac from the Apple menu. If it lists a Chip and an Apple chip name, choose the Apple silicon version. If it lists an Intel Processor, choose the Intel version. Download the matching DMG file through this site's download guide. If you see a warning that the developer cannot be verified when opening the app for the first time, confirm the file came from this site, then go to System Settings → Privacy & Security and select Open Anyway. If your device is managed by an organization and that option is unavailable, contact your administrator rather than trying different installers.

First, confirm the installer came from the /dl/shadowrocket/ address linked in this site's download guide. For a Windows SmartScreen warning, verify the file's source, then select More info → Run anyway. If macOS says the developer cannot be verified, go to System Settings → Privacy & Security and select Open Anyway. If macOS says the app is damaged, download it again and follow the relevant steps in the download guide. Do not disable system protection globally. If the warning is a malware detection alert rather than a source warning, stop and investigate.

On Android, after downloading the installer from this site, temporarily allow Install unknown apps only for the browser or file manager you use to open it. You can revoke that permission after installation. When connecting for the first time, review the system VPN request. On Linux, choose the deb, rpm, or AppImage package for your distribution; AppImage files need execute permission before they can run. If device policy blocks installation or VPN connections, check with your administrator. See the download guide for commands and permission steps. Android's app-install permission and VPN connection permission are separate.

First, check that Home's SERVER list contains an entry and that your own server is selected. The first time you connect, approve the system request to add a VPN configuration and complete any device authentication. If you previously denied the request, try connecting again. If the switch still turns off immediately, check whether another VPN is running or whether your system has managed network restrictions, then review the error in Log. Don't delete all configurations as a first step. Save your existing details and change one condition at a time before retrying.

This manual uses the original English interface labels, so you can look for Home, Config, Settings, and Global Routing directly. Check your system's preferred language and the app's language options first. An option may appear in system settings only if the app supports that language, and menus can vary by operating system and version. You don't need to reset network settings to change the language. When following a procedure, match the interface label and feature location rather than button color. If you can't find an option, use the settings paths in the options manual.

Make sure you copied your own subscription URL, not a management-page or sign-in URL, and remove any spaces or line breaks at either end. Check whether the URL has expired, its access token has changed, or your provider requires a new link. Then review the error: a request timeout points to a network issue, while an unparseable response may indicate an incorrect subscription format. Don't post the full subscription URL publicly; it often contains access credentials. For troubleshooting, note only the error type and contact your provider if you need to verify the URL or format.

Compare the server details you already have, checking the protocol, address, port, and authentication information first. Then verify protocol-specific fields such as encryption, TLS, SNI, transport, and path. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different parameters; the same address and port do not make their configurations interchangeable. After saving, select the entry again and run Connectivity Test. If it still fails, check the specific error in Log rather than changing several advanced fields at once.

Check that the QR code contains server or subscription details the app can recognize, not just a link to a regular webpage. Then make sure camera access is allowed. When scanning a code on a screen, keep its edges fully visible and the image sharp; avoid glare, cropping, and blurry scaling. If the app reads text but cannot add an entry, ask your provider to verify the encoded data and protocol format, or enter the details manually if you have them. QR codes may contain passwords or access credentials, so don't share the original image publicly.

A subscription update refreshes its group with the content returned by the remote service, so names, entry counts, and order may change. Before updating, note the group and entry you are using. Afterward, check that the expected entry is still selected and run Connectivity Test again. If the update fails, keep any entries that still work and check the network and subscription URL; don't repeatedly delete and re-import. Manual changes to subscription entries may be overwritten by a later update, so record temporary test settings separately. For lasting changes, use the details provided by your service provider.

No. Subscribe usually retrieves and refreshes your existing server list. Config contains rules, policy references, and related settings. Importing a subscription does not automatically enable a suitable rules file, and importing a Config does not guarantee that its referenced servers exist. Check these separately: first, review the SERVER list and selected entry in Home; then, in Config, confirm the active configuration and its policy references. After moving to another device or restoring the app, check both sets of data rather than restoring only one before connecting.

Config uses the rules in the active configuration to determine how requests are handled. Proxy sends requests within that mode's scope through the proxy. Direct bypasses the selected proxy server. For everyday rule-based routing, choose Config and make sure the rules file is enabled. For a quick comparison, test the same request in Proxy and Config. Don't confuse the mode names with the uppercase PROXY and DIRECT policies used in rules; they are different settings. Direct also does not confirm that a server is working.

Turn off the connection and confirm your Wi-Fi or mobile data can reach ordinary websites on its own. Turn the connection back on, check the selected server, and run Connectivity Test. If the test fails, check the server details and availability first. If it passes but websites still fail, check DNS in Settings and review Log to distinguish a DNS error, connection timeout, or rule-matching issue. Finally, compare Config and Proxy using the same destination. Change one setting at a time and record the result so you can tell what made a difference.

Connectivity Test reports the result for the selected test method; it doesn't guarantee that every domain, port, or app request will work. Check the failed site's DNS and connection entries in Log, then verify that the expected rule matched, its policy points to a working server, and DNS returned a usable address. If only one app is affected, check whether it has an existing connection or its own network settings. Don't keep lowering the test timeout based on a single result. Narrow down the actual failed request one layer at a time.

Rules are generally matched from top to bottom, and the first match determines the policy. Put more specific DOMAIN or DOMAIN-SUFFIX rules before broader rules that could match first. FINAL is the fallback when no earlier rule matches, so place it at the end and check that its PROXY, DIRECT, or policy group reference is correct. After editing, confirm this is the active Config and use Log to see which rule matched. If a broader rule already matches first, adding similar rules at the bottom usually won't change the outcome.

Start by checking your system's battery usage by time period and background activity. Look for large data transfers, frequent reconnections, subscription refreshes, or continuous diagnostics. On Demand starts connections when configured conditions are met; it does not need to be enabled in every situation. Try turning it off temporarily and connecting manually, then compare similar usage conditions. Log helps with troubleshooting; stop continuous monitoring when you've finished, and check whether extra debugging options are enabled. Don't judge stability by arbitrarily shortening test intervals, and avoid turning off every setting at once to compare battery use.