This guide is for users who already have connection details from their own provider and need to import them into Shadowrocket or check the settings. First, identify whether a link contains a single connection or points to a subscription by looking at its prefix. Then check the server, port, credentials, and transport settings. Finally, follow the steps to import, update, and test. The example.com address and sample credentials are for illustrating syntax only and cannot be used to connect. This site does not provide, sell, or recommend nodes or subscription services.
1. Share Links vs. Subscription URLs: Connection Details vs. a Server List
ss://, vmess://, vless://, and trojan:// are the four share link prefixes covered here. They typically contain the details needed for a single connection. When imported, the app reads those details and creates a server entry. Changing the link's remarks does not change the remote server's settings.
Subscription URLs usually start with https://, for example https://example.com/sub?token=xxxx. The app first requests that URL, then parses the list of connections returned by the server. The response may contain multiple share links in encoded text or another subscription format supported by the app. You cannot turn a subscription URL into a single share link simply by replacing “https” with a protocol prefix.
| What to check | Single share link | Subscription URL |
|---|---|---|
| Where the details are stored | Mostly in the link itself | Returned by the server at the URL |
| What happens on import | Parses the settings and saves one server entry | Requests the URL, parses the response, and saves a group of entries |
| When server-side details change | Usually needs to be imported again or edited manually | Synced by updating the subscription; the result depends on the server response |
| Sensitive information | Password, UUID, and server details | Access token, credentials in the URL path, and any connection details it can retrieve |
Seeing https:// alone does not prove that a URL is a subscription. Account login pages, payment pages, and help documents also use HTTPS. Check the purpose given by your provider and whether the request returns subscription data that Shadowrocket can parse. If you see a login page or CAPTCHA, first make sure you copied the subscription URL.
2. Read the Link: Prefix, Credentials, Host, Port, and Parameters
Field layouts vary by protocol, but you can use the same order to check them. Confirm the prefix first, then check the authentication details, server address, and port, followed by the TLS and transport settings. Remarks usually come after #; they identify the entry and are not an authentication password.
- Protocol prefix: Tells the importer which format to parse. Do not replace it arbitrarily.
- Credentials: May be a password or a UUID. Preserve the exact capitalization and symbols.
- Server and port: Together, they identify the connection target. The same domain on a different port may lead to a completely different service.
- Query parameters: Parameters after
?are separated by&and describe transport or security settings. Parameter names and supported options depend on the share link format. - Remarks: Text after
#may use percent-encoding; for example,%20represents a space.
3. ss://: Find the Encryption Method and Password
ss:// is used for Shadowsocks. The common SIP002 share format encodes “encryption method:password” using Base64 or URL-safe Base64, followed by @server:port. Older formats may encode a longer block of details, so the presence or absence of a visible @ does not by itself mean the link is broken.
ss://[email protected]:8388#demo-ssThe example above is for syntax only. Decoding YWVzLTEyOC1nY206ZGVtby1vbmx5 gives aes-128-gcm:demo-only: the encryption method is aes-128-gcm, the password is demo-only, the server is example.com, and the port is 8388. Do not paste the entire encoded string into the password field.
- After importing, open the entry details and confirm that Type is set to Shadowsocks.
- Compare the encryption method, password, server, and port with your connection details.
- If the original link includes a
pluginparameter, also check the plugin name and options. Correct basic fields do not guarantee that the plugin settings are complete.
Base64 strings sometimes omit the trailing = padding, while URL-safe variants may use - and _. Don’t try to “fix” these differences by replacing characters. Keep the original text provided by your service provider and let the importer parse it. Only copy the full link again if you’ve confirmed that it was truncated.
4. vmess://: Commonly a Base64-Encoded JSON Object
vmess:// is used for VMess. A common share format encodes a JSON object and places it after the prefix. The structure below is decoded JSON, not a complete share link you can paste in to import. Generators may use other variants, so do not assume every link uses the same field definitions.
{
"v": "2",
"ps": "demo-vmess",
"add": "example.com",
"port": "443",
"id": "00000000-0000-4000-8000-000000000001",
"aid": "0",
"scy": "auto",
"net": "ws",
"type": "none",
"host": "example.com",
"path": "/demo",
"tls": "tls",
"sni": "example.com"
}addandport: Server address and port;idis the UUID used for authentication.ps: Remarks;v: Format marker for this share structure, not the Shadowrocket app version.aid: The alterId field in older formats. Modern VMess AEAD configurations typically use0; follow your server's requirements.net,host, andpath: Describe the transport type and related settings. In this example,wsmeans WebSocket.tlsandsni: TLS settings and the server name used during the handshake, respectively. Do not confuse SNI with the WebSocket Host.
JSON requires properly paired quotes and commas. Line breaks added by chat apps, a missing closing character when copying, or straight quotes changed to curly quotes can all cause parsing errors. If the server address is blank after import, check whether the original link is complete before changing Global Routing.
5. vless:// and trojan://: Similar Formats, Different Credentials
Common vless:// and trojan:// share links both follow a pattern like “credentials@server:port?parameters#remarks”. VLESS usually uses a UUID, while Trojan usually uses a password. Similar formatting does not mean you can swap the prefixes or reuse the same transport settings.
vless://[email protected]:443?encryption=none&security=tls&type=ws&host=example.com&path=%2Fdemo&sni=example.com#demo-vless
trojan://demo%[email protected]:443?security=tls&type=tcp&sni=example.com#demo-trojan| Field | Description | How to check |
|---|---|---|
| VLESS credentials | A UUID in this example | Check each part and preserve the hyphens |
| Trojan credentials | The example password is demo@only | In the link, %40 decodes to @. Do not mistake the separator for part of the password. |
| security=tls | Describes TLS transport security settings | Check that SNI matches the name on the certificate |
| type=ws / type=tcp | Describes the transport method | Do not assume the settings are interchangeable just because both use port 443 |
| path=%2Fdemo | The decoded path is /demo | Preserve the leading slash and capitalization |
In the VLESS example, encryption=none describes VLESS's own encryption field; it does not mean the entire connection is without TLS. Interpret it together with the security parameter. Other security modes may require additional parameters, so do not copy this example's TLS settings to your own service.
The server address, SNI, and WebSocket Host may be the same or different; they serve different purposes. Do not change them just to make the fields “look consistent.” Importers also vary in which parameters they support. If an entry can be saved, that only means its syntax was accepted; check its details and test the connection afterward.
6. Import into Shadowrocket: Single Entries vs. Subscription Groups
The steps below use the import options on Home. Home is where you manage server entries, Config is for rule configurations, and Settings is for app options. Regular server share links and subscription URLs should not be imported into Config as rule configuration files.
Import a Single Share Link
- Copy the complete link from your own connection details. Copy only the link itself—leave out descriptions, quotation marks, and trailing punctuation.
- Open Shadowrocket and go to Home. If a clipboard import prompt appears, confirm it and check the new entry. If no prompt appears, use the app's import option or scan a QR code for the link.
- Open the entry details and check Type, server, port, credentials, TLS, and transport settings in turn. The fields shown vary by protocol.
- Save and select the entry, then connect. A single entry does not automatically become a subscription-managed entry when your provider changes its details.
Import and Update a Subscription
- Copy your subscription URL, for example, one with a structure like
https://example.com/sub?token=xxxx. This is a dummy value, not a service endpoint. - Go to Home → +, choose Subscribe under Type, enter the full URL in the subscription URL field, save, and wait for the list to load.
- Check that entries appear in the subscription group, then select the one you want to use. Successfully importing a subscription does not automatically select one of its connections.
- When your service details change, update the subscription from its group on Home. First confirm what was returned and whether the update completed, then check whether the existing entries changed.
7. Test After Import: Check the Details, Then Compare Routing Modes
A successful import only means the details could be parsed; it does not confirm that the server is reachable, the credentials are valid, or the rules behave as expected. Select the entry and test the connection first, then check Home → Global Routing. The comparison below covers Shadowrocket settings, not protocol speed rankings.
Config
RecommendedRoutes traffic according to the rules in the current configuration. When a rule such as DOMAIN-SUFFIX, IP-CIDR, or GEOIP matches, its assigned policy applies. If none of the earlier rules match, FINAL determines the route; traffic is not necessarily sent directly.
Best for: Everyday use with an existing rule configuration and traffic routed by destination
Proxy
Routes app-managed connections through a proxy. This can temporarily rule out ordinary routing rules as the cause of an issue with a test destination. It does not fix an incorrect password, port, or TLS setting.
Best for: Temporarily checking whether a proxy connection works and narrowing down rule-related issues
Direct
Routes app-managed connections directly. Being able to open a website does not prove that the proxy entry you just imported is working.
Best for: Checking whether your local network is working
Bottom line: Change one test setting at a time
If the same test destination works in Proxy but fails in Config, leave the connection settings as they are and check the matching rules, policies, and DNS. If both modes fail, first check the server, port, authentication, and TLS. Restore your original routing mode after testing so a temporary setting does not become your permanent configuration.
Global Routing also includes the Scene mode, whose behavior depends on your existing scene settings; it is not a fixed test mode for ruling out variables. Settings → On Demand controls when a connection starts automatically; it does not fill in missing share link parameters. If the connection state changes automatically during troubleshooting, check your existing On Demand settings as well.
8. Share Link Import and Subscription Update FAQs
I copied a link. Why wasn't it added automatically?
First, make sure the prefix and the full link are intact, and remove any quotation marks or explanatory text around it. Then check whether the system allows clipboard access, and return to Home to use the import option or scan a QR code generated from the original link. Do not change an https subscription URL to an ss prefix just to trigger recognition.
The subscription update says it succeeded, but the entries haven't changed. Did it fail to refresh?
Not necessarily. A successful update means the data was fetched and parsed; the server may have returned the same list. Check whether the server or port in the group actually changed, then verify the subscription URL you copied. Do not repeatedly delete and recreate the group to check whether the server has updated it.
The subscription URL opens in my browser. Why can't the app import it?
A page loading in your browser does not mean the response is subscription data. If you see a login form, an HTML error page, or an access verification page, check the subscription URL specified by your provider. For a 401 or 403 response, check your token and account permissions. For a timeout, check network access; do not start by changing the protocol password.
Can I send someone the full link so they can check it for me?
First, make a local copy and redact the password, UUID, subscription token, and other authentication parameters, leaving only the field structure you need checked. QR codes contain the original details too. If you have exposed full credentials, revoke or replace them through your own service account, then update the entry or subscription in Home.
After checking, you should be able to answer three questions: Did you import a single connection or a subscription URL? Do the saved fields match your own service details? Will the current routing mode use this connection? Working through these questions in order helps keep formatting issues, server reachability, and rule behavior separate.