Shadowrocket FAQs

Yes. The iPhone and iPad version costs $2.99 as a one-time App Store purchase. The Mac (Apple silicon and Intel), Windows, Android, and Linux versions are free. Download desktop and Android installers from this site's download page; files are served from /dl/shadowrocket/. Choose your operating system first, then the processor or package format. The Mac version is not downloaded from the iPhone and iPad App Store listing.

Check the spelling, then check the country or region for the Apple Account used for Media & Purchases. It may differ from your device language, system region, or iCloud account. Shadowrocket is not available on the mainland China App Store. To change your region, go to Settings → Apple Account → Media & Purchases → View Account → Country/Region. Follow Apple's official process and check your balance, active subscriptions, and payment information before proceeding.

Open the App Store product page linked from the download page and check the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118. All three must match; don't rely on a similar name alone. The iPhone and iPad version costs $2.99 as a one-time App Store purchase. The Mac, Windows, Android, and Linux versions are free. A free listing with the same name is not the iPhone or iPad product covered here.

Usually not. The iPhone and iPad version costs $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. On your new device, use the same Apple Account you used for the original purchase, then find Shadowrocket in your App Store purchase history and download it again. If you still see a price, check the account, purchase history, and store region. Reinstalling the app won't restore server details or configurations that weren't backed up.

Yes. The iPhone and iPad version is available on the App Store for a one-time $2.99 purchase and works on both devices. The Mac, Windows, Android, and Linux versions are free. On iPad, download it using the Apple Account that made the purchase. Check the App Store listing for system requirements and compatibility before installing. If your device doesn't meet the requirements, first check for an available system update; an installation issue doesn't mean your subscription has expired.

Shadowrocket is a rule-based proxy client that reads connection details, applies rules, and handles connections. A one-time app purchase is not a service plan. The iPhone and iPad version costs $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. Further setup requires a subscription or server details you already have. This site doesn't provide, sell, or recommend servers or subscriptions; it explains how to import and check them.

Open the Apple menu → About This Mac. If Chip shows Apple silicon, choose the Mac Apple silicon download. If Processor shows Intel, choose Mac Intel. Move the app to Applications before opening it. If you see “Unable to Verify Developer,” confirm the file came from this site, then go to System Settings → Privacy & Security and select “Open Anyway.” Don't infer the processor type from your browser's detection.

First confirm that you downloaded the installer from this site's download page and that its path is under /dl/shadowrocket/. If SmartScreen shows “Windows protected your PC” and you've confirmed the file's source, select “More info” → “Run anyway.” Allow only this specific installation; don't disable Windows security protections. If your device is managed by an organization and there's no option to proceed, contact your device administrator rather than trying to bypass its policies.

Confirm the app came from this site and is in /Applications. If you see “Unable to Verify Developer,” try opening it once, then go to System Settings → Privacy & Security and select “Open Anyway.” If you see “App is damaged,” download it again first. After confirming the source and path, you can run xattr -cr /Applications/Shadowrocket.app in Terminal, then reopen the app. This command removes the app's extended attributes; use it only on this app after confirming its source.

On Android, download the installer from this site's download page. When prompted, allow your browser or file manager to “Install unknown apps”; you can revoke this permission afterward. On Linux, Debian- and Ubuntu-based distributions generally use deb packages, while Fedora-based distributions generally use rpm. For AppImage, first run chmod +x on the downloaded file to make it executable. If a system security policy blocks installation, check the file's source and your distribution's requirements; don't disable system protections globally.

This permission is required for Shadowrocket to create a system VPN configuration on iPhone and iPad. Make sure the prompt comes from the Shadowrocket you're using, select Allow, and complete any device passcode or system verification. If you denied the request, return to the app and reconnect to trigger it again. If the configuration was deleted, you'll need to authorize it again. Managed devices may restrict adding VPN configurations; check your organization's requirements, as repeatedly toggling the connection won't remove system restrictions.

Use the interface labels to find your way: Home is where you view and select servers; Add Server adds connection details; Config manages configuration files; Global Routing selects a routing mode; Data shows traffic; and Settings contains app preferences. This manual keeps the original English labels and explains them alongside. Screen locations may vary slightly by operating system and version, so follow the labels shown on your device.

A subscription URL fetches and updates a group of server entries. A single-server share link usually describes just one server. First identify which type of information you have, then choose the matching import method. Prefixes such as ss://, vmess://, vless://, and trojan:// are commonly used for individual server shares; don't repeatedly refresh them as if they were subscription URLs. Links may contain account credentials, so don't share them in public chats or forums, or in unredacted screenshots.

First make sure you copied the entire subscription URL, with no line breaks, spaces, or truncated parameters. Then check whether your current network can reach it. If it returns a login page, an error page, or no content, the client can't parse it as a server list. Ask the original provider to check the URL's validity period, account status, and output format. Don't delete existing working entries first. When troubleshooting, share only the error details—not the full subscription URL or its credentials.

Find the subscription group in Home and use its update action; the button's location depends on the current interface. After updating, check whether the server list changed, whether your previously selected server is still there, and run Connectivity Test again. If the update fails, keep the existing entries and check your network and subscription URL first. Updating a subscription changes server details; it doesn't update the app and may not replace the rules in Config.

Choose the protocol that matches the information you have, then check the server address, port, and authentication details one by one. Shadowsocks requires the correct encryption method and password; other protocols may also require a UUID, TLS settings, transport type, or server name. Don't fill in missing fields based on guesswork, and don't enter the address's port again in the separate port field. After saving, run Connectivity Test, then verify the connection to help distinguish entry errors from routing issues.

First make sure the QR code contains supported server details, not a website login URL or payment page. When using Scan QR Code, allow camera access and keep the code fully visible, sharp, and free of glare. If the interface offers an option to scan from your photo library, try the original image. If it still fails, ask the source for the corresponding text share link and check its protocol format. Don't upload images containing connection credentials to public QR recognition sites.

Note the currently enabled Config, Global Routing mode, and any essential settings. Use the app's export feature to back up your own configuration, and store any subscription URLs you already have securely. Exported files may contain passwords, UUIDs, and account details, so keep them somewhere protected and under your control. After restoring, check the current server, rule actions, and system VPN authorization. Reinstalling the app successfully doesn't automatically restore your previous connection details.

Config applies rules from the currently enabled configuration file, making it suitable for everyday use when your rules are ready. Proxy routes connections through the proxy mode, which is useful for temporarily checking the proxy path. Direct bypasses the proxy, providing a comparison with your underlying network. None of these modes guarantees that a server is available. After switching to Config, check that the active configuration is correct; in Proxy mode, confirm that the selected server connects.

First check for a pending VPN authorization, then confirm that a server with complete details is selected. Check whether another VPN connection is running on the device and whether device management policies restrict VPN use. Note the exact error shown when the toggle turns off, then check permissions, server details, and your current network in that order. If you recently changed the configuration, restore a known-working state first. Avoid changing several settings at once, so you can identify what caused the failure.

Disconnect and confirm that your underlying network works, then check the selected server's connectivity and account status. After reconnecting, check Global Routing. If needed, briefly compare Proxy with Config, then check DNS and which rules are matching. If only some destinations fail, focus on the relevant domain's rule action and DNS results. If all destinations fail, check the server and network first. Change one thing at a time and note the results before and after.

Connectivity Test reports results only for its current test method and target; it doesn't replace a full access check. A reachable test target doesn't mean DNS, TLS, and routing work for every domain. Confirm the test used the server currently selected, then visit the actual destination you need to check and see whether the rules assign it the expected action. Don't compare latency alone; also check for timeouts, resolution errors, and whether the destination itself is available.

Rules are generally matched in order. An earlier match may prevent later rules from being considered for that connection. Check the currently enabled Config, not just a file you've edited, then review the match scope and action for rules such as DOMAIN-SUFFIX and GEOIP. FINAL is the fallback rule when nothing earlier matches, so it belongs at the end. Save a copy before making changes, then verify the results with an actual connection and any available connection logs. Don't rely on rule names alone.

Start by using your system's battery statistics to distinguish foreground use, background connections, and traffic from other apps. Frequent transfers, repeated reconnects, heavy rule processing, or continuous diagnostics can all increase battery use. Check whether On Demand starts connections under network conditions where they're not needed, and reduce repeated automatic tests. Change conditions only when you have a clear reason. Compare before and after under the same network and usage duration; don't attribute a single battery drop to one toggle.