Shadowrocket
FAQ & Troubleshooting

Yes. The iPhone and iPad version costs $2.99 as a one-time App Store purchase. The Mac, Windows, Android, and Linux versions are free. Mac downloads are available for Apple Silicon and Intel; choose the package that matches your device on other platforms too. Start with the download guide and select your platform. Computer, Android, and Linux installers are available on this site under /dl/shadowrocket/. The guide also covers how to allow the app to open the first time. Do not use an installer made for another operating system.

Open Shadowrocket’s App Store product page first to check whether the app is unavailable in your store region or simply missing from search results. The app is not available in the mainland China store. Check the region associated with the Apple ID used for the App Store; changing your device language or system region alone won’t change it. If you need to change the store region, follow Settings → Apple ID → Media & Purchases → View Account → Country/Region, and review the store’s requirements for balance, subscriptions, and payment. Changing the device language does not change the account’s storefront.

Check that the developer is Shadow Launch Technology Limited, the icon is the official one, and the app ID is 932747118; all three should match the same product page. The iPhone and iPad version costs $2.99 as a one-time App Store purchase; check the store page for the final price. The Mac, Windows, Android, and Linux versions are free. Don’t rely on the name or search ranking alone, and don’t mistake a similarly named free listing for this product. Get computer, Android, and Linux installers from this site’s download guide under /dl/shadowrocket/.

On your new device, sign in to the App Store with the Apple ID originally used to purchase Shadowrocket. Find the app in Purchased or your account’s app list, then download it again. Your device’s cloud account may differ from the account used for the purchase. If the purchase doesn’t appear, check which account made it and which storefront is currently selected. Restoring the app does not restore all local settings. If you can still use the old device, save your configuration and server details, and check that your backup is complete. Don’t erase the old device until you’ve verified the backup.

Yes. iPhone and iPad use the same App Store product listing. Sign in with the original purchase account to download the app on either device from your purchase history. The iPhone and iPad version costs $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. Check the App Store listing for the iPhone and iPad system requirements. After installation, import your own subscription or server details and approve the VPN configuration on that device. A connection on another device does not mean this one is set up.

A one-time app purchase is not a service plan. Shadowrocket manages connection settings, configuration files, and rules; getting the app does not include a remote server you can connect to. These instructions assume you already have a subscription or server details. Get subscription links from your service provider. This site is the official site and manual; it does not provide, sell, or recommend servers or subscriptions. Before importing, distinguish a subscription link, a single server share link, and a Config file. They serve different purposes and aren’t interchangeable just because their text looks similar.

Open About This Mac from the Apple menu and check whether it shows Chip or Processor. Choose the Apple Silicon version if it shows an Apple chip, or the Intel version if it shows an Intel processor. Don’t guess from the Mac’s appearance or year of purchase. Move Shadowrocket from the matching DMG to Applications, then open it. If macOS says the developer cannot be verified, confirm the download source, then go to System Settings → Privacy & Security and select Open Anyway. See the download guide for complete installation and security prompt instructions.

First, make sure the file came from this site’s download guide, is under /dl/shadowrocket/, and is the Windows installer. If SmartScreen blocks it, expand More info to review the file details. If they check out, select Run anyway and follow the installer. Don’t leave system protection turned off just to install the app. If your device is managed by an organization, the button is unavailable, or policy explicitly blocks the app, contact your administrator rather than repeatedly changing settings. The wording of the prompt may vary with Windows settings.

First, confirm you downloaded the correct chip version, the file finished downloading, and Shadowrocket is in /Applications. If macOS says the developer cannot be verified, first try Open Anyway under System Settings → Privacy & Security. If the installer is from this site and macOS still says the app is damaged, run xattr -cr /Applications/Shadowrocket.app in Terminal, then try opening it again. This command applies only to the specified app directory; don’t expand the path to the entire disk. If permissions or organization policies block it, check the app’s location and your device management requirements.

Choose the Android arm64 APK from the download guide. If tapping the link in WeChat doesn’t start the download, use the page menu to open it in your system browser. During installation, follow the system prompts to allow the browser or file manager you’re using to install unknown apps. You can revoke this permission afterward. Grant it only to the app handling this installation; there’s no need to enable it for every app. If installation still fails, check the device architecture, available storage, and whether the download completed. Save any existing settings before checking for conflicts with an older installation.

Choose the package format used by your Linux distribution: deb for systems that use deb packages, rpm for systems that use rpm packages, or AppImage if you want a standalone file. After downloading, open a terminal in the file’s directory. Install a deb package with sudo apt install ./Shadowrocket.deb; if the filename differs, substitute the name of the downloaded file. For an AppImage, grant execute permission with chmod +x Shadowrocket.AppImage before running it. Package permissions, dependencies, and desktop integration vary by distribution. If an error occurs, read the terminal output before trying again.

First, make sure a server is available to select in Home, then try turning on the connection. The first time you connect on iPhone or iPad, the system asks to add a VPN configuration. Approve it and complete any device passcode or authentication prompt. If you canceled, return to the app and try again. If it still won’t turn on, check the system’s VPN and device management settings, and see whether another VPN connection is already active. Managed devices may block new configurations; don’t delete organization settings you don’t recognize. Approval only lets the system establish a connection; you still need to check the server and rules.

Get the subscription link from your service provider. In Home, open Add Server, choose Subscribe, paste the full URL, save it, and then update it. Check for extra spaces, line breaks, quotation marks, or text added by a messaging app before and after pasting. The full link may include query parameters, so don’t keep only the domain. After importing, confirm that entries appear in the server list, then select the server you want to use. Subscription links may contain access credentials; don’t share the full URL in public screenshots, comments, or shared configurations.

First, tell apart an address that can’t be reached from a response the app can’t parse. Check that you copied a subscription URL, not an account page, instructions page, or single server share link. Then confirm that your current network can reach the URL, the subscription is still valid, and the server returns content the app supports. A page loading in a browser doesn’t mean its content is a valid subscription; a login page can’t be parsed as one either. If you see an error, note its wording and when it occurred, then ask your provider to verify the URL and format. Keep existing entries while troubleshooting so you don’t delete a configuration that still works.

A single server share link usually describes one server. A QR code may simply encode the same link; after using Scan QR Code, check whether the result is a server or a subscription. With manual Add Server, enter the protocol, address, port, and required authentication details one by one. Whichever method you use, verify the protocol. Matching address and port values don’t mean you can skip TLS, SNI, or transport settings. After importing, check that all fields are present, then save and test. A single server entry does not automatically update like a subscription list.

In Home, find the relevant Subscribe entry and update it. When the update finishes, check the list and the currently selected server. The list reflects the subscription’s latest response, so servers may be added, renamed, or removed. Confirm that your selected entry is still there; don’t rely only on its previous name. Updating the server list and switching Config are separate actions. Updating a subscription does not necessarily change your rules. If you edited parameters generated by the subscription, an update may overwrite them. Record any changes you need to keep and check them against the original details from your provider.

Check the server address, port, password, SNI, and TLS settings against the server details you already have. The server address is the connection destination; SNI is used for the TLS handshake, and they may differ. Check the password for leading or trailing spaces too. For certificate errors, verify the SNI, device time, and server certificate before enabling Allow Insecure. A successful import only means the app recognized the fields; it doesn’t prove the remote service is reachable or authentication is correct. Change one field at a time and keep its previous value so you can revert.

Subscribe is mainly for fetching and updating a server list. Config organizes connection behavior and rules, with sections such as [General], [Rule], and [Host]. Importing a server subscription as a configuration file, or pasting a full rules file as a server address, may fail to parse. Identify the content type first, then use the matching screen. After switching configurations, check which Config is selected. A configuration can change DNS and how requests are routed. Read unfamiliar sections before importing, and save your current configuration so you can restore it if needed.

Config uses the rules in the current configuration to route requests. Proxy sends requests through the selected server. Direct connects to the destination without a proxy. Use Config for everyday rule-based routing; while troubleshooting, temporarily switch to Proxy or Direct to compare results. These interface modes relate to the PROXY and DIRECT policies used in rules, but they are not the same setting. Compare using the same destination and network conditions, then restore the original mode so you don’t leave a temporary troubleshooting setting in place.

First, turn off the connection and check that your basic network works. Turn it back on and make sure the intended server is selected. The connected status means the local connection process started; it doesn’t guarantee that remote forwarding, DNS, or the destination website is working. Use Connectivity Test to check reachability, then compare Config and Proxy against the same destination. If only Config fails, check the rules first. If both fail, check the server settings, subscription status, and network. If only one website fails, note its domain and the error instead of resetting all settings.

First, make sure Global Routing is set to Config and check which configuration file is active. Rules are matched in order: the first matching rule determines the policy, so later, more specific rules won’t be considered for that request. For example, place DOMAIN-SUFFIX,example.com,PROXY before FINAL,DIRECT. FINAL is the fallback when no earlier rule matches. Also distinguish DOMAIN, which matches an exact domain, from DOMAIN-SUFFIX, which matches a domain suffix. After editing, save and make the request again. Check the connection log for the matched rule rather than judging only by whether the page loads.

Start with the screen for your task: use Home to view servers and connection status, Add Server to add an entry, Subscribe to manage subscriptions, Config to choose a configuration, Global Routing to select Config, Proxy, or Direct, and Settings to review settings. The manual keeps these interface labels in English so you can match them directly instead of looking for alternate button names. System language, app language settings, and platform differences may affect what you see. If the screen doesn’t match the instructions, confirm your platform and current screen, then look up the relevant feature in the terminology guide. Don’t rely on icon positions alone.

Check system battery usage for the same period and distinguish foreground activity, background traffic, and a weak network signal. Continuous traffic, many connections, frequent retries, or extended detailed logging can all increase battery use; the VPN indicator alone doesn’t identify the cause. Compare idle and active use under similar network conditions, then check whether the server keeps disconnecting or a test is running continuously. Change one setting at a time and note the result. On Demand can connect based on conditions, but check its triggers if an incorrect setup causes frequent reconnects.

In Settings, check whether On Demand is enabled and whether its network conditions match your current environment. It triggers connections based on system and configuration conditions; it doesn’t decide which rules apply to each website. Global Routing and Config determine how requests are routed. For troubleshooting, temporarily turn off On Demand and test a manual connection. Then restore conditions one at a time and test on different networks. If the connection starts again right after you turn it off manually, check the automatic triggers first. System VPN settings may also be affected by device management policies.