Shadowrocket · Official Guide

Shadowrocket
Setup and Routing Rules

A rule-based proxy client for all platforms: import an existing subscription and configure traffic routing. iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, Android and Linux versions are free.

Current version v2.2.92 · iPhone / iPad: $2.99 one-time; Mac, Windows, Android and Linux: free

First-time setup: add a server and connect step by step →

  • DOMAIN-SUFFIX
  • Global Routing
  • On Demand

GET / Downloads by device

Downloads for all platforms

Check your device and processor first, then open the relevant download instructions. iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, Android and Linux versions are free. Desktop and Android installers are available from this site's download page via the /dl/ path.

Before configuring for the first time, have your own subscription link or server details ready. Installing the client, importing a server and choosing a routing mode are separate steps; downloading the app does not provide a connection configuration.

iPhone / iPad

App Store $2.99 one-time · Other platforms free

Start configuring in this order: Home, Add Server, Config. System requirements are as listed on the App Store page. Before purchasing, check the developer and app ID. If the device has a previous purchase, check your purchased items first; reinstalling and purchasing again are not the same thing.

The first connection prompts you to add a VPN configuration. Allow it only after confirming the request was just initiated in Shadowrocket. If you previously denied it, reopen the connection switch and follow the system prompts. See the download page and getting-started guide for a full explanation of permissions.

Mac

Free · Apple Silicon / Intel

Check the processor type in About This Mac and choose the Apple Silicon or Intel version. Both installers are listed on the download page. Do not infer the architecture from the computer's appearance or purchase year, or treat a mobile App Store purchase as a requirement for Mac.

If a “developer cannot be verified” warning appears on first launch, confirm the file came from this site, then follow the “Allow installation” section on the download page to adjust Privacy & Security settings. Keep your configuration before updating; replacing the app file does not rebuild a subscription.

Windows

Free · 64-bit installer

Get the Windows installer from the download page, then install the app and import your configuration. A Windows download warning and the client's connection result are separate issues: after installation, you still need to select a server, check the mode and test actual access.

If SmartScreen appears, first verify the download source. Once you confirm the file came from this site, follow the installation instructions and select “More info” then “Run anyway.” If the device is managed by an organization, follow its administrator's requirements instead of repeatedly changing system security settings.

Android

Free · arm64

Get the apk from this site's download page. If Android requires permission to install unknown apps, grant it only to the browser you are using for this download. You can turn off the permission afterward, according to your device management preferences. Do not confuse source authorization with VPN connection authorization.

If a download link does nothing when opened in WeChat, use the system browser to visit this site's download page and download again. After installation, import your existing server details, check that the selected entry uses the protocol specified by your provider, then connect for the first time.

Linux

Free · deb / rpm / AppImage

Choose a package format based on your distribution's package manager: use deb for systems with apt, rpm for systems with dnf, and AppImage when you need a standalone executable. The format does not change your subscription; use your own server details.

AppImage requires execution permission. Installation commands, dependency prompts and first-launch steps for deb and rpm are on the download page. Check the actual file path before running a command; do not apply an installation command for another distribution to your system.

READ / Features and configuration index

Connections and routing rules

First confirm that a single server connects successfully, then add rules, On Demand and configuration management. Change one type of setting at a time and keep a working copy of your configuration. This makes it easier to identify whether a problem came from server parameters, DNS or a change in rule matching.

Apply policies in match order

Routing rules determine whether a request uses PROXY, DIRECT or REJECT. In Config, arrange conditions in Rule in the order they should be evaluated. Common domain rules can match a full domain, suffix or keyword; IP-CIDR matches an address range. Once an earlier rule matches, a later rule with the same condition will not rewrite the result. Put specific conditions first, broader ones afterward, and use FINAL for requests with no match. When troubleshooting, also check whether Global Routing is set to Config, so you know the current configuration is being used.

Rule · Order example
DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-KEYWORD,intranet,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXY

CHECK / App and usage details

Verify the app and prepare for first use

Shadowrocket Guide is the official Shadowrocket website and guide. Download sources, purchase records, server details and routing configuration each serve a different purpose. Check each one before use rather than assuming that completing one step completes the others.

  • Shadow Launch Technology Limited
  • App ID 932747118
  • 2 ways to get it: one-time purchase for phones and tablets; other platforms free

Check the developer, icon and ID

On the App Store product page, check the developer name, Shadow Launch Technology Limited, the official icon and app ID 932747118. The icon should match the official icon in this site's header. Do not rely on a search result's name alone. A listing with a similar name may be a different app; if the page does not match these details, return to the product page linked from the download instructions and check again.

The app ID identifies the store listing; the developer name and icon provide two additional checks. Reviewing all three is more reliable than recognizing the name “Shadowrocket” alone. Get desktop and Android versions from this site's download page; mobile store search instructions do not apply to every platform.

Separate the app purchase from server service

One-time app purchase ≠ server plan. iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, Android and Linux versions are free. None of these options includes server service. Shadowrocket is closed-source commercial software for reading existing server details and handling connections according to your configuration. Your service provider supplies the server address, authentication method and service status.

This site does not provide, sell or recommend servers or subscriptions. Before use, have your own working subscription link or server parameters ready. If you do not have them, first confirm their source before continuing with import. Installing the app, allowing a VPN configuration or turning on the connection switch does not provide a working server.

Check store region and system requirements

For iPhone / iPad, system requirements are as listed on the App Store page. If the product page is unavailable in your current store, first check the country or region associated with your Apple ID for the App Store. The app is not available in the mainland China store, so not finding it in search does not necessarily mean the spelling is wrong. Account region and device language are separate settings; changing the system language does not change the store region.

If you need to change your region, first read the region-change requirements in your account settings and address any existing balance, subscriptions or payment information. Then follow the system process. Do not repeatedly try to change regions without checking your account status. The download page explains store availability and how to verify the listing; check the current product page before purchasing.

Switch devices or reinstall

iPhone and iPad share the same purchase record. If you use the original purchasing account and the device meets the requirements, you can redownload the app from Purchased in the App Store. iPhone / iPad: $2.99 one-time; Mac, Windows, Android and Linux: free. When switching devices, check the account and purchase record before buying again based on a search result.

Redownloading the app and restoring your personal configuration are separate tasks. Keep your configuration and any required information before deleting the app. After reinstalling, check the server, active configuration file, Global Routing and On Demand one by one. Even if a file has synced to the new device, confirm it is selected and working; its presence in the file list is not enough.

Choose Global Routing first

The three common modes are configuration, proxy and direct, shown in the interface as Config, Proxy and Direct. Config matches requests against the current configuration's rules; Proxy applies a proxy policy; Direct connects directly. For troubleshooting, switch modes temporarily only when you have a clear test in mind, then restore the original mode so it does not affect later rule tests.

You may also see Scene; check the contents of your own scene settings before using it. Importing a subscription does not choose Global Routing for you, and a rule file only handles routing as expected when the relevant mode and configuration are active. If a domain does not follow the expected route, check the mode first, then the matching rule and final policy.

Handle updates and troubleshooting separately

Update the iPhone / iPad client through the App Store. Get new Mac, Windows, Android and Linux installers from this site's download page. Client updates, subscription refreshes and configuration changes each affect different content. When something goes wrong, first determine whether the app will not open, a subscription will not update or a destination page cannot be reached after connecting, then follow the relevant instructions.

If only one server entry has stopped working, reinstalling the client repeatedly usually will not fix the server-side issue. First check whether the existing subscription can be updated, verify the port and authentication details, then check Connectivity Test and DNS. When reporting an issue to your service provider, include the relevant symptoms. Before sharing a screenshot publicly, hide the full subscription address, password and other authentication details.

First connection checklist: import your own subscription or server details, select an entry, check Global Routing, allow the VPN configuration request you just initiated, turn on the connection switch, and test actual access. Add rules, On Demand and sync one at a time after the basic connection works.

If Windows, desktop or Android installation is blocked by the system, first confirm the installer came from this site, then follow the steps for that platform. Do not disable all security settings just to complete installation; managed devices should follow their organization's requirements. The download page provides installation warnings and their remedies together for easy reference.

NOTES / Guides by topic

Installation and connection troubleshooting

For issues beyond the basic setup, find a guide for the specific prompt you encountered. Note the step where the issue occurred and the interface wording, then choose the relevant article. Avoid changing the server, mode, DNS and rules at the same time; otherwise, it is hard to tell which change affected the result.

Troubleshooting

Why the VPN configuration prompt appears

Learn why the system requests permission on the first connection, why the VPN entry appears in system settings after approval, and what to do if you denied permission or accidentally deleted the configuration. Check system permissions separately from server details to avoid mistaking a permission issue for an expired subscription.

Understand permissions and configuration →
Download and installation

Download Android and allow installation

Learn how to download the apk from this site, allow your browser to install unknown apps and open the app for the first time. If tapping the link in WeChat does nothing, use the system browser. Follow the steps in order and distinguish permission to install from the system permission required to connect.

See Android installation steps →