Shadowrocket
FAQ

Yes. The iPhone and iPad version is a one-time $2.99 purchase on the App Store. The Mac, Windows, Android, and Linux versions are free. Mac builds are available for Apple silicon and Intel. Get desktop, Android, and Linux installers from this site’s download page; download links are under /dl/shadowrocket/. Do not use an installer intended for another platform.

Open the App Store product page linked on this page first to distinguish a search issue from regional availability. The app is not available on the mainland China App Store. Store availability depends on the country or region of the Apple Account used for purchases, not the device’s display language. Check the region under Settings → Apple Account → Media & Purchases → View Account → Country/Region. If you need to change it, follow Apple’s process for handling account balance, subscriptions, and payment methods.

Open the product page and check the name Shadowrocket, the developer Shadow Launch Technology Limited, and app ID 932747118 in the product URL. The icon should match the official icon in this site’s header; don’t rely on the search title or a rocket image alone. A listing with a similar name but a different developer or app ID is not the same app. Get desktop and Android installers from this site’s download page.

Yes. The iPhone and iPad version is a one-time $2.99 App Store purchase and works on both devices. The Mac, Windows, Android, and Linux versions are free. On iPad, use the Apple Account that made the purchase to open the product page or find the app in your purchased items. Check the App Store page for system requirements. A purchase record is separate from connection settings; after installation, you’ll still need to import your existing subscription or server details.

The iPhone and iPad version is a one-time $2.99 App Store purchase; the Mac, Windows, Android, and Linux versions are free. After switching iPhones or iPads, sign in with the Apple Account used for the purchase and download the app again from your purchased items. If you see a purchase button, check the account, store region, and purchase history before paying again. On other platforms, download the appropriate installer again. Reinstalling the app does not automatically restore your Config or subscriptions, so back them up separately before switching devices.

No. A one-time app purchase is not a service plan. The iPhone and iPad version is a one-time $2.99 App Store purchase; the Mac, Windows, Android, and Linux versions are free. These prices are for the app itself. To connect, you’ll need your own existing subscription or server details; after importing them, check that they’re valid and that the protocol settings match. This official site and manual does not provide, sell, or recommend servers or subscriptions.

Open About This Mac from the Apple menu. If it shows Chip and lists an Apple chip, choose Mac Apple Silicon; if it shows an Intel processor, choose Mac Intel. Both options are in the Mac section of this site’s download page. Choose based on your hardware, not the system’s display language. After opening the DMG, move the app to Applications. If macOS says the developer can’t be verified the first time you open it, confirm the file came from this site, then follow the prompts under Privacy & Security.

First, confirm the installer came from this site’s download page and its URL is under /dl/shadowrocket/. Make sure you’re installing Shadowrocket. If SmartScreen displays a warning, select More info to review the file details, then choose Run anyway. If the device is managed by your organization or security software reports a specific threat, stop and investigate. Don’t disable system-wide protection, and don’t repeatedly change system policies if there’s no option to allow the app.

First, check that you downloaded the correct build for your chip, got the file from this site, and moved the app to Applications. If macOS says the developer can’t be verified, open Privacy & Security in System Settings, find the recent block, select Open Anyway, and confirm. If the app is still reported as damaged, download it again first. Once you’ve confirmed the file’s source, you can run xattr -cr /Applications/Shadowrocket.app in Terminal and reopen the app. This command only changes extended attributes for the specified app; don’t use it on files from unknown sources.

Open this site’s download page in your system browser and get the Android APK. WeChat’s built-in browser may block downloads or the handoff to the installer. In system settings, temporarily allow the browser or file manager you use to open the installer to install unknown apps; you can turn this permission off afterward. If installation still fails, check storage space, whether the download completed, and whether the build matches your device architecture. Stop and verify the file source if you see a specific security warning.

Select an imported server entry, turn on the connection switch, and review the system’s VPN configuration authorization prompt. If permission was denied, check the Shadowrocket entry and any device management restrictions in the system’s VPN settings. Another active VPN configuration may also conflict. Disable the conflicting connection, then authorize Shadowrocket again. Contact your administrator if the device is managed. Back up your Config and existing subscription details before deleting configurations or reinstalling.

This manual uses the interface’s English labels so you can find them as shown in the app: Home displays connection entries, Add Server is for entering server details, Config manages configuration files, Settings opens preferences, and Global Routing selects how connections are handled. If your system offers per-app language settings, check the app settings in the system. Available options depend on your system and app. Don’t change protocol fields, policy names, or rule keywords just to change the display language.

Make sure you copied your complete subscription URL, not an information or login page. Check for leading or trailing spaces, line breaks, or missing characters. Then check whether your local network can reach the URL and whether the subscription is still valid. If you see a format error, check whether the response is actually a webpage, an error message, or a page requiring login. Keep the exact error text and investigate one issue at a time; don’t repeatedly import everything in bulk. Hide credentials and personal information in the URL before asking someone for help.

Updating a subscription refreshes its entries using the content returned by the remote service, so names, addresses, and available entries may change. Before updating, note the currently selected entry and back up any important fields you edited manually. Afterward, check whether the selected entry still exists or was replaced, and whether policies still reference the correct name. If an old entry disappears, don’t assume the app is at fault; check the subscription response and compare it with the documentation for your existing service.

A successful QR code scan doesn’t guarantee that the code contains importable server details. First identify whether it contains a single server link, a subscription link, or an ordinary webpage, then use the appropriate import option. A blurry image, cropped screenshot, or expired code can also cause problems. If you’re scanning from your photo library, check system photo access permissions. After importing, check the protocol, address, and port in Home; a scan-complete message alone doesn’t mean the connection is configured.

Choose the protocol based on your existing server details, then check the server address, port, and authentication fields one by one. Depending on the protocol, you may also need to enter encryption, UUID, TLS, SNI, transport, or path settings. Don’t copy settings from a different protocol. Keep extra spaces out of the address field, and enter the port and authentication details as provided. After saving, run Connectivity Test before trying a real request. If the test fails, compare each field with the original details instead of changing several at once.

A subscription usually updates a set of server entries. A Config organizes rules, policies, and other settings; they serve different purposes. Importing a subscription doesn’t mean the right Config is selected, and switching Config doesn’t automatically update server entries. If entries are present but traffic isn’t routed as expected, check the selected entry in Home, the active file in Config, and the Global Routing mode separately. Don’t treat these three states as one.

Export the current Config, and separately record how to import your existing subscriptions and any manually entered server details. Check the exported file to see exactly which fields it contains. Store the backup somewhere private and protected; don’t upload it to a public page. After installing on the new device, restore the configuration, check the subscription, selected entry, and Global Routing, then authorize and test the connection. Backups may contain authentication details, so remove sensitive fields before sharing them.

Config applies the rules in the active configuration and is suited to everyday use when your rules are ready. Proxy routes traffic through the proxy and can help you check a proxy connection. Direct helps test direct connectivity. When troubleshooting, change only one mode at a time and test the same destination each time. Proxy doesn’t automatically fix connection problems, and Direct doesn’t restore all network settings. Actual behavior still depends on system routing, DNS, and the active configuration.

Disconnect first and confirm your local network can access the internet. Then check the selected server entry in Home and the Connectivity Test result. Reconnect and compare Direct, Proxy, and Config using the same destination. If only Config fails, check the rules and policy references first. If Proxy fails too, check the server settings and service status. If domain requests fail while the basic connection works, check DNS settings. Also make sure the device’s date, time, and time zone are correct.

No. A single timeout isn’t enough to draw that conclusion. The test target, network path, and server response can all affect the result. Once your local network is working, run the test again and check the address, port, authentication fields, TLS, and system time. Comparing the same entry on different local networks can help narrow down the cause, but don’t change the protocol and rules at the same time. Record the exact error and conditions. Passing one test doesn’t guarantee that every domain, protocol, or rule path will work.

First, make sure Global Routing is set to Config and that the active file is the one you just edited. Rules are generally matched from top to bottom, so a broader rule earlier in the list may match first. Then check the syntax of keywords such as DOMAIN, DOMAIN-SUFFIX, GEOIP, and IP-CIDR, and confirm that each referenced policy exists. PROXY, DIRECT, and REJECT are actions, not server addresses. If no earlier rule matches, check whether the fallback action in FINAL is what you expect.

Note the current On Demand conditions, then temporarily turn off On Demand and connect manually on the same network. If the manual connection is stable, check the On Demand conditions, Wi-Fi and cellular switching, and system VPN status first. If it still disconnects, investigate the server and local network. After making changes, enable one condition at a time to avoid multiple conditions triggering in turn. Some settings on managed devices can’t be changed by the user; ask the administrator to check them instead of repeatedly deleting system configurations.

Check background activity for the same time period in system battery settings, and look for frequent reconnects, continuous tests, or heavy background transfers. Weak signals and network switching can also increase battery use, so connection duration alone isn’t enough to judge it. Data and system statistics may use different scopes, time windows, and reset methods; they aren’t directly comparable as if they were the same bill. For troubleshooting, keep the network unchanged, stop active tests, and record usage over a period of time. Save any data you need for comparison before clearing statistics.