Shadowrocket FAQ

The iPhone and iPad app costs $2.99 as a one-time App Store purchase; the price shown in your store applies. The Mac, Windows, Android and Linux versions are free. Mac downloads are available for Apple Silicon and Intel. Get desktop and Android installers from this site's download page under /dl/shadowrocket/. Buying the app does not include a proxy service or subscription. Import your own subscription or server details; get subscription links from your service provider.

Open the App Store product page linked here and check the app name, Shadowrocket, the developer, Shadow Launch Technology Limited, and app ID 932747118 in the product URL. Compare the listing with the official icon; don't rely on similar names in search results. For desktop and Android, choose the matching platform on this site's download page and confirm the installer link is under /dl/shadowrocket/. Use the correct download source for each platform.

Shadowrocket isn't listed in the mainland China App Store. Search results depend on the country or region of the Apple Account used for the store, not your device's display language. In Settings, open Media & Purchases for your account, tap View Account, then check Country/Region. To change it, use Change Country or Region on that page and follow the prompts about your balance, active subscriptions and payment details. Review the listed requirements before making a change.

The iPhone and iPad app costs $2.99 as a one-time App Store purchase; the Mac, Windows, Android and Linux versions are free. After switching iPhones or iPads, sign in with the original purchasing account and redownload the app from your App Store purchase history. You usually won't need to buy it again. If the store still shows a price, check the account and store region under Media & Purchases, and verify the app ID in your purchase history. Restoring the app doesn't restore every setting, so save your configs and subscription details before reinstalling.

Yes. iPhone and iPad use the same Shadowrocket App Store listing; check that page for the system requirements. The iPhone and iPad app costs $2.99 as a one-time purchase. The same purchasing account can redownload it on compatible iPhone and iPad devices. The Mac, Windows, Android and Linux versions are free. After installing on iPad, import your own subscription or server details and approve the system VPN configuration when connecting for the first time. Installing the app doesn't configure a connection for you.

Yes. Shadowrocket is free for Mac, Windows, Android and Linux. The iPhone and iPad app costs $2.99 as a one-time App Store purchase. Choose the right platform on this site's download page; installers aren't interchangeable across operating systems. Desktop and Android installers aren't code-signed, so you may see a system warning the first time you open one. After confirming the source, select “More info → Run anyway” on Windows, “Open Anyway” under “Privacy & Security” on Mac, or allow installation from the relevant source on Android when prompted.

On your Mac, open About This Mac from the Apple menu. If it lists a Chip and identifies it as Apple silicon, choose the Apple Silicon version. If it lists an Intel processor, choose the Intel version. This site's download page provides both options; don't guess based on the Mac's appearance or purchase year. If you see an “unidentified developer” warning after installation, confirm the file came from this site, then choose “Open Anyway” under “System Settings → Privacy & Security.” If you chose the wrong architecture, download the matching installer rather than assuming the launch problem is caused by your config.

First confirm that you got the file from this site's download page and that its link is under /dl/shadowrocket/. When SmartScreen shows a protection warning, expand “More info,” check the file you’re about to run, then select “Run anyway.” These installers aren't code-signed; the warning doesn't indicate whether a subscription works. If your device is managed, the button is unavailable, or security software blocks the file, follow your organization's device policy. Don't disable system-wide protection to force the installation.

First confirm that the installer came from this site and matches your Mac's chip type. If you see an “unidentified developer” warning, try opening the app once, then go to “System Settings → Privacy & Security,” select “Open Anyway,” and follow the prompts. If macOS says the app is damaged, download it again and move it to Applications. After confirming the source, you can run xattr -cr /Applications/Shadowrocket.app in Terminal and try again. Use this command only for this exact app path; don't apply it to the entire disk or disable system-wide protection.

On Android, after downloading the installer from this site's download page, you may need to allow your browser or file manager to “Install unknown apps.” You can revoke that source permission after installation. On Linux, choose the deb, rpm or AppImage package for your distribution. For an AppImage, allow it to run as a program in its file properties or use chmod +x to make it executable. For both platforms, confirm the file came from this site's /dl/shadowrocket/ path. On managed devices, follow your administrator's installation requirements.

Get the complete subscription link from your service provider. Check that copying didn't omit query parameters or add spaces or line breaks. Make sure you're using the subscription import option, not entering the subscription URL in Add Server's server address field. Then check your device's date and time, network connection and provider account status. If an update returns a webpage, sign-in page or error message, the content isn't a parseable subscription. Keep the exact error text for troubleshooting. Don't repeatedly delete working entries, and never share a full link that contains credentials.

Use Subscribe when you have a subscription link that updates multiple server entries. Use Add Server when you have the details for one server—its protocol, address, port and authentication settings—and enter them individually. Scan QR Code can read a QR code from your service provider, but check whether it contains a single server or a subscription link. A config file in Config may also include rules and DNS settings, so its URL suffix alone doesn't tell you whether it's equivalent to a server subscription. Check the content type before importing.

Update the subscription from its management screen. After the request finishes, check the entry names, count and current selection. The updated list reflects the provider's response, so entries the provider removed or renamed may disappear; manual changes may also be overwritten by a later update. If an update fails, note the error and check your network and account status before doing anything else. Don't clear the entire group. If your provider changed the subscription URL, replace it with the complete new link and check that your selected server is still available.

A successful import may only mean the URL was saved; it doesn't guarantee that the server list was retrieved. Run an update, then check for errors, collapsed groups or active filters. An empty response, unsupported format, expired link, or a rules config instead of a server subscription can all leave the list empty. Ask your service provider what the link is for and which formats it supports. Don't enter plan details from a webpage, an account page URL or a full HTML page as server information.

Choose the protocol specified by your service provider, then check the server address, port and required authentication fields. Shadowsocks encryption and password, the UUID for VMess or VLESS, and the Trojan password are different fields and aren't interchangeable. If using TLS or additional transport settings, verify the server name, path and other required values too. The address field usually takes a hostname or IP, not pieces of a full webpage URL. Save and test one complete entry before adding others to make input errors easier to isolate.

Config routes connections according to the rules in your current config, making it suitable for everyday use when you have rules set up. Proxy sends traffic handled by the current connection through the selected proxy, which is useful for a short comparison test. Direct connects the relevant traffic straight to its destination, which helps check the underlying network. Proxy won't fix incorrect server settings, and Direct doesn't remove the system VPN configuration. When troubleshooting, change only one mode at a time and visit the same destination; note the difference, then restore your original setting.

Make sure a working server is selected. On the first connection, allow the system to add a VPN configuration and complete any device authentication prompts. If you previously denied permission, check the VPN settings in the system settings and try connecting again. Another active VPN, device management restrictions or incorrect config fields can also cause the connection to end immediately. Disconnect other VPN sessions, restart the app and check the error message one item at a time. Remove the VPN configuration and authorize it again only if you've confirmed it is damaged and saved the information you need.

Disconnect and confirm the device can access the internet on its own, then reconnect and check the selected server. Use Connectivity Test to check the connection, but passing the test doesn't guarantee that every site is reachable. If only domain names fail, check whether the DNS server is reachable and how the current rules route DNS requests. If only certain destinations fail, check the matching rule and policy in the request log. Briefly switch between Proxy and Config to help distinguish server issues from rule issues. Rules match from top to bottom; put FINAL at the end as the fallback.

This manual keeps interface labels in English so you can match them directly: Home shows servers and connection status; Add Server lets you add a server manually; Config handles config files; Settings contains app settings; and Global Routing lets you choose Config, Proxy or Direct. Menu locations can vary by platform and version, so look for the item name rather than relying on a specific button position. If you don't understand a protocol field, check its definition instead of changing TLS, DNS or authentication settings based on the English wording alone.

Battery use depends on traffic, wireless signal strength, how often the server reconnects, the protocol and diagnostic logging—not just whether the connection switch is on. Compare battery usage under similar conditions in your system's battery settings. Check for repeated disconnects and reconnects, and stop continuous tests or detailed logging you no longer need. On Demand starts connections when its configured conditions are met; it isn't a battery-saving switch. While troubleshooting, turn it off temporarily and connect manually. Once stable, restore its conditions one at a time.