OFFICIAL MANUAL · GLOSSARY
Look up terms for the interface, protocols, rules, configuration, and installation. First identify whether a term refers to an entry point, connection method, or rule action, then adjust the relevant setting.
This page is the glossary for the Shadowrocket Official Manual. For setup steps, see Getting Started; to get the app, visit Download Shadowrocket for All Platforms.
INTERFACE
Interface names identify where an action is performed; they are not rule actions. In particular, distinguish Config under Global Routing from the Config page used to manage files.
Home is the main screen for viewing server entries, selecting a connection, and toggling the connection on or off. An entry in the list means its connection details have been saved, not that a connection is active. When troubleshooting, check the selected entry, connection toggle, and actual request results separately. Do not assume a server is working just because it appears in the list.
Global Routing determines how traffic is handled overall: Config follows the configuration, Proxy uses proxy mode, and Direct connects directly. Config applies the rules in the current configuration; Proxy uses proxy mode; Direct uses direct mode. These options are not the same as the uppercase PROXY and DIRECT rule actions. Check this setting before deciding whether a specific rule is working.
On Demand starts or maintains a connection when its configured conditions are met. Available conditions depend on the options shown in the current interface. It does not create servers or fill in missing authentication details. To stop a connection temporarily, check the On Demand conditions too; the system may reconnect when those conditions are met again.
Add Server lets you create a server entry manually. Choose the protocol based on the server details you already have, then enter the address, port, and authentication fields. You cannot infer a server's protocol from its name; TLS, transport, and server name must also match the remote setup. Saving means the form was accepted, but you still need to test the connection.
Connectivity Test checks connectivity under specific conditions. Use the test target and method shown in the current settings. A successful test does not prove that every website or app is reachable, and a failed test does not necessarily mean the authentication details are wrong. For meaningful comparisons, keep the test method, network, and target consistent.
DNS resolves domain names to IP addresses, which are usually needed before a connection can be made. The resolution path, cache, and returned address can all affect subsequent connections, so troubleshoot DNS issues separately from server connection issues. After changing DNS, retry the request and check the logs to confirm how it was resolved instead of relying only on whether the setting was saved.
PROTOCOL
The protocol must match the remote server; changing a dropdown selection cannot turn one type of server into another. Speed, battery use, and reliability depend on the network and configuration, so protocols cannot be ranked by name alone.
Shadowsocks is built around encrypted proxy transport. Common connection fields include the server address, port, password, and encryption method. The encryption methods at both ends must be compatible; a correct password with a mismatched method can still cause the connection to fail. Check all parameters after importing an entry, and do not treat its display name as a protocol version or performance guarantee.
VMess is a proxy protocol with authentication, and the UUID is one of the key connection identity parameters. The transport, TLS, and related path settings must also match the server configuration. A significant device clock offset can affect authentication too. When troubleshooting, check the whole set of fields instead of just pasting the UUID again.
VLESS has a streamlined authentication and protocol design, but its name does not mean the connection is confidential. Actual security depends on the transport and security layers used with it. Enter the UUID, server name, and other details as provided by your service provider. VMess settings cannot be converted to VLESS just by changing the protocol name.
Trojan typically runs over a TLS connection. The password is used for authentication, while the server name and certificate validation settings affect whether a secure connection can be established. The connection address and the name covered by the certificate may serve different purposes, so enter them separately based on the details you have. If you see a certificate error, check the name, device clock, and server certificate rather than disabling validation.
Hysteria2 is based on QUIC and relies on UDP, with transport handling designed for different network conditions. Actual performance still depends on packet loss, congestion, server load, and device state; it does not guarantee a fixed speed. If UDP is restricted on your network, check the network conditions before troubleshooting authentication or bandwidth settings.
WireGuard identifies peers using public keys and carries IP traffic through a tunnel. Its configuration includes keys, endpoints, tunnel addresses, and routing scope. The private key is sensitive: remove it before sharing a support request, and do not confuse it with the public key. Establishing a connection and routing traffic correctly are separate steps; after a successful handshake, check that the target traffic follows the expected path.
HTTP and SOCKS5 are common proxy interfaces with different request formats and authentication options. Their names alone do not guarantee an encrypted connection between the client and proxy server. A destination website using HTTPS does not mean the connection to the proxy uses TLS. Check the actual server capabilities to confirm UDP support and whether authentication is required.
RULE & POLICY
A rule specifies what to match and what to do when it matches. The first part is the condition; the second is the policy. More specific conditions usually belong before broader ones.
Rule refers to a routing rule in a configuration. Rules are usually checked one by one from top to bottom, and the policy specified by the first matching rule is applied. More rules do not necessarily make routing more precise: a broad rule near the top may prevent a later, more specific rule from matching. To analyze a request, first confirm that Global Routing is set to Config, then check the rule and policy that actually matched.
DOMAIN matches an exact domain; DOMAIN-SUFFIX matches a domain and its subdomains; DOMAIN-KEYWORD matches a keyword contained in a domain name. For example, DOMAIN-SUFFIX,example.com,PROXY sends the matching domain range to the PROXY policy. Keyword rules can match a broad range, so avoid short terms that may match unrelated domains.
GEOIP classifies a destination using an IP geolocation database; it does not use a webpage's language or a website's name. Database records may not reflect the actual server location, and one website may use addresses in several regions. GEOIP uses different matching information from domain rules, so when troubleshooting, check what information is available for the request.
IP-CIDR matches IPv4 address ranges, while IP-CIDR6 matches IPv6 ranges. The prefix length after the slash determines the range covered; a larger number usually means a smaller range. A domain can resolve to multiple address types, so an IPv4-only condition may not cover an IPv6 connection. Check the actual resolution results to see whether a rule should match.
FINAL handles requests that do not match any earlier rule and should go at the end of the rule list. For example, FINAL,DIRECT sends all remaining requests to DIRECT; it does not change requests that already matched an earlier rule. If many requests reach FINAL, check whether earlier rules cover the targets and whether the intended configuration is selected.
PROXY sends a matching request to the proxy policy, DIRECT connects to the destination directly, and REJECT blocks the matching request. These are rule actions and should be distinguished from the Proxy and Direct options under Global Routing. REJECT depends on the available matching conditions; domain or IP rules may not distinguish different content on the same domain.
Latency is the time a request and response take under a specific test method, usually measured in milliseconds. It cannot be directly converted to available bandwidth or used to predict sustained downloads or video performance. For comparisons, use the same test method and consider packet loss, variation, and real-world requests instead of choosing only the entry with the lowest number.
SUBSCRIBE & CONFIG
A server entry describes where to connect; a config file describes how to handle requests. Updating a server list and switching configurations are separate actions, so do not confuse their results.
A subscription link retrieves and updates a set of server entries. Get the link from your service provider. It may contain personal authentication details, so do not share it in screenshots or support requests. An update can fail when the link cannot be reached, the response format is unsupported, or the content cannot be parsed. Check the error message to identify the cause instead of assuming all servers are unavailable.
A server is a remote endpoint the client connects to. Its saved entry usually includes the protocol, address, port, and authentication details. A server entry is also commonly called a “node,” but that does not mean the client includes a service. The display name is for identification; it does not confirm the server's physical location, available bandwidth, or validity period. Check those details with your service provider.
Config can refer to the configuration management page; .conf is a common config file extension. A file can contain sections such as General, Rule, and Host. Config under Global Routing means handling traffic according to configuration rules. The names are the same, but their purposes differ. After downloading or editing a file, make sure the intended configuration is selected and test an actual request to confirm it is working.
General holds global settings, including DNS settings used by the configuration; Host defines local domain mappings. Host changes the resolution result for specific domains, not the routing policy applied after a match. A fixed address kept over time may conflict with changes to the server address, so check whether the mapping is still needed if problems arise.
URL Rewrite processes request URLs according to specified conditions; its behavior depends on the matching expression and action. It is not a universal tool for replacing content on every webpage. Whether a rule matches depends on the information visible in the request and the relevant processing conditions. Before making changes, understand the rule's target and scope. Do not use rewrite settings from an unknown source for everyday connections.
Scan QR Code reads text from a QR code. Whether it can be imported depends on whether the link format and fields it contains are supported. A QR code is just a way to carry information; it does not turn an ordinary webpage address into a server configuration. After importing, check the protocol, address, and parameters, and avoid sharing QR codes that contain authentication details.
PLATFORM & INSTALL
Shadowrocket is available for iPhone, iPad, Mac, Windows, Android, and Linux. App access, processor architecture, and system installation prompts are separate considerations; check the details for your device.
The App Store is where you get the iPhone / iPad version. Purchased helps you find the app record associated with the Apple ID used to buy it; redownloading is still subject to store availability and device compatibility. To confirm the official app, check the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118. System requirements are as listed on the App Store page. The iPhone / iPad version costs $2.99 as a one-time App Store purchase. The Mac / Windows / Android / Linux versions are free.
These names distinguish Mac processor architectures. Check the chip or processor information in About This Mac, then choose the matching installer. This site provides separate DMG installers for Apple Silicon and Intel Macs; you cannot reliably identify the architecture from the computer's appearance or purchase year. If macOS blocks the app on first launch, confirm it came from this site and follow the installation instructions below.
Allow Installation means confirming that an app can run in a system prompt or security settings after checking its source. Desktop and Android installers are not code-signed; get installers only from this site's /dl/shadowrocket/ directory. On macOS, go to Privacy & Security and select “Open Anyway.” In Windows SmartScreen, select “More info → Run anyway.” On Android, allow installs from the current download source. On Linux, grant the AppImage execute permission. See the installation approval guide for full steps. Do not disable system protection globally.
The iPhone / iPad version costs $2.99 as a one-time App Store purchase. The Mac / Windows / Android / Linux versions are free; the amount charged locally is shown on the store page. A one-time app purchase is not a service plan: buying the app does not create a subscription link, server account, or service validity period. Your service provider manages any existing subscription; the client imports the details and handles connections according to your settings.