Shadowrocket FAQ

Yes. The iPhone and iPad version costs $2.99 as a one-time App Store purchase. The Mac, Windows, Android, and Linux versions are free. Mac downloads are available for Apple silicon and Intel; choose other downloads based on the platform details on the download page. Desktop and Android installers are provided on this site under /dl/shadowrocket/. You’ll still need your own subscription or server details to connect.

No. A one-time app purchase does not include a server subscription. The iPhone and iPad version costs $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. These options provide the app itself. To connect, use the subscription, server address, port, and authentication details supplied by a service you already use. This site does not provide, sell, or recommend servers or subscriptions, and its import guides do not configure service accounts for you.

Open Shadowrocket’s App Store product page from the download page to rule out a spelling mistake or missed search result. The app is not currently available in the mainland China storefront. On your device, check the account’s storefront under Settings → Apple Account → Media & Purchases → View Account → Country/Region. If you need to change it, follow Apple’s official account process and first resolve any restrictions involving your balance, active subscriptions, or Family Sharing. Your device’s language or region setting alone does not determine its App Store storefront.

On the product page, check the name Shadowrocket, developer Shadow Launch Technology Limited, and app ID 932747118. Compare its icon with the official icon in this site’s header. The iPhone and iPad version costs $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. Don’t mistake a free listing with the same name for this app. Get desktop and Android downloads from this site; their installer URLs should be under /dl/shadowrocket/.

On iPhone or iPad, sign in with the Apple Account used for the original purchase, then find Shadowrocket in your App Store purchased apps and download it again. The purchase works on both devices. The iPhone and iPad version costs $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. If the App Store still shows a price, check your signed-in account and storefront, then review your purchase history before paying again. Reinstalling the app does not restore its configuration; migrate your subscriptions and settings separately.

Yes. Get Shadowrocket for iPhone or iPad from its App Store product page. The iPhone and iPad version costs $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. Check the App Store product page for the iPad system requirements. If the install button is unavailable, check your current OS, storefront region, and device management restrictions. Keep a copy of your subscription and any required server details so you don’t migrate the app without its connection settings.

Open About This Mac from the Apple menu. If it lists an Apple chip, choose the Apple silicon version; if it lists an Intel processor, choose the Intel version. The download page has a separate DMG button for each—there’s no need to guess based on your Mac’s appearance or purchase year. If you see “cannot verify the developer” after installation, first confirm the installer came from this site, then choose “Open Anyway” under System Settings → Privacy & Security. If macOS says the app is damaged, follow the installation guidance instead of repeatedly downloading different builds.

First confirm the file came from this site’s download page and a /dl/shadowrocket/ URL. On the Windows SmartScreen warning, select “More info → Run anyway.” If Mac says the developer cannot be verified, go to “System Settings → Privacy & Security” and select “Open Anyway.” If macOS says the app is damaged and you’ve moved it to Applications, open Terminal and run xattr -cr /Applications/Shadowrocket.app, then try again. Only follow these steps for a file whose source you’ve confirmed. On a managed device, contact your administrator first.

On Android, download the arm64 installer from this site, then follow the system prompt to allow the browser or file manager you used to open the file to install unknown apps. You can turn off this permission after installation. On Linux, choose a deb, rpm, or AppImage package for your distribution. For an AppImage, run chmod +x on the downloaded file before launching it. Don’t force a package format made for one distribution onto another. If you see an architecture compatibility error, check your device architecture against the download page.

Make sure a server is available to select on Home, then complete the VPN configuration authorization required for the device’s first connection. On iPhone or iPad, check the VPN configuration in Settings and confirm permission hasn’t been revoked. Also temporarily disconnect any other service using the system VPN and try again. Work or school management policies may restrict access on managed devices. If the switch still won’t turn on, note the exact system message and restart the device before trying again. Don’t delete every configuration or reset network settings as a substitute for diagnosing the problem.

These guides use the interface’s original labels: Home is where you select a server and connect; Add Server adds connection details; Subscribe is for subscription entries; Config is for configuration files; Global Routing controls how traffic is handled; and Settings contains app settings. Find each item by its label, then check the terminology guide for its meaning. Menus may be in different places on different platforms, and available interface languages depend on the current version. Don’t change server details just because a button has moved.

Update the iPhone and iPad app through the App Store. For desktop and Android, get the platform-specific installer from this site’s download page; if the system blocks the first launch, follow the installation guidance there. Updating Subscribe reloads the server list from a service you already use; it does not update the app itself. Before updating, save any necessary settings and note the currently selected server. Afterwards, check that your subscription is still listed and that the selected server remains available.

Get the complete Shadowrocket subscription URL from a service you already use. On Home, open Add Server and choose Subscribe. Enter the link in the URL field, save it, then update the subscription. Return to the list to check whether servers from that source appear, and select one to test. Before pasting, check for spaces or line breaks at either end. Don’t use an account management webpage URL as a subscription URL. Subscription links may contain access credentials, so don’t share them in public comments or screenshots.

Check the link, the response, then your account status. Copy the full link again and check for missing characters, incorrect escaping, or trailing spaces. Confirm the service returned subscription data—not a login page, error message, or redirect. Finally, check that the subscription is still active in your service account. If the import fails, keep your existing working list; don’t clear all servers right away. If you report the issue, include the error message and steps to reproduce it, but hide any credentials in the subscription URL.

Subscribe refreshes a source’s list using the data currently returned by the service. If the service removes, renames, or changes servers, some previous entries may disappear and the selected server may no longer work. Confirm which subscription you updated, check the returned list and your account status, then select an available server and test it. List size alone doesn’t show whether an import succeeded. If you imported multiple sources, similar names don’t mean their addresses, ports, or authentication details are identical.

In Add Server, select the correct protocol, then check the address, port, and authentication details against the information from your service. For Shadowsocks, the encryption method and password must match. For Trojan, enter the password, TLS, and SNI settings as specified by the service—don’t guess based on the website domain. Watch for invisible spaces and full-width punctuation when copying details. If the service provides an import link designed for Shadowrocket, use it where possible, then check the important fields. Don’t turn off certificate verification to mask incorrect settings.

Give each Subscribe entry a note that identifies its source, and confirm which source you’re updating before you start. Adding the same link repeatedly creates duplicate lists. Before deleting an entry, compare its subscription URL and note, then keep the one you actually need. Manage manually added servers separately from subscription-generated ones to avoid accidental deletion. Record the entries that currently work, then update and test them one at a time. If a service changes its link, confirm the new one works before removing the old source rather than keeping several indistinguishable entries.

Treat subscription URLs, server passwords, authentication tokens, and QR codes containing these details as private. When moving them to your own devices, use a controlled transfer method; afterwards, check whether temporary files or images remain in shared locations. For troubleshooting, you can share the protocol, exact error message, Global Routing selection, and checks you’ve already tried, but redact credentials from full addresses. Config files may also contain private domains, Host mappings, or authentication details. Hiding only the server name isn’t enough to safely share the whole file.

Config applies policies using the rules in the currently enabled configuration. Proxy sends traffic handled by the app through the proxy path, which can help you briefly check whether a server works. Direct connects straight to the destination, making it useful for comparison with your device’s regular network behavior. For everyday rule-based routing, use Config and make sure the right configuration is enabled. Proxy won’t fix incorrect server settings, and Direct doesn’t turn off system VPN authorization. Restore your preferred mode after troubleshooting.

Disconnect the app first and confirm the device itself can access the internet. In particular, check whether public Wi-Fi requires a browser sign-in. Reconnect and test the selected server, then temporarily switch to Proxy for comparison. If Proxy fails too, check the server status, authentication details, and subscription validity first. If only Config fails, review the rules and DNS. Change one thing at a time and note the specific domain and error message. “Connected” usually means the VPN tunnel is established; it doesn’t guarantee that the remote server or destination website is reachable.

Check that Global Routing is set to Config and that the configuration you just edited is enabled. Rules usually match in order, so an earlier match determines the policy. Put specific DOMAIN-SUFFIX rules before broader rules that could override them, and leave FINAL at the end. For example, DOMAIN-SUFFIX,example.com,PROXY applies to that domain and its subdomains. Save the changes, make the request again, and check the match log. A webpage may request several domains, so don’t look only at the address bar.

Connectivity Test reports the result for its particular test method and destination; it doesn’t replace testing websites directly. Check whether the failing site matches the expected policy, then look at DNS resolution, TLS errors, and the site’s own status. If other sites work, you can compare with another server from the same subscription, but don’t change DNS, rules, and protocol settings at the same time. If only one app fails, check whether it uses a separate connection method or cached data. Record the specific request rather than relying only on the server test result.

Compare similar time periods in your system’s battery usage stats and distinguish screen use, background downloads, and activity related to the app. A VPN connection handles traffic for other apps too, so the app’s name in the battery report doesn’t necessarily account for all the drain. During troubleshooting, reduce continuous speed tests, overly frequent subscription updates, and long periods of detailed logging. Check whether a weak signal or unstable server is causing repeated reconnections. Change one factor at a time and compare similar network conditions and usage; don’t draw conclusions from a single brief reading.

Check whether On Demand is enabled in Shadowrocket and in the system VPN settings. If the conditions for an on-demand connection still apply, manually disconnecting may cause it to reconnect. To pause it, first turn off the relevant On Demand setting, then disconnect. Check Wi-Fi, cellular, and other trigger conditions separately so automatic reconnection isn’t mistaken for a faulty switch. If the device has a management profile, confirm whether an administrator controls these settings. When you’re done troubleshooting, restore only the conditions you need.