Official manual · All platforms

Shadowrocket
Guide

Name: Shadowrocket
Price: 2.99 USD
Author: Shadow Launch Technology Limited

A rule-based proxy client for every platform: import an existing subscription or server details and route traffic with rules. iPhone / iPad: $2.99 one-time purchase on the App Store; Mac, Windows, Android and Linux versions are free.

Download Shadowrocket All platforms →

Current version 2.2.92 · iPhone / iPad $2.99 one-time; Mac, Windows, Android and Linux versions free

First-time setup: import and connect →

Config · Rule · On Demand

Understand scope before configuring

Shadowrocket core features

For a first setup, verify a connection with one existing server entry before adding rules and automatic connection conditions. Server entries determine where to connect; Config determines which policies apply to requests; Global Routing determines whether the current configuration is in use. These serve different purposes: changing servers does not rewrite rules, and importing a configuration does not establish a connection. Understanding these layers separately makes it easier to identify whether to check parameters, rules or system connection status when something fails.

Shadowrocket supports protocols including Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard and Hysteria2. Choose a protocol that matches the actual settings of your existing server. The same address with a different Type, port or transport parameter can produce a completely different result. For field definitions, see the protocol reference.

Global Routing: choose a mode

View Global Routing on Home. Config uses the current configuration's Rule to route traffic; Proxy sends proxyable traffic through the selected server; Direct connects without a proxy server. For everyday rule-based routing, select Config and confirm which configuration file is active. Proxy can help determine whether rules affect the result, but it is not a switch that fixes every connection issue. After changing modes, send a new test request instead of judging by an existing connection.

Interface options · not an app screenshot

Global Routing
  Config  → Rule
  Proxy   → selected server
  Direct  → direct connection

On Demand: connection triggers

On Demand starts the system VPN connection when specified conditions are met; it is separate from request routing with Rule. First connect manually and verify that an existing server works, then check the On Demand network conditions in Settings. To adjust behavior for Wi-Fi, review each network name and exception. After enabling it, test again when the network changes and observe the system connection status. It cannot correct a wrong password or port, or restore an unavailable server. If problems persist, turn off automatic triggers and return to manual connection troubleshooting.

Settings path

Settings
  On Demand

Home
  Global Routing
  Connectivity Test

Rule: order determines the match

Review Rule in Config. Rules are generally evaluated from top to bottom, and the matching policy is applied. DOMAIN matches a full domain, DOMAIN-SUFFIX covers a domain and its subdomains, IP-CIDR describes an address range, and FINAL handles requests that did not match earlier rules. Place narrower exceptions before broader rules, then reconnect and check which rule matched. example.com in this example is for syntax only. PROXY, DIRECT and REJECT mean proxy, direct connection and reject; they do not include usable server details.

Rule syntax example

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECT

Subscribe: maintain existing entries

An existing subscription can reduce the work of entering servers one by one. Get the subscription URL from your provider, choose Subscribe under Add Server, paste the full address, save, and update the list. After importing, check that the number and types of servers and required fields match your existing details. A successful subscription update does not mean a connection test has passed. Subscription URLs may contain credentials; keep them on your own devices and obscure the full link in screenshots. If entries disappear after an update, first check the subscription status and response to avoid duplicate records that are hard to distinguish.

Check interface fields

Add Server
  Type → Subscribe
  URL
  Remarks

Home
  SERVER

Config: change one category at a time

Config manages the configuration files used for connections. General, Rule and Hosts have different roles. Before importing, understand the file's source and purpose; keep a working copy before editing, then confirm that Global Routing is set to Config. Adjust and verify one rule before changing DNS or other settings, so multiple changes do not make the cause difficult to locate. To sync files across personal devices with iCloud, check the account, sync switch and whether the file has arrived. Configuration sync and restoring an app purchase are separate processes and cannot replace each other.

Configuration sections

Config
  General
  Rule
  Hosts
  URL Rewrite
  HTTPS Decryption

Diagnostics: narrow down the cause by layer

If a connection fails, run Connectivity Test on Home, check Type, Host, Port, Password and transport parameters, then look for clues in Diagnostics under Settings. Data can show traffic changes, but traffic does not prove a request succeeded, and a latency test passing does not confirm every protocol feature works. Use one server and one test target while troubleshooting; change one setting at a time and record the result. If failures occur only after changing networks, check the current network, DNS and system time rather than immediately reinstalling the app.

Diagnostics paths

Home → Connectivity Test
Settings → Diagnostics
Settings → Test Method
Data

From a manual connection to a stable configuration

To add an entry, fill in the details manually with Add Server or use Scan QR Code to read your existing server information. Either way, reopen the saved entry and check Type, Host and Port. A successful QR scan only means the contents were read; it does not show that the remote service is available. For entries using TLS, also check the server name and certificate settings. Do not weaken validation just to bypass an error.

To verify a connection, first confirm that the system allows a VPN configuration, then select an existing server, connect and send a new request. If the test passes but one app still fails, check Global Routing, Rule matches and DNS. If all requests fail, start with server parameters and the network environment. This order reduces repeated switching between settings and makes it easier to describe completed checks when asking for help. See the getting started guide for the full process, or read the feature guide to understand each capability.

Choose how to get the app by platform

Shadowrocket downloads for every platform

iPhone / iPad: $2.99 one-time on the App Store; Mac, Windows, Android and Linux versions are free. Desktop and Android installers are available through the /dl/ paths on this site's download page, not as direct links on the homepage.

Check both the operating system and processor architecture for your device. Existing subscriptions and server parameters can still be used as configuration references, but system permissions, file locations and first-launch prompts vary by platform. Follow the relevant download-page section rather than applying installation steps from another system.

iPhone / iPad

$2.99 one-time on the App Store; Mac, Windows, Android and Linux versions are free. On a mobile device, import an existing subscription, check Global Routing and connect according to rules. iPhone and iPad can restore the app with the same purchase account. Check the App Store page for system requirements.

Before purchasing, check the account's storefront and the app ID. If you have purchased the app before and changed or reinstalled a device, look for Shadowrocket in Purchased. On the first connection, follow the system prompt to allow a VPN configuration. App purchase records and your subscription status are managed separately.

View iPhone / iPad access steps

Mac

Free · Apple Silicon / Intel; iPhone / iPad cost $2.99 one-time on the App Store, and other platforms are free. Check the chip or processor in About This Mac, then choose the matching dmg. Installers for both architectures are listed on the download page; do not guess based on the model name.

If the first launch says the developer cannot be verified, confirm that the file came from this site, then choose Open Anyway in Privacy & Security in System Settings. For other prompts, check the installation approval table instead of repeatedly downloading a file for the wrong architecture.

View Mac installers

Windows

Free; iPhone / iPad cost $2.99 one-time on the App Store, while Mac, Windows, Android and Linux versions are free. The download page provides a 64-bit Windows installer. Check the system type and save location, then import your existing configuration after installation.

If SmartScreen blocks the app, first confirm that it was downloaded from this site. If confirmed, select More info → Run anyway. Organization-managed computers may prevent users from overriding this prompt; follow the device management requirements instead of repeatedly changing system security settings.

View Windows installation steps

Android

Free; iPhone / iPad cost $2.99 one-time on the App Store, while Mac, Windows, Android and Linux versions are free. The Android version uses an arm64 apk; check your device architecture before downloading. If tapping the link in WeChat does nothing, open this site's download page in the system browser and try again.

During installation, allow the browser currently in use to install unknown apps, then disable the permission afterward if desired. The first connection requires system VPN authorization. Installing the app does not provide server details; import your own existing entries.

View Android download steps

Linux

Free · deb / rpm / AppImage; iPhone / iPad cost $2.99 one-time on the App Store, and other platforms are free. Choose deb for Debian- and Ubuntu-based systems, rpm for Fedora-based systems, or AppImage for other distributions as appropriate. Check the processor architecture too.

Install deb and rpm packages with your distribution's package manager. AppImage requires execution permission first. Before running terminal commands, confirm the directory and exact file name. Commands and permission instructions are maintained on the download page; do not run commands from unknown sources.

View Linux package formats and installation

View all platforms →

Verify the app and understand its scope

Purchase records, app identity and configuration data

Shadowrocket is a closed-source commercial app. This is the official Shadowrocket site and manual. Download options vary by device, while connection setup depends on your existing subscription or server details. Verify the app's identity first, then handle purchase restoration and configuration import separately to avoid mixing unrelated issues.

Developer Shadow Launch Technology Limited
App ID 932747118
2 download options · App Store and installers from this site

Check three details on the App Store

When getting the app for iPhone / iPad, confirm the name is Shadowrocket, check the developer Shadow Launch Technology Limited, and verify app ID 932747118 on the product page. The official icon is a rocket outlined in blue and purple on a white background, matching the icon in this site's header. A similar name alone does not confirm identity, and search ranking is not a reliable check. The download guide links to the relevant product page so you can compare the search result with the listing you open.

Store visibility depends on the account's region and access restrictions. If the app is unavailable in the mainland China storefront, first check the account's storefront region instead of repeatedly changing search terms. Also check content restrictions, age ratings and account status. Changing an account region may affect its balance, subscriptions and payment methods, so review Apple's stated requirements first. A device's language or time zone is not the same as its App Store account region; distinguish these settings before making changes.

Two price tiers and restoring with the same account

On the US App Store, Shadowrocket costs $2.99 one-time for iPhone / iPad; other storefronts show local currency. Mac (Apple Silicon and Intel), Windows, Android and Linux versions are free. With the same purchase account, iPhone and iPad users can redownload the app from Purchased; switching between these device types does not require buying it again. When restoring, check the account used for Media & Purchases, not just whether the device is signed in to iCloud.

Restoring a purchase restores eligibility to get the app; it does not automatically restore locally saved server entries, passwords or configuration files. Save your configuration data before changing devices, and verify that all synced content has arrived on the new device. If a purchase prompt appears after redownloading, check the account and purchase record first, then follow the restoration section of the download guide. Do not pay again before finding the cause. Check the App Store page for iPhone / iPad system requirements.

Manage the client and connection resources separately

App purchase ≠ service plan. The app reads server parameters supplied by the user, applies rules and establishes connections. Remote server availability, subscription validity and access credentials are separate requirements. This site does not provide, sell or recommend nodes or subscriptions. If you do not already have server details, you can read about the interface and rules, but installing the app does not create remote connection resources.

Subscription links, server passwords and QR codes may contain personal access credentials. Before importing, confirm the details come from your own provider or server configuration. When reporting a problem, include only the protocol type, symptoms and checks already completed; hide full links and passwords. example.com in the technical reference is only for explaining fields or matching behavior, not a real connection address. Policy names in rule examples do not mean that the corresponding server has been configured.

Updates and troubleshooting

Manage iPhone / iPad app updates through the App Store. For Mac, Windows, Android and Linux, get the current installer from this site's download page. Keep a working configuration before updating, and read the first-launch and permission notes for your platform. If connection problems appear after an update, first check that the selected server, Global Routing mode and configuration file are still consistent. Review the error details instead of assuming that the update caused every problem.

Keep troubleshooting conditions consistent: use the same network, server and test target. Confirm the system time, then check the address, port, password and transport parameters. If only certain requests fail, check Rule and DNS. This helps distinguish an unreachable server, mismatched parameters, an incorrect rule match and app permission issues. For more checks, choose the relevant category in the FAQ rather than changing every setting at once.

Guides · browse by specific issue

Installation and rules guides

These guides cover Linux package formats, rule matching and App Store searches. Choose the scenario that matches your current issue and follow the checks in order. System prompts during installation and protocol errors during connection are different kinds of issues.

Download & Install

Installing Shadowrocket on Linux: choose deb, rpm or AppImage, use apt or dnf, and set execution permissions

Choose a package by distribution: use deb with apt on Debian/Ubuntu, rpm with dnf on Fedora-based systems, or AppImage on other distributions after adding execution permission. Check the package format, architecture and local file path to avoid copying commands intended for another distribution.

Read the Linux installation guide →

Rules & Routing

Shadowrocket rule syntax for beginners: what DOMAIN, DOMAIN-SUFFIX, DOMAIN-KEYWORD, GEOIP, IP-CIDR and FINAL match

Learn what six common rule keywords match and how to write them, how rules are evaluated from top to bottom, and what the PROXY, DIRECT and REJECT policies mean. Distinguish full domains, domain suffixes and address ranges before arranging exceptions and the final fallback.

Read about Rule matching →

Troubleshooting

Can't find Shadowrocket on the App Store? Check storefront region, age ratings and account status

If Shadowrocket does not appear in App Store search, check the account's storefront region, age rating restrictions and account status. Follow the checks in order and confirm the product page with app ID 932747118. Locate search issues in the store and account settings first; there is no need to change saved server parameters.

Read App Store search troubleshooting →

View all articles →

ShadowrocketGuide