How to Install Shadowrocket on Android: Download the APK and Allow Unknown Apps

1. Check device compatibility and download source

Shadowrocket for Android is free. Get the installer from the Android section of this site’s download page. Before downloading, check whether your device supports arm64, the common 64-bit ARM app architecture. A 64-bit-capable processor does not necessarily mean the installed Android system can run 64-bit apps, so check carefully, especially on older devices or custom Android builds.

Check About phone or About tablet in System settings for your model and OS details, then consult your device documentation to verify the supported app architecture. If your device only supports 32-bit apps or uses a different processor architecture, don’t try to work around it by changing the file extension or repeatedly reinstalling. Installation failures can have other causes, so check the exact system message.

Here’s how to get Shadowrocket across platforms: the iPhone / iPad version costs $2.99 as a one-time App Store purchase. The developer is Shadow Launch Technology Limited; check the App Store listing for system requirements. The Mac (Apple silicon / Intel), Windows, Android, and Linux versions are free. All download instructions on this site lead to its download page, where you can choose the version for your device. Don’t use chat attachments or files rehosted on cloud drives.

2. Install the APK from the download page

Use your system browser for these steps. Android treats downloading a file and allowing an app to install it as two separate actions. Even after the download finishes, you may need to grant install permission to the browser or file manager you used to open the APK. Allow only the source app named in the system prompt, rather than enabling installs for every app.

1. Open the download page

   In your system browser, visit this site’s downloads page, find the Android section, and select the arm64 APK. Make sure you don’t select an installer for Windows, Mac, or Linux. Wait for the download to finish.

2. Open the downloaded file

   Open the .apk file from Downloads in your browser menu, or find it in the Downloads folder in your system’s Files app. If it still shows as downloading, failed, or temporary, resolve the download issue first; don’t proceed with installation.

3. Allow this source

   If Android says you can’t install apps from this source, tap Settings in the prompt to open the Install unknown apps page for the app you used. Turn on Allow from this source. On English-language systems, the setting is commonly called Install unknown apps, with the toggle labeled Allow from this source.

4. Return to the installer

   Return to the system installer, check that the app is named Shadowrocket, and tap Install. If the installer doesn’t reappear, open the same APK again from your download history. There’s no need to download it again.

5. Revoke source permission

   After installation, confirm that Shadowrocket opens, then return to the Install unknown apps page for that source and turn off the permission you enabled. This won’t uninstall Shadowrocket. If you update it manually later, grant permission again when prompted.

If your device is managed by your employer or school, system policies may prevent you from changing install-source permissions. If the toggle is grayed out, you see a message that an administrator has blocked it, or a management policy stops the installation, contact your device administrator. Repeated taps or switching browsers won’t remove these restrictions.

3. If WeChat can’t download the APK, use your system browser

Being able to open an article in WeChat’s built-in browser doesn’t mean it can download an APK and hand it off to the system installer. If tapping the button creates no download, the page says to open it in a browser, or you’re sent back to chat, troubleshoot opening the page and downloading the file separately. Don’t keep tapping the download button and creating multiple tasks.

If your system browser also fails to start a download, first check whether regular web pages load. Then look for messages that the download was canceled, storage is full, or the network was interrupted. Try again on a stable Wi-Fi or mobile data connection, keeping mobile data usage in mind. Don’t disable system-wide security protections just to complete a download.

4. Troubleshoot installation errors using system messages

When troubleshooting, note the full error message rather than just saying the app won’t install. An incomplete download, a package parsing error, a blocked source, and a conflict with an installed app occur at different stages. Address the specific cause before trying again to avoid repeatedly submitting the same damaged file to the installer.

A package parsing error is not the same as a network configuration problem. The app hasn’t been installed successfully, so changing a server address, port, or subscription won’t help. Don’t guess compatibility from the filename; check the package type on the download page against the app architecture your device supports.

5. First launch: installation permission vs. VPN permission

Install unknown apps lets a source app start an installation. Android’s VPN connection prompt lets Shadowrocket create a local VPN tunnel. These permissions do different things; the first does not replace the second. After installation, open Home and import your existing configuration. The first time you connect, read and approve the system’s VPN request.

• Check your existing configuration: Verify that the server address, port, authentication details, and protocol match. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different fields; enter the details from your own service configuration.
• Import a subscription: Use your own subscription URL and check that the list appears after importing. Updating a subscription fetches the latest content provided by the service; it does not update the APK or guarantee that existing entries will stay unchanged.
• Check the routing mode: In Home → Global Routing, Proxy uses the proxy policy, Direct connects directly, Config follows configuration rules, and Scene applies the selected scene. When troubleshooting for the first time, avoid changing several modes and settings at once.
• Approve the VPN request: The first time you connect, check the app name in the system prompt before approving it. If another VPN is running, check for a conflict. In most cases, two standard VPN tunnels can’t run at the same time in the same user environment.
• Test the connection: Use Connectivity Test on Home to check how the connection behaves. A connected status confirms that the tunnel is established; it doesn’t mean the destination site, DNS, and routing policies are all working as expected.

To connect automatically, first verify that a manual connection works, then check Settings → On Demand. On Demand is not an installation permission and cannot supply missing configuration. Android background battery management is controlled in system settings. If the connection drops when the screen locks, check whether the system is restricting background activity before reinstalling the app.

Use minimal rules to separate installation issues from routing issues

The following is a syntax example for the [Rule] section in Config, not a complete configuration you can use to connect. Assume the configuration defines a working PROXY policy. Rules are matched from top to bottom, and the policy for the first match is applied. Put FINAL last to handle requests that don’t match any other rule.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
FINAL,DIRECT

example.com is a documentation example domain. The second rule covers only the 192.168.0.0/16 address range, not all private addresses. This example sends unmatched requests through DIRECT, so don’t use it as a general-purpose routing setup in place of your existing configuration. For more on how GEOIP, IP-CIDR, and domain rules work together, see the Rules reference.

6. Android installation FAQs