A cross-platform rule-based proxy client. Import an existing configuration, choose a connection mode in Global Routing, and let rules determine how requests are handled.
iOS / iPadOSmacOS / Windows / Android / LinuxRule → first match2 ways to get the app
Features and settings
From existing configurations to rule matching
Server details, configuration files, and the connection switch each serve a different purpose. Check that your data is complete before choosing a connection mode. Change one setting at a time to identify what caused a change.
Rule routing
Rules determine which policy handles a request. In Home, set Global Routing to Config to check rules in the order listed in the current configuration. The first matching rule applies; matching results are not combined. Specific domain conditions should generally come before broader suffix conditions, with FINAL at the end as a fallback. If a website is routed unexpectedly, check the mode and rule order first, then check the server connection. Do not judge whether a rule works simply by switching servers.
On Demand uses network conditions to decide when to start a connection. It controls whether a connection is established, not which rule handles a domain. Find On Demand in Settings and configure conditions for your Wi-Fi and Cellular use. First establish a working connection manually, then enable automatic triggers; otherwise, automatic reconnection may hide errors in the configuration. After making changes, test by switching networks and check the VPN status shown by the system. To temporarily stop automatic connections, also check whether the relevant On Demand conditions are still enabled.
Support for multiple protocols lets you choose the appropriate Type based on your existing server details. It does not mean that parameters can be interchanged between protocols. In Add Server, select a type first, then check Host, Port, and authentication fields one by one. For TLS, also verify details such as the server-provided SNI. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard each use a different configuration structure. If a connection fails after import, check the original information for missing fields and keep certificate verification enabled. Disabling verification should not be a routine fix.
A subscription is used to retrieve and update a user's existing server entries in bulk. In Add Server, select Subscribe and enter the complete link from your own service provider in the corresponding field. After saving, check whether the expected group appears in the SERVER list. Subscription links may contain account credentials and should be treated as sensitive information. Do not share them in public screenshots or forward them to others. If an update fails, check whether the link has expired, the network can reach it, and the response is still a valid subscription. Repeatedly adding the same link usually creates duplicate entries rather than fixing the original.
Example for illustration · Cannot be used to connect
https://example.com/sub?token=xxxx
This example only illustrates the link structure. Enter your own subscription link.
Config files
Config stores rules and related settings. It is separate from the server entries in SERVER. Before enabling a configuration, review each section and confirm that the General options, Rule policies, Host, and URL Rewrite settings fit your needs. Keep a recoverable copy before making changes, adjust only a small amount at a time, then test in Config mode. If you use iCloud sync, first confirm how the current device relates to the synced content. Sync is a configuration management tool; it will not automatically restore expired server credentials or replace a backup made before an update.
Diagnostics should distinguish between server reachability, an established connection, and a successful request to the destination. Home's Connectivity Test can check a server entry's response, but the result does not replace a real access test. Traffic records in Data show observed activity and cannot by themselves prove that rules are correct. When troubleshooting, note the current network, Global Routing mode, and failed request, then review available information under Diagnostics in Settings. Before sharing troubleshooting details, remove subscription links, passwords, and personal access records; a concise error description is usually enough.
Global Routing: how the current request is handled
Data: actual traffic activity
Diagnostics: errors and diagnostic information
Get Shadowrocket for your device
Download for all platforms
iPhone / iPad: $2.99 one-time via App Store, with one purchase for both devices. Mac, Windows, Android, and Linux versions are free. Desktop and Android installation packages are available from this site's download page, with download requests served from /dl/shadowrocket/. Choose your device, then follow the download page instructions to install and allow the app in your system settings.
$2.99 one-time via App Store; other platforms are free. Check the App Store listing for system requirements. The iPad's wider display can make it easier to review Config, but rules still need to be checked one by one in order. A file name alone does not tell you what a configuration is for.
When connecting for the first time, follow the system prompt to allow adding a VPN configuration. This permission establishes a connection on your device; it does not generate server details for you. Prepare your own subscription or complete server parameters first.
Free · Apple Silicon / Intel. Check your chip in About This Mac, then choose the matching package. Do not choose an architecture based only on the computer's appearance or purchase year. Both versions are available on the download page for you to compare.
If you see “Cannot verify developer” when opening the app for the first time, confirm that the file came from this site, then follow the download instructions in Privacy & Security and select “Open Anyway.” See the installation guide on the download page for other system prompts.
Free · 64-bit installer. Keep a backup of your configuration, then run the installer. If you already have other network connection settings in place, avoid enabling multiple settings that take over network traffic during your first test. This makes it easier to identify how requests are actually routed.
If SmartScreen blocks the app, check the download source first, then follow the installation instructions to select “More info” and “Run anyway.” On managed devices, follow your administrator's policies.
Free · arm64 package. Open the download page in your system browser. After downloading, follow the system prompt to allow your browser or file manager to “Install unknown apps.” You can revoke this installation permission when you no longer need it.
If you cannot download using an in-app browser, open the same page in your system browser using the menu in the upper-right corner. When connecting for the first time, confirm the system's VPN connection request. Prompts vary by device and system.
Free · deb / rpm / AppImage. Choose a format based on your distribution and package manager, and check that the system architecture and package are compatible before installing. Use the appropriate package manager for deb and rpm files. For AppImage, grant execute permission as instructed.
If the app does not launch directly in your desktop environment, check the terminal output and determine whether the issue is permissions, dependencies, or configuration. The download page lists relevant commands. Before running them, confirm that the file name matches the file you downloaded.
Shadowrocket is a closed-source commercial app. This is the official site and guide. Verify the app using its official icon, developer name, app ID, and this site's download path—not similar names, search rankings, or screenshots from others.
Developer: Shadow Launch Technology LimitedApp ID 9327471182 ways to get the app · App Store / packages from this site
Check three details on the App Store listing
Open the App Store product page linked from the download page. Check that the app is named Shadowrocket, verify the developer is Shadow Launch Technology Limited, and confirm that the product link contains app ID 932747118. The official icon should match the one used in this site's header. A matching name or high search ranking is no substitute for these checks. A free listing with the same name in the store is not the paid mobile version of this product.
iPhone / iPad: $2.99 one-time via App Store; Mac, Windows, Android, and Linux versions are free. The store may display local currency and the final price based on your account's storefront. Review the current product page before purchasing. Check the App Store listing for system requirements; requirements in older articles may no longer apply.
Store availability and account region
Whether a product appears in the App Store depends on the region of the account used for Media & Purchases. Changing your device language does not change the storefront. If the app is not currently available in the mainland China storefront, first check the account you are signed into for purchases and its region, then read the store information on the download page. Do not treat a failed network connection, a missing App Store search result, and an app that will not launch as the same issue; each requires different checks.
If you need to change your account region, use the official Country or Region option in your system account settings, and review conditions relating to your balance, existing subscriptions, and payment methods first. Changing regions can affect other purchases on your account, so do not do so just to act on a single search result. Check whether the App Store product page is available before deciding what to do next.
Purchase history, new devices, and restore
You can restore the app on iPhone and iPad using the same purchase account's purchase history. When switching devices or reinstalling, sign in to the original purchase account and find Shadowrocket under Purchased in the App Store. If you see a new purchase prompt, check the account before paying again. Restoring the app and restoring its configuration are separate tasks. After reinstalling, check that your server entries and Config are still in place.
iCloud sync can help manage supported content across devices. Before enabling it, confirm your account and existing data, and keep a separate backup of important configurations. Do not mistake purchase history for a backup of subscription links. Manage server addresses, authentication details, and rule files according to their respective sources and purposes, then verify each item after migration.
Buying the app ≠ a service plan
Purchasing the app grants a license to use it; it does not automatically provide a usable server. This site does not provide, sell, or recommend servers or subscriptions. Before setup, you should already have your own subscription or server details. The app handles importing, connecting, and applying rules. Server availability, valid authentication, and up-to-date addresses must be checked separately.
When adding a server manually, confirm its protocol, address, port, and authentication fields with your own service provider. When importing a subscription, check that the link is complete. Do not share complete links, QR codes, or configuration files containing passwords. The example.com examples only illustrate formatting; they are not connectable servers and do not represent a service provider.
Get and update versions for other platforms
Get Shadowrocket installation packages for Mac, Windows, Android, and Linux from this site's download page. Before updating, save your current configuration and close the app, then follow the steps for your system. If the installation is blocked, first confirm the source and file type, then follow the system instructions on the download page. Do not leave system-wide protection disabled just to open a file.
App Store manages app updates on iPhone and iPad; server subscription updates are separate. An app update does not automatically fix expired subscription credentials, and updating a subscription does not change the app itself. When troubleshooting, first decide whether you need to update the app, a server entry, or Config. Avoid changing several layers at once.
Four checks before your first connection
Why can't I connect even though SERVER has an entry?
An entry only confirms that the information was saved. Check the selected server, protocol fields, and authentication details, then make sure the current network can reach the address. Consider Connectivity Test results alongside a real access test; one successful test response does not guarantee that every request will work. See connection verification steps.
Why didn't traffic change after I edited a Rule?
First confirm that Global Routing is set to Config and that you are using the configuration you just edited. Then check the rule list from the top for an earlier matching condition, especially a broad DOMAIN-KEYWORD, an address range, or a FINAL that appears too early. Rules do not automatically prioritize whichever condition is most specific. See the rule matching reference.
What's the difference between scanning a code and importing with Subscribe?
Scan QR Code reads the content carried in a QR code. Subscribe manages the entries returned by an existing subscription link. Check the specific type of the scan result; its appearance alone is not enough to identify it. After saving, review the SERVER group and fields to confirm the information looks right, then test the connection. See import instructions.
Where should I look if the connection returns after I turn it off?
First check On Demand in Settings and the system's On Demand connection status for the current VPN configuration. See whether a network change triggered reconnection before changing rules or server details. For a temporary test, disable automatic trigger conditions and connect manually. Once testing is complete, restore the settings you need. See the first-time setup sequence.
Continue by topic
Installation, rules, and protocol guides
Quick start walks through a complete connection, while the rule reference explains syntax in detail. The articles below cover specific parameters and installation steps. Identify whether your issue concerns installation permissions, configuration fields, or rule routing, then open the relevant topic.
Use your existing server details to check Host, Port, Password, and SNI one by one. Learn what TLS does and why Allow Insecure should not be a routine response to connection failures.
Compare the matching boundaries for full domains, suffixes, keywords, and IP ranges, and learn how rule order relates to policies. Use readable examples to see why FINAL belongs at the end of the rule list.
Start from this site's download page and follow the steps for the arm64 package and system installation permissions. If an in-app browser cannot download the file, switch to the system browser, then continue with installation.
