Shadowrocket FAQ
First identify whether the issue is about downloading, importing, or connecting, then check each step in order. Covers iPhone, iPad, Mac, Windows, Android, and Linux.
Haven’t installed it yet? Start with the download and installation guide for all platforms. Already have server details? Begin with the getting started guide.
- 2 ways to get Shadowrocket
- iPhone / iPad: one-time $2.99 · Other platforms: free
- Troubleshoot one symptom at a time
Select a question to expand the answer. Connection toggle, internet access, and battery issues are covered under Troubleshooting in Rules & traffic routing.
Purchase & authenticity
Check the product listing and purchase account first, then troubleshoot region and device-transfer issues.
Can you use Shadowrocket on desktop and Android? How much does it cost?
Yes. Get the iPhone and iPad version from the App Store for a one-time $2.99 purchase. The Mac (Apple silicon and Intel), Windows, Android, and Linux versions are free. Get installers for other platforms from the all-platform download page at /dl/shadowrocket/ on this site. Buying the app does not include a service plan. We do not provide, sell, or recommend servers or subscriptions; you’ll need your own subscription or server details before use.
How can I verify the genuine Shadowrocket listing in the App Store?
Open the App Store product page and check the product name, Shadowrocket, the developer, Shadow Launch Technology Limited, and app ID 932747118. Compare the listing with the official icon in this site’s header. Don’t rely on the name in search results alone. The iPhone and iPad version costs a one-time $2.99 in the App Store; the Mac, Windows, Android, and Linux versions are free. The final price depends on the storefront. A free listing with the same name is not proof that it’s genuine.
Shadowrocket isn’t showing up in the App Store. What should I check first?
Open the App Store product page directly, then check the country or region of the Apple Account used for purchases, content and age restrictions, and whether you’re signed in. The app isn’t available in the mainland China storefront. Your device language and physical location don’t determine your account’s storefront. If you need to change regions, follow Apple’s official steps under Settings → Apple Account → Media & Purchases → View Account → Country/Region. Resolve any balance, subscription, or payment-method requirements first; don’t keep switching regions to troubleshoot.
Do I have to buy Shadowrocket again when I get a new iPhone or reinstall it?
If you bought Shadowrocket for iPhone or iPad, sign in with the Apple Account used for the purchase, then find and download it again from the App Store’s purchased items. If you’re still asked to pay, check the account and purchase history before trying again. The iPhone and iPad version is a one-time $2.99 App Store purchase; the Mac, Windows, Android, and Linux versions are free and can be downloaded again from this site for a replacement device. Purchase history won’t restore your server credentials or local settings. Back them up separately before switching devices.
Can I install Shadowrocket on iPad? Is the purchase shared with iPhone?
Yes. iPhone and iPad use the same App Store product listing, and you can restore the purchase on another compatible device with the same Apple Account. The iPhone and iPad version is a one-time $2.99 App Store purchase; the Mac, Windows, Android, and Linux versions are free. Check the App Store listing for the iPhone and iPad system requirements. You can use the same configuration on both devices, but whether your service allows simultaneous connections depends on its own limits—not the app purchase.
Installation & first launch
Confirm the platform, architecture, and download source before handling first-launch security prompts.
Which Mac version should I download: Apple silicon or Intel?
Open About This Mac from the Apple menu. If it shows Chip and an Apple chip name, choose the Apple silicon version. If it shows an Intel processor, choose the Intel version. Don’t guess based on the model year. The download page has a separate DMG for each. If macOS can’t verify the developer the first time you open the app, confirm the installer came from this site, then go to System Settings → Privacy & Security, find the blocked app, and choose Open Anyway. Follow the on-screen prompts.
Windows SmartScreen warns that the app may be unsafe. What should I do?
First, make sure the installer came from this site’s download page at /dl/shadowrocket/ and is the 64-bit Windows EXE. Once you’ve confirmed the source, select More info → Run anyway in the SmartScreen prompt, then follow the installer. If your organization’s policy hides the button, ask your device administrator. Don’t disable device-wide security. If the source is unclear or the filename looks wrong, stop and download the installer again from the download page.
Mac says the developer can’t be verified or the app is damaged. What should I do?
Check that the installer came from this site and matches your Mac’s chip type. Move the app to Applications, then try opening it again. If macOS can’t verify the developer, go to System Settings → Privacy & Security and choose Open Anyway. If you’ve confirmed the app came from this site, its location is correct, and macOS says it’s damaged, run xattr -cr /Applications/Shadowrocket.app in Terminal and try again. This command removes extended attributes from the selected app; it won’t repair arbitrary file damage. If the download is incomplete, download it again. Don’t run the command on an app from an unknown source.
The Android download doesn’t start, or the app won’t install. What should I do?
If tapping the link in WeChat does nothing, open the site’s download page in your system browser using the menu, then download the arm64 APK. Before installing, go to system settings and allow your browser or file manager to install unknown apps for this installation only. You can revoke the permission afterward. If the system displays a security warning, verify the source; don’t ignore warnings about an unknown source. If the package can’t be parsed, check your device architecture, available storage, and whether the download completed, then download it again.
Which Linux package should I use: deb, rpm, or AppImage?
Choose deb for Debian, Ubuntu, and similar distributions; choose rpm for Fedora and similar distributions. Use AppImage if you don’t want to install a system package. Download all files from this site’s download page. From the directory containing the file, install a deb with sudo apt install ./ followed by the actual filename, or an rpm with sudo dnf install ./ followed by the actual filename. For AppImage, run chmod +x followed by the actual filename, then launch it. If the system blocks execution, check the source, architecture, and execute permissions rather than using elevated privileges to bypass the issue.
The interface is in English. Where should I start?
Use the interface’s original labels to find your way around: Home shows your saved servers and connection toggle; Add Server adds a server; Config manages configuration files; Global Routing selects how traffic is handled; Settings contains app settings. Check the app’s language options in system settings; the exact location varies by system. Keep these English labels in mind when following a guide so you don’t mistake an explanation for a button. For your first setup, follow the getting-started guide to add a server, choose a mode, connect, and test. You don’t need to change every setting at once.
Subscriptions & server imports
The steps below assume you already have your own subscription or server details.
A subscription import failed. What should I check, and in what order?
Check that the copied URL is complete and contains no extra spaces, line breaks, or punctuation added by a messaging app. Make sure it’s the actual URL for your existing subscription, not an account-management webpage. Try again on your current network and check the service status and expiration date. If the response is a login page or error text, ask your original service provider to confirm the URL and format. Don’t add the same subscription repeatedly. When troubleshooting or asking for help, hide tokens, account details, and server credentials in the URL; share only the error message.
Why doesn’t scanning a QR code add the server?
Make sure camera access is enabled and the QR code is clear, complete, and unobstructed. Check that it contains server-sharing details Shadowrocket can recognize—not a webpage link or login credentials. Add a server using your own server details. After scanning, check the protocol, address, port, and authentication fields in Add Server before saving. QR codes can contain sensitive connection details; don’t post them publicly. If the scanned details look wrong, stop and check the original information.
How do I update an existing subscription? Do I need to select a server again afterward?
In Home, find the subscription group and use its update action. When the update finishes, check whether the list changed and whether an error appeared. The returned subscription data may add, remove, or rename servers in the group. If your previously selected server was removed or renamed, select a server that’s still available. Manage manually added servers separately from subscription groups. If the update fails, keep your current working configuration and check your network and subscription URL instead of deleting everything.
Are Subscribe and Config the same thing?
No. Subscribe is generally used to get a list of servers from an existing subscription. A Config file may also contain sections such as General, Rule, and Host that control connections and traffic routing. Importing a server list doesn’t configure rules, and switching Config files doesn’t necessarily update server details. Check what your information is for before importing it to the right place. Keep a copy of your existing configuration before making changes, then check the server list, active Config, and Global Routing separately.
The import succeeded, but Connectivity Test failed. What does that mean?
A successful import means the information was recognized and saved; it doesn’t prove the server is reachable. Check the server address, port, protocol, and authentication details, then confirm the status of your existing service. Retry over Wi-Fi and mobile data to see whether the issue affects just one network. Connectivity Test results depend on the test method and destination, so one failure doesn’t mean every request will fail. Check real-world access and the error type in the logs, changing one variable at a time and keeping track of reproducible results.
Rules & traffic routing
Troubleshooting: check in this order—basic network access → server → mode → matched rule.
How should I choose among Config, Proxy, and Direct in Global Routing?
Config follows the rules in your active Config and is suited to everyday rule-based routing. Proxy sends requests the app can handle through the selected proxy and can help you check whether a server is reachable. Direct checks access without using a proxy. These are routing modes, not separate servers or speed tiers. When troubleshooting, note the current mode and compare the same request in each mode. Switch back to your preferred mode when you’re done so a temporary test setting doesn’t become your everyday configuration.
The connection toggle won’t turn on, or it turns off right away. What should I do?
First, select a working server. Check whether the system asks you to authorize the VPN configuration, and follow its prompts. If you previously denied authorization, try connecting again and check the system’s VPN settings. If another VPN session is active, disconnect it before testing. Then check the current Config for syntax errors, check whether device management policies apply, and try restarting the app. Don’t repeatedly delete system configurations. Note the error first, then determine whether it’s an authorization, configuration-loading, or server-connection issue.
Shadowrocket says connected, but I can’t access the internet. Should I check the server or the rules first?
Disconnect and confirm the device’s internet connection works, then reconnect and test the same destination. If both Proxy and Config fail, check the selected server, authentication details, service status, and DNS errors first. If Proxy works but Config fails, focus on the rule and policy that matched the request. Direct can provide a comparison with your local network, but it doesn’t prove the proxy is working. Change one thing at a time and note the network type and error. Don’t replace the server, DNS, and entire Config all at once.
Why does rule order matter? Where should FINAL go?
In the [Rule] section, requests are checked from top to bottom. When a rule matches, its policy applies and later rules aren’t checked. Put more specific DOMAIN or DOMAIN-SUFFIX rules before broader matches. Place FINAL at the end of the section as the fallback for requests that didn’t match earlier rules. Don’t just check that a rule exists: check whether an earlier rule already matches, and make sure Global Routing is set to Config. PROXY, DIRECT, and REJECT mean route through a proxy, connect directly, and reject the request, respectively.
How can I confirm a request is being routed as expected?
Select Config in Global Routing and make sure it’s using the configuration you just edited and saved. Then make a request to your test destination and check the connection records or logs for the domain, matched rule, and policy. For example, use DOMAIN-SUFFIX,example.com,PROXY, with FINAL,PROXY as the last line in the [Rule] section. These examples illustrate syntax and may not suit your network. If the logs show an IP request, check DNS resolution and how IP-CIDR or GEOIP rules match it. A webpage loading successfully doesn’t by itself prove that the rule is correct.
Does On Demand keep the connection active all the time? How can I check increased battery use?
On Demand starts a connection when its configured conditions are met. Whether it stays connected depends on those conditions, network changes, and actual requests; it isn’t simply a timer-based toggle. Pause the relevant conditions, then compare manual connections on the same network with similar usage. Check system battery usage, background activity, subscription update frequency, and log volume. Frequent reconnects and an unstable network signal can also use more battery. Reduce unnecessary background activity one setting at a time and test again. A persistent VPN icon alone doesn’t mean the app is transferring large amounts of data continuously.
What information should I collect before reporting an issue?
Note your device platform, network type, Global Routing mode, protocol, steps to reproduce, and the complete error message. Include whether things work after disconnecting, whether the issue happens on another network, and which settings you changed recently. You can share rule snippets after removing sensitive details, but don’t send a full subscription URL, QR code, password, private key, or account credentials. Reproduce the issue with as few changes as possible before collecting details. For questions about an existing service’s expiration, authentication, or address, check with its provider.