Official Guide · App Store listing
A rule-based proxy client for iPhone / iPad, with rule-based routing and multiple protocols. The app is a one-time purchase on the App Store; you’ll need your own subscription or server details to connect.
APP STORE / APPLE DEVICES
First verify the official icon, developer, and app ID on the App Store, then check device compatibility and purchase status. The App Store is the only place to get Shadowrocket. Refer to the App Store listing for system requirements.
On the App StoreDownload ShadowrocketOpen the product page in the App Store on your iPhone and check the Apple ID used for the purchase and device compatibility. After installing, import an existing configuration, then follow the system prompt to allow VPN configuration. Granting permission does not confirm that the connection works.
See iPhone availability details →On your iPad, use the Apple ID associated with the purchase to view your purchases, then open the product page to check availability. Refer to the App Store listing for details on whether the purchase is universal across iPhone and iPad. Verify your server, subscription, and configuration on the device.
See iPad availability details →Shadowrocket is also available from the same App Store on Mac / Apple TV. Refer to the App Store listing for compatibility, system requirements, and whether universal purchase applies.
CAPABILITY INDEX
Understand the difference between server details, configuration files, and routing modes before changing individual settings. The left navigation shows where to find each option; the right side lists the relevant keywords and settings. Syntax snippets are for reference, not complete, ready-to-use configurations.
On Home, open Global Routing. Choose Config to route requests according to the active configuration’s rules, Proxy to use proxy routing, or Direct to connect directly. To route by domain or address, first confirm the active configuration in Config, then check the order of rules and the policy names. Rules are generally matched from top to bottom. A broad condition may match too early and prevent a more specific rule below it from taking effect. Test with a known domain first, then add rules one at a time to make issues easier to isolate.
In Settings, check On Demand. First confirm that an existing server connects manually, then set the conditions that should trigger a connection. On Demand controls when a connection is established; it does not determine how requests are routed—that’s controlled by Global Routing. After changing the settings, check behavior on the current network, after switching networks, and after manually disconnecting. If the connection starts again after you disconnect, check whether a condition is still being met. To troubleshoot, temporarily turn off On Demand and connect manually. Re-enable conditions one at a time after verifying the basic connection and rules.
In Add Server, select Type first, then enter the address, port, and authentication details from your existing server information. Shadowsocks, VMess, VLESS, Trojan, WireGuard, and Hysteria2 use different parameter formats; changing the type while keeping the other fields is not sufficient. For TLS, check the server’s required name and certificate settings. Disabling verification is not a general-purpose fix. Compare each field with the source details before saving. Test the individual server first, then add subscription management or rule-based routing to avoid mistaking a protocol issue for a rules issue.
Before importing, identify whether you have a server subscription, a server share link, or a configuration file URL, then use the matching Subscribe or import option. An existing subscription usually contains a set of server details, and its contents may change when updated. A configuration file may also include rules and DNS settings, so the two cannot be distinguished by URL appearance alone. Before updating, note which servers work and any manual changes. Afterward, check the groups, selected server, and connection result. Subscription URLs may contain access credentials; redact the full URL and sensitive parameters in screenshots and logs.
In Config, confirm which configuration is active, then review sections such as General, Rule, and Hosts. Keep a recoverable copy before editing rules. After making changes, confirm the file is saved and selected; adding a file to the list does not make it active. To maintain configurations across devices, check the scope and status of the app’s iCloud sync options, then verify the selected configuration and server details on the other device. Sync is not a substitute for a backup, and sensitive fields may not transfer in the same way. Keep a verified working copy before troubleshooting.
If a connection fails, first check the toggle and selected server on Home, then run Connectivity Test and review Diagnostics in Settings. Traffic shown in Data indicates request activity; it does not by itself prove that a specific site is reachable. A successful test does not verify every domain, protocol, or rule path. Check each layer in order: basic network, server details, Global Routing, DNS, and rule matching. Change one variable at a time. Before reporting an issue, note the steps that reproduce it and the error text. Redact subscription URLs, passwords, and keys while retaining relevant timing and context.
This rule sends requests matching example.com and its subdomains to PROXY. The latter is a policy reference and must match a name in the active configuration. It is not a server address, and this line alone cannot establish a connection.
DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXYThis example illustrates rule syntax. GEOIP checks the geographic location associated with an address, while FINAL handles requests that did not match earlier rules. The actual route also depends on DNS results, rule order, and the selected policy.
Read the Global Routing and Rules Guide →Start by checking On Demand in Settings. Keep connections manual while confirming that the server and configuration work. Then enable conditions and observe when the system establishes a connection. Condition matching and rule-based routing operate at different levels and should be tested separately.
Settings
On Demand
Home
Global Routing
Connectivity TestIf connections restart repeatedly, note the network conditions and toggle actions. Don’t change the configuration and server at the same time. Narrow the trigger conditions first, then decide whether rules also need adjustment.
See Settings and Maintenance →After selecting Type, check the corresponding fields. The same address and port do not mean two protocols are compatible. Passwords, keys, transport settings, and TLS requirements must match the server details; don’t infer missing parameters from the protocol name.
Manual entry makes it easier to check each field, while QR codes and share links reduce typing. Whichever method you use, check Type and the key fields after importing, then test the connection.
See Protocol Terms →After importing a subscription, check that all entries are present, that your previous selection is still available, and whether any parameters changed during the update. Seeing servers in a list does not mean they’ve been verified. Select an entry and test an actual request.
Subscribe
Add Server
Scan QR Code
Import from Cloud JSONThese import options handle different content types. If recognition fails, confirm the format provided by the source and that you used the matching option. Check for extra spaces or line breaks from copying, and never publicly share a complete URL that contains credentials.
Follow the Guide to Import an Existing Subscription →After editing a configuration, confirm that it was saved and is selected. General contains global settings, Rule defines request matching, and Hosts specifies name resolution. Content from one section cannot be moved arbitrarily to another.
[General]
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT
[Hosts]This is an example of how to read configuration sections, not a complete connection setup. Keep a copy before making changes, then check the file contents after syncing across devices. If the result differs from what you expect, restore a known working state and compare changes one at a time.
Read the Configuration Management Guide →First confirm that the device’s basic network connection works, then check server authentication and run a connection test. If the test succeeds but a request to a specific destination fails, check Global Routing, DNS, and rules. Don’t assume both symptoms have the same cause.
Home → Connectivity Test
Data
Settings → DiagnosticsTraffic in Data only indicates that requests are being made. When comparing destinations or networks, keep the configuration and server selection the same and note the error text. Change one variable at a time to link results to a specific change.
Read the Connection Troubleshooting Guide →FIRST CONNECTION
These steps assume you already have your own subscription or server details. Treat importing, system authorization, and request testing as separate steps to avoid repeatedly changing rules before the connection prerequisites are in place.
Open Home and use Add Server, QR scanning, or the appropriate subscription option based on the information you have. For manual setup, select Type first, then enter each parameter. For imports, check the source and format, then review the server list and selection. Don’t enter a configuration file URL as a server address or publish authentication details from a subscription. If import fails, check the original format; this is more useful than repeatedly changing the port.
To route requests according to a configuration, select Config and confirm that the required file is selected in Config. Proxy and Direct help distinguish routing modes, but neither replaces checking the configuration itself. Changing modes affects where traffic goes, so restore your usual selection after testing. For the first test, use simple, readable rules. Verify each match before adding exceptions to avoid changing several rules at once and making the cause difficult to identify.
Turn on the connection toggle in Home. The first time you add a VPN configuration, read and confirm the system authorization prompt. Then run Connectivity Test, visit a known test destination, and review the results in Data or Diagnostics. If something goes wrong, note the error text and check basic network access, parameters, routing mode, and rules in that order. A connected status confirms the connection state; it does not prove that every destination or rule is working.
PRODUCT VERIFICATION
Shadowrocket is a closed-source commercial app. This is the official Shadowrocket guide for iPhone and iPad. Refer to the App Store product page for purchase and compatibility details, and use the labels shown in the app for step-by-step instructions.
Open the App Store product page. First compare its official icon with the one shown on this site, then check that the developer is Shadow Launch Technology Limited, and finally confirm that the app ID in the product URL is 932747118. A matching or similar name alone is not enough; search result titles can obscure differences in developer or product. After checking all three, review the price, compatibility, and purchase button.
Whether the app appears in the store depends on your Apple ID’s storefront and current availability. If search results don’t match what you expect, check the storefront and product page rather than assuming the device is at fault. Refer to the App Store listing for system requirements, device compatibility, and universal purchase availability. This site does not substitute fixed system version numbers for the store’s information.
Buying the app ≠ buying a proxy service. The US storefront price is about $2.99, paid once; other storefronts show local currency, and the amount on the purchase confirmation screen is final. Payment grants the right to use the app. Server addresses, authentication details, and subscription content must come from a service you already have. This site does not provide, sell, or recommend servers or subscriptions, or choose a service for you.
A one-time purchase does not guarantee that any server will connect, and the app does not automatically generate a working configuration. Before opening the app for the first time, prepare the required details and follow the setup guide. If a connection fails, check purchase status and server availability separately: the first determines whether you can get the app; the second affects whether the expected connection can be established. Each requires a different troubleshooting path.
When changing devices or reinstalling, use the Apple ID associated with the purchase to view your purchases in the App Store, then open the Shadowrocket product page to check its availability. Refer to the App Store listing for details on purchases shared between iPhone and iPad. If the page still shows a price, check your account, storefront, and purchase history. Don’t assume a previous app icon means the purchase is complete.
Restoring the app and restoring its configuration are separate tasks. After getting the app again, check your existing server details, configuration files, and sync status. Don’t assume the purchase history restores all connection data. For iCloud sync, check the scope you actually enabled. Before connecting, verify the selected configuration and server; restore from your own backup if needed.
Find Shadowrocket in the App Store’s app update section and update it manually or according to your device’s automatic update settings. Review the product page notes, then check key settings after updating. This page does not list specific version numbers or release dates; use the installed version and information currently shown in the store when troubleshooting, rather than relying on outdated records to determine whether a feature is available.
Handle routine maintenance in separate steps: keep a recoverable configuration copy, update the app, then check for changes to existing subscriptions. App updates, subscription updates, and rule edits are different operations. If you do them all at once, it’s difficult to tell what caused a problem. After each change, test a known destination and note the result to make future comparisons clearer.
Use these distinctions to identify the issue, then open the relevant guide or terminology entry.
A server subscription mainly provides connection entries; a configuration file may also define request rules. Importing servers does not select the right configuration for you. If you use Config mode, check the active file and policy references. See Subscription and Configuration Terms.
The test only reflects the result for its specific test path. Actual destinations may also be affected by DNS resolution, rule matching, and protocol differences. Continue checking with Data and Diagnostics. See Connection Diagnostics.
Global Routing determines the routing mode for requests. On Demand controls when a connection is triggered based on conditions. Test the connection manually before setting automatic triggers so you can distinguish establishing a connection from choosing a route. See Interface and Toggle Terms.
Restoring a purchase does not restore configuration. Check your backups and the scope of iCloud sync; don’t assume everything will transfer. After restoring, verify authentication fields and test the connection. See Restore Purchases.
TECHNICAL NOTES
After your first connection, explore a topic based on what you need to troubleshoot. Identify each protocol and parameter before changing settings. These technical notes explain how to enter and verify your existing details; they do not replace the complete configuration provided by your service.
Start with a domain resolution issue and compare three DNS approaches. Learn how resolution results affect rule matching, then check DNS, the connection, and the destination request in order instead of switching servers at the first sign of trouble.
Compare protocols by their transport and authentication requirements, and learn why you must select Type in Add Server first. Choose a type that matches your existing server details; changing the protocol name is not a connection fix.
Learn what Private Key, Public Key, Pre-shared Key, Allowed IPs, and MTU do. Distinguish local keys from Peer details and find out where to check when parameters don’t match.