Genuine App Store app · Official manual
shadowrocket · noun · Rules-based proxy client for Apple platforms
Shadowrocket is a rules-based proxy client primarily for iPhone and iPad, available as a one-time purchase through the official App Store. This manual explains how existing server details map to app settings, following the steps for import, connection, routing, and diagnostics.
Connecting involves three separate steps: save valid connection details, choose how traffic is routed, and verify actual requests. Purchasing the app only provides the client; the steps that follow assume you already have your own subscription or server details.
A server entry stores the address, port, and authentication details needed for one connection. A subscription imports and maintains multiple entries at once. In Home, tap Add Server, select the Type that matches your existing details, then check Host, Port, and the fields required by that protocol. If you already have a subscription link, use the corresponding Subscribe import option. Don't enter a subscription URL as the Host for a single server.
After importing, check that each entry in the list is complete, then select the one you want to use. Scan QR Code can import an existing configuration QR code, but check the protocol and parameters after scanning. A subscription may contain entries for different purposes; names are labels, not proof that a connection works. Before updating, note any custom details you need to keep so you can distinguish remote changes from your local edits.
Global Routing determines how requests are handled. Config applies the policies in the current configuration; Proxy sends traffic through the selected proxy; Direct connects without a proxy. For typical use, start by confirming that Config is selected and checking FINAL at the end of the configuration. The connection toggle alone doesn't show whether every request is routed through a proxy.
For an initial check, briefly select Proxy to see whether the chosen server can complete a request, then switch back to Config and check how the rules differ. Direct can help compare behavior on a direct connection, but it won't fix incorrect server details. Mode selection and server selection are separate: the mode determines the route, while the server selection determines the connection target. Track changes to each separately.
The connection toggle in Home starts or stops the connection. The first time you turn it on, the system may ask you to add a VPN configuration. Review the system prompt, grant permission, then return to the app to check the connection status. Connectivity Test can help check the selected entry, but its results reflect only that test method. They don't replace testing access in an app or prove that a particular routing rule matched.
To verify the connection, open a familiar website, then check the relevant request, matched policy, and any timeouts. If the toggle is on but access fails, check your local network, server address, port, authentication details, TLS settings, system time, and DNS in that order. Change one item per test and repeat the same check to keep cause and effect clear. If you need help, note the symptoms and redact sensitive details before sharing them.
Start with entries for the settings you actually use. First locate the control, then check what it affects. If you're unsure about a default, use the value shown in your current app.
Interface labels remain in English. Rules determine where requests go, connection details determine whether a server is reachable, and automation settings determine when a connection is attempted. Check these separately.
Rules & Routing determines request handling based on domains, addresses, or other matching conditions. Set Global Routing to Config, then review Rule in the active configuration. Rules are generally matched from top to bottom; put more specific conditions before broader ones, with FINAL as the catch-all at the end. For your first change, add just one clear domain rule, save it, make a new request, and check the request log. PROXY, DIRECT, and REJECT mean route through a proxy, connect directly, and block, respectively. The example illustrates syntax only; it isn't a complete configuration.
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
FINAL,PROXYOn Demand applies connection behavior based on the network environment and configured triggers; it isn't the same as manually turning on the Home toggle. For your first test, leave existing settings unchanged, verify a manual connection, then review On Demand in Settings. When setting Wi-Fi, cellular, or domain conditions, define the expected behavior for each one and test on the relevant network. If the connection starts again after you stop it manually, check these conditions before repeatedly deleting server entries. Automatic triggers still require a valid server and configuration; they don't replace checking connection details.
Settings → On DemandThe protocol defines how the client connects to a server, so Type must match your existing server details. Authentication and transport fields differ across Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard; changing only the protocol name won't make other parameters compatible. When possible, import the original configuration, then check Host, Port, authentication details, and any required TLS settings. If the connection fails, keep the original entry and test a copy with one change at a time, so you can trace the results.
Add Server → Type
Host / Port / Password / MethodSubscribe imports a subscription you already have and updates server entries from its remote contents. Before importing, make sure the link is complete and belongs to a service you already use. After saving, check that the groups and number of entries match your expectations. A failed update doesn't necessarily mean all saved entries have stopped working; check the subscription request and server connection separately. Subscription links may contain credentials, so redact them from screenshots or Log before sharing. Remote updates can change entry names or parameters; check whether an entry is managed by a subscription before editing it locally.
Home → Add Server → Type → SubscribeConfig manages configuration files that affect routing, name resolution, and other behavior; it isn't a server subscription. In Config, identify the active file first, then review sections such as General, Rule, and Hosts. Keep a copy before making changes, adjust one section at a time, and verify the result. If you use iCloud sync, check which items the app can sync and confirm the contents on both devices. Sync doesn't guarantee that all connection states will match, and it isn't a substitute for backing up before editing. After a remote configuration update, check your custom content again.
Config → General / Rule / HostsDiagnostics help break a connection failure into testable issues. Note the Test Method in Settings before running Connectivity Test; results from different test methods aren't directly comparable to real-world access speed. Use Log to review requests, connections, and error clues, and Data to check traffic statistics. Neither alone proves that all requests took the same route. Keep only the records needed during troubleshooting, and use specific failed requests to investigate DNS, rules, or connection details. Remove addresses, credentials, and personal browsing information before sharing.
Connectivity Test
Settings → Test Method / Diagnostics
DataThe App Store is the only place to get Shadowrocket. Before purchasing, verify the app identity; after installation, review system permissions. Check the App Store listing for system requirements and whether a purchase applies across devices.
On the App Store product page, confirm the app name, developer, and official icon, then follow the current storefront prompts to purchase and install. When you first open the app, have your existing subscription or server details ready. Import and select an entry, then turn on the Home connection toggle. Check the App Store listing for system requirements rather than relying on search snippets to determine compatibility.
Authorizing a VPN configuration is a system step required for the connection; it isn't part of the purchase process. If there's no connection after authorization, return to Home and check the status and selected entry. If the product page shows that you've purchased the app, check your purchase history for the account in use. Reinstalling doesn't need to be your first troubleshooting step.
View the iPhone guideIf you've already purchased Shadowrocket with the same Apple ID, check your App Store purchase history and the product page status, then follow the prompts to get the app. Check the App Store listing to confirm whether the purchase applies to both iPhone and iPad. The layout may differ on iPad, but Home, Config, and Settings remain useful labels when locating controls.
Handle app purchase history and in-app configuration separately. Having the app installed on another device doesn't mean the current device has the same servers, rules, or permissions saved. Before using iCloud sync, check which items can sync, then verify them one by one. Test the first connection on the current device; a connection working on another device doesn't verify this one.
View the iPad guideShadowrocket is also available on the App Store for Mac and Apple TV. Check the listing for compatibility, system requirements, and whether a purchase applies across devices.
Use the App Store product page to verify the app by checking its developer, official icon, and app ID. Shadowrocket is a closed-source commercial app; confirm the price, compatibility, and purchase status on the store page.
Check the app's identity in three places. On the product page, confirm the developer is Shadow Launch Technology Limited, compare the official icon, and verify that the product URL contains app ID 932747118. A similar name in search results isn't proof of identity, and the icon alone isn't enough. If any details don't match, return to the getting-started instructions and reopen the specified product page before deciding whether to purchase.
Buying the client ≠ buying a service plan. Purchasing Shadowrocket gives you the right to use the client; it doesn't create a server, subscription link, or connection credentials. This manual doesn't provide server nodes or subscription services. Import instructions assume you already have your own subscription or server details. The US storefront reference price is $2.99; prices appear in local currency on other storefronts, and the amount charged is the one shown on the App Store purchase page.
App Store search results can vary by storefront, content restrictions, and account status. If you can't find the app, open the specified product page first, then check the account currently used by the App Store, Screen Time content restrictions, and any payment prompts. No search results don't necessarily mean there's a problem with your device. Don't infer your purchase price from someone else's screenshot; always check the App Store listing for system requirements.
When switching devices or reinstalling, first check your App Store purchase history and confirm you're using the original purchasing account. The app purchase and local configuration recovery are separate: after restoring the app, check existing entries, Config, synced content, and VPN permissions. App updates are managed through the App Store, and release notes are on the store page. Keep a restorable copy of important configurations before changing settings, then verify your connection and rules after updating.
For DNS issues, first distinguish a name resolution failure from a server connection failure, then check the relevant items in the current Config and Settings. For On Demand issues, check the trigger conditions before testing the manual toggle. For rule issues, confirm Global Routing is set to Config, then trace the specific request and matched policy. Widget, Proxy ports, and sync options in Settings affect different parts of the app; avoid changing them all to troubleshoot a single timeout.
Defaults may vary; use the values shown in your current app. Keep settings that already work, note their original values, and change one item at a time: save, test, and revert if needed. Changes in Data can help show activity, while Log may provide error clues, but assess them alongside the specific request and network conditions. See the Settings reference for descriptions, default checks, and where to find each option.
Read the Settings referenceFind instructions for a specific issue by first identifying which layer is failing, then choosing the relevant article. These guides cover using an existing configuration, not finding a service.
Using DOMAIN-SUFFIX, IP-CIDR, and GEOIP as examples, this guide explains rule matching order, why FINAL belongs at the end, and how the three policies work. Read it if you're connected but a particular request isn't taking the expected route. Check the active configuration before changing rule order.
Read the articleCheck the test method, address, port, authentication, and TLS settings in order, then verify the system time and DNS. Distinguish a test timeout from an actual access failure. Record the result of each change, and avoid repeatedly switching configuration files before confirming the connection details.
Read the articleLearn how On Demand relates to the manual toggle and how to verify triggers for each network environment. Read this if the connection changes when switching networks or reconnects after you stop it manually. First verify a manual connection, then add conditions for automation.
Read the articleFor your first use, import one entry and verify the connection before exploring rules and automation. Keeping a tested baseline gives you a reliable point of comparison for every change that follows.
View all articles