iPhone
After opening the app, import your connection details, then follow the system prompt to add a VPN configuration. This permission sets up a network connection on your device; it does not verify the server details.
Read the instructions →Official Manual · App Store Listing
Shadowrocket Guide
Subscription setup and routing rules.
For the iPhone / iPad app, start by verifying the one-time purchase, then import an existing subscription, test the connection, and configure rule-based routing.
- Subscribe
- VLESS
- WireGuard
Getting and opening the app
Verify the App Store listing before setting up a connection
Shadowrocket is a paid app available only on the App Store, with a one-time purchase. Before buying, verify the developer, official icon, and app ID. Check the App Store listing for system requirements and device compatibility.
If you already have a subscription or server details, continue to the import steps after installing the app. The app purchase is separate from network service. This site does not provide subscriptions or servers; get your subscription link from your service provider.
iPad
Use the Apple ID you used to make the purchase to check your App Store purchase history, then continue with installation and import. Check the App Store listing to see whether the purchase can be shared with iPhone.
Read the instructions →Installing the app and restoring its configuration are separate steps. On another device, verify the server details, selected configuration, and system permission. Don't assume a successful installation means the connection is ready.
See how to get the app →Settings and recommended order
Shadowrocket feature guide
First, understand the difference between servers, subscriptions, and configuration files. Then choose how to handle traffic. The sections below explain common screens; examples illustrate formats only and cannot be used to connect.
Import a subscription with Subscribe
A subscription lets you retrieve and update server entries in one place. Get the link from your service provider. In Add Server, choose Subscribe as the type, enter the full URL, then save and update. Before importing, check that the link has not been split across lines and that its query parameters are intact. After import, verify the groups and entries rather than just checking whether a name appears. If an update fails, keep any existing usable details, check the link status, and try again. Subscription URLs may contain access credentials, so don't share the full link when troubleshooting.
Read the subscription guide →https://example.com/sub?token=xxxxThe token in this example is fake and cannot be used to connect.
Global Routing
Global Routing determines how connections are handled. Config mode applies the rules in the selected configuration; Proxy mode sends general requests through the selected proxy; Direct mode connects directly. For your first test, note the current selection and change it only as needed for troubleshooting. Changing modes does not change server details or fix an incorrect address or password. To apply rules, make sure the intended file is selected on the Config screen.
See the routing setup steps →Config → Apply the current configuration's rules
Proxy → Use proxy mode
Direct → Use direct modeOn Demand
On Demand lets you set conditions that trigger system connection behavior. Find it in Settings. First confirm that the server and routing work with a manual connection, then enable only the conditions you need. On Demand does not import subscriptions or fix invalid connection details. If the connection turns back on after you switch it off, check the conditions here and observe what happens when you change networks. Temporarily disabling relevant conditions during testing can help isolate the cause; restore your settings when you're done.
Read about On Demand →Settings
On Demand
First, test a manual connection
Then set the trigger conditions
Finally, test a network changeRule matching
Rules are evaluated in the order listed in the configuration, and matching requests are handled by the specified policy. DOMAIN-SUFFIX matches domain suffixes; IP-CIDR matches address ranges; FINAL catches requests not handled by earlier rules. Back up the current configuration before editing, then check the target rule's position and policy name. Adding a rule does not mean it will be matched first. PROXY, DIRECT, and REJECT produce different outcomes. Check request logs when testing instead of inferring rule matches from how a webpage looks.
Read about rule matching and limitations →[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECTProtocols and fields
Shadowrocket can manage connection details for protocols including Shadowsocks, VMess, VLESS, Trojan, WireGuard, and Hysteria2. In Add Server, select the Type that matches your existing details, then verify the address, port, and authentication fields. Required fields vary by protocol, and transport and TLS settings must match the server. Review parsed details after importing a link. Don't reuse settings from another entry just because the port is the same, or assume how a connection will perform based on the protocol name alone.
See the manual entry field guide →Type → Match the existing protocol
Address → example.com
Port → 443
UUID → your-uuid
These field descriptions are for reference only and do not form a usable configuration.Configuration management with Config
The Config screen manages rules and other configuration content; it serves a different purpose from the server list on Home. Servers determine where to connect, while the configuration determines how requests are handled. Both are needed when using Config mode. Keep a copy of the original file before editing. Afterward, confirm the new file is selected and compare results using the same test target. If you use iCloud sync, check your system account and sync status. Sync is not a substitute for a separate backup, nor proof that a subscription updated or another device has completed connection authorization.
Read about configurations and backups →[General]
bypass-system = true
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTApp verification, purchases, and connection testing
What to know before and after buying Shadowrocket
Shadowrocket is a closed-source commercial app. This is the official website and manual. Refer to the App Store product page for availability, purchase, and compatibility details; follow the interface currently shown on your device for app instructions.
- Developer: Shadow Launch Technology Limited
- App ID: 932747118
- One-time purchase
Verify the listing: the name is only the first step
On the App Store, first confirm the product name is Shadowrocket, then check that the developer is Shadow Launch Technology Limited. Compare the listing with the official icon in this site's header, and verify that the app ID in the product page URL is 932747118. Check all three details together; don't rely only on a name, search ranking, or similar-looking icon. You can compare the product page in a browser with the listing in the device's App Store. Before buying, confirm the app name and price on the payment screen.
The official icon helps identify the app; it does not confirm that the app is purchased or installed on your device. If the developer or app ID on the store page does not match, return to the listing and verify it before entering payment details. The app verification guide explains how to check each of these three details, one by one.
Store availability and account region
App Store listings, currencies, and purchase availability depend on the storefront for your current account. A page that won't load or an app that doesn't appear in search is a different issue from a failed app connection: these happen during acquisition, before server configuration is involved. Check the account signed in to the App Store, your network connection, and any messages on the page. Don't convert the US price shown in this manual and assume it applies in every region, or take a product page loading in a browser as proof that your device meets compatibility requirements.
Check the App Store listing for system requirements, device compatibility, and whether the app is a universal purchase. Reviewing the compatibility section before buying is more straightforward than checking after installation. For account or payment issues, follow the information shown in the store rather than trying to resolve them by changing a subscription URL.
App purchases and network services are separate
The US price is approximately $2.99 as a one-time purchase. Prices are shown in local currency in each storefront; check the App Store listing for the actual price. The purchase covers the app itself, not a set of servers. An app purchase is not a network service plan. You need your own subscription or server details; get subscription links from your service provider. This site does not provide, sell, or recommend servers or subscriptions.
So, an empty Home list after payment does not mean the purchase failed; entries appear only after you import them. Conversely, entries in a subscription don't prove that the service is still active. The app purchase record, subscription status, and server availability are separate things and should be checked separately when troubleshooting.
Purchases and restoration across devices
To use Shadowrocket on iPhone and iPad, check your App Store purchase history using the Apple ID used to buy it. Check the App Store listing for details on whether the purchase can be shared across devices. When switching devices or reinstalling, find the app in your purchased items and verify the developer and app ID. If the page still shows a price, first check that you're using the original purchase account and the right storefront; don't make another payment as the first step to restoring a purchase.
Restoring the app does not automatically restore your subscription, configuration, or device authorization. After installation, check the entries on Home, the selected file on Config, and the system connection prompt. If you use iCloud sync, first check the relevant system settings and sync results, then verify each item. Don't overwrite configurations on multiple devices at once before making a backup.
First-time authorization and first-time connection are different
When you first turn on a connection, the system may ask you to allow adding a VPN configuration. This system permission is required to establish a network connection on your device. After granting it, the server address, authentication details, transport settings, and routing must still match. Start by testing a verified entry and leave other settings unchanged for now. If you cancel the permission prompt, resolve that system prompt before checking connection status, so a missing device authorization isn't mistaken for a server problem.
Return to Home and check the selected entry, connection switch, and Global Routing. Connection status is only one indication; test by opening the specific destination too. If it fails, note the network and error message, then narrow down the cause by checking the parameters, routing, and DNS resolution in that order.
How to read Data usage and latency tests
Data usage shows traffic recorded by the app on your device; it should not be treated as a service provider's billing statement. Before comparing figures, check what is being measured and the selected range, and consider when you used the app. Connectivity Test helps assess how entries respond, but it is not a full webpage access test. Results can vary with the test method, target, and network conditions.
If latency looks normal but a webpage won't load, don't keep resorting entries based on the number alone. Test the same target again, then check Global Routing, the selected configuration, and DNS resolution. Results are comparable only when the test conditions are consistent. Server connectivity, DNS resolution, and access to a destination are related but distinct checks.
Handle subscription updates and configuration backups separately
A subscription update can change the server list, while editing a configuration can change routing behavior. Before updating, note the current group and entry; before editing rules, back up the configuration. Don't change the subscription, server, and rule file all during the same troubleshooting session. If the list suddenly appears empty, first check the link and its response instead of clearing existing data. Query parameters in a URL may be needed for authentication, so preserve the full URL when copying it.
Backups may contain server credentials, so store them somewhere you control. When describing a problem to someone else, you can share the protocol, error message, and tests you've already tried, but hide sensitive details such as subscription URLs and passwords. example.com and the sample authentication values in this manual are for illustrating a format only, not a real service.
Order of app updates and settings changes
App updates are managed through the App Store, where you can also view the product's update history. Before updating, keep a copy of your current configuration and note how to reproduce the problem. After the update, retest with the same target before deciding whether to change settings. An app update, subscription update, and rule file update are different: they affect the app, server list, and routing logic, respectively.
This manual does not specify a particular app version or minimum OS version, so changing details aren't treated as permanent requirements. If a screen looks different, find it by its English name on your device, then check the current App Store information. Changing one setting at a time makes it easier to identify the cause and restore the original state.
Selected FAQs
The Home list is empty after purchase. What should I do first?
Import your existing subscription or server details. Get the subscription link from your service provider; the app purchase and server list are managed separately. Save the details, update the list, and check that the entries are complete. See the subscription guide for the full process.
Which Global Routing mode should I use: Config, Proxy, or Direct?
Choose Config mode to route traffic according to rules, and confirm the intended configuration is selected. Use Proxy mode to test a proxy route when appropriate for your test target; choose Direct when you need a direct connection. Note the original selection before switching. See the Getting Started Guide for details.
Why won't a webpage load even though the latency test returns a result?
A latency test and a full connection to a webpage use different targets and processes. Check the current server, routing mode, matched rule, and DNS resolution; don't judge the connection by a single test. Troubleshoot by category in the FAQs.
The connection turns back on after I switch it off manually. What should I check?
First, check the On Demand conditions in Settings. Temporarily disable relevant conditions during testing, observe the system connection status, then decide which settings to restore. Don't delete the subscription and configuration at the same time, or you may lose the original conditions needed to troubleshoot. See the FAQs for more.
Protocols and troubleshooting
Keep reading: fields and connection issues
After your first connection, look up the specific issue you're encountering. Protocol guides explain design and settings, not guaranteed network performance. Troubleshooting articles help you keep test conditions consistent and narrow down the cause step by step.
Protocols
What is Hysteria2? QUIC-based design and use cases
Learn how Hysteria2 handles transport and congestion control. Understand the difference between its design goals and real-world performance on unstable networks, why UDP restrictions may prevent a connection, and which existing details to verify before adding an entry.
ProtocolsVMess vs. VLESS: fields to understand when entering details manually
Learn how UUID, alterId, encryption methods, and TLS settings differ. Follow the Add Server field-checking order to avoid applying one protocol's setup to another.
TroubleshootingSubscription update failed or the list is empty: a five-step checklist
Check the URL format, whether it was copied in full, the service provider's status, update timing, and network conditions, in that order. Keep existing details before testing. Distinguish an invalid URL from an unexpected response or parsing failure, and avoid repeatedly importing without checking.