A rule-based routing client for iPhone and iPad, available as a one-time purchase. Set it up with your existing subscription or server details.
Shadowrocket is a paid client for Apple platforms, available exclusively on the App Store. First verify the app listing and your account’s purchase status, then move on to configuration. Check the App Store listing for system requirements and purchase availability.
Verify the app name, developer, and icon on the App Store product page, then open the app after purchase. On the first connection, follow the system prompt to add a VPN configuration. Buying the app does not configure a server; you’ll still need to import your own connection details.
See the iPhone purchase guide →Use the Apple Account you purchased with to check your purchases and the storefront’s universal purchase availability. Restoring the app and restoring its configuration are separate steps: after reinstalling, check your existing subscription, current servers, and active Config.
See the iPad purchase guide →Check the product page’s price, compatibility, purchase availability, and update history separately. If you can’t find the app, first check your Apple Account’s storefront region, age-rating restrictions, and account status. Then locate the product page by app ID; don’t rely on a similar-looking name in search results.
An app purchase is not a server subscription. Buying Shadowrocket gives you the right to use the app; it does not include a server or subscription. This manual explains how to configure information you already have. This site does not provide, sell, or recommend servers or subscriptions.
Open the App Store and check the product name, Shadowrocket; the developer, Shadow Launch Technology Limited; and the product page URL, which should contain id932747118. The app icon should match the official icon shown in this site’s header. A similar name alone is not enough: verify all three details on the same product page before purchasing, rather than relying on separate search results.
If the expected app doesn’t appear in search results, check which storefront your account is using, then review Content & Privacy Restrictions in Screen Time. Whether the App Store displays a purchase button or allows payment depends on the listing shown to your account and the system prompts. Reference prices in this manual don’t replace the checkout price, and shouldn’t be taken to mean all storefronts show the same currency or amount.
Shadowrocket is a closed-source commercial app sold as a one-time purchase. The US storefront reference price is $2.99; check the current App Store listing for the actual price. See the listing for universal purchase availability across iPhone and iPad, system requirements, and other purchase conditions. To check in-app purchases, read the relevant section in the store listing rather than relying on old screenshots.
When switching devices or reinstalling, use the Apple Account you purchased with to check your purchases, then verify whether your local configuration was restored. Getting the app again doesn’t guarantee that subscriptions, server passwords, and custom rules have all been restored. If iCloud sync is enabled, check each item’s sync status. App updates are managed through the App Store; after updating, verify the active configuration and connection status rather than relying on old button locations.
Before changing settings, understand what server details, routing modes, and configuration files each control. The six sections below reflect the app’s capabilities. Example rules illustrate syntax only; they aren’t intended as drop-in replacements for your existing configuration.
Rules associate destination domains or addresses with a policy. In Home, select Config under Global Routing, then check which file is active in Config and the order of its rules. DOMAIN-SUFFIX matches domain suffixes; IP-CIDR matches address ranges; FINAL handles requests that don’t match an earlier rule. Keep a copy of the original file, change one condition at a time, and test the target request to see which rule matches. An enabled connection switch alone doesn’t confirm that traffic is using the intended policy.
DOMAIN-SUFFIX,example.com,PROXY
On Demand triggers connections when specified conditions are met; it doesn’t fix server settings. First select an existing server manually, authorize the system VPN configuration, and verify access. Then check the On Demand options in Settings. Test what happens when the network changes, the app reopens, or you disconnect manually, and confirm the conditions suit your use. If connections keep triggering, note the network conditions and temporarily disable automatic triggers for comparison, so you don’t mistake automatic connection behavior for a server issue.
Settings / On Demand
Shadowrocket supports protocols including Shadowsocks, VMess, VLESS, Trojan, and Hysteria2. Available options are listed under Type in Add Server. Choose the protocol that matches your existing server details; changing Type alone while keeping fields from another protocol won’t work. After entering Host, Port, and authentication details, check TLS, transport, and any other parameters required by the server. If the connection fails, compare each field with the original information instead of switching protocols at random to judge server quality.
Add Server / Type / Host / Port
A subscription imports and updates server details you already have. First identify whether you have a server subscription, a single share link, or a Config URL, then choose the appropriate entry point. Enter server subscriptions in Add Server using the applicable type. In Config, use Subscribe for a Config subscription; don’t treat different content as interchangeable just because the URLs look similar. After updating, check the groups, item count, and selected entry, and keep the original subscription record. Subscription URLs may contain credentials, so redact the full link before sharing troubleshooting screenshots.
Add Server / Subscribe / Scan QR Code
Config manages rules and related settings. Successfully importing a server doesn’t mean the required configuration file is active. First confirm the file’s source and purpose, then review sections such as General, Rule, and Hosts to make sure they fit your access policies. Make a copy before editing, verify which file is selected afterward, and test the same destination for comparison. Understand DNS and URL Rewrite entries separately. Don’t replace an entire configuration or change multiple sections at once to fix a single server connection issue.
Config / General / Rule / Hosts
Connectivity Test, Diagnostics, and Data in Settings help you check different aspects of the connection. Before testing, note your local network, selected server, and Global Routing mode. Run the test, then cross-check with an actual web request. Results depend on the test method and destination, so they don’t represent the speed of every site. Traffic recorded under Data isn’t the same as a service provider’s billing allowance. Change one variable at a time while troubleshooting, check relevant logs when needed, and remove addresses, authentication details, and subscription credentials before sharing any materials.
Connectivity Test / Diagnostics / Data
The Config, Proxy, and Direct options in Global Routing represent configuration, proxy, and direct modes. Config processes requests according to the active configuration; Proxy routes requests in proxy mode; Direct handles them in direct mode. Check server connectivity separately from the policy applied to a particular domain. When using Config, also verify that policy references in the file are valid. Importing a file doesn’t mean it’s active.
Data shows traffic recorded by the app; iCloud sync can sync relevant data when supported. Neither replaces connection testing or an independent backup. Before using multiple devices, check the selected server, configuration name, and settings on each one. Matching filenames don’t guarantee that the contents or active status are identical. See the Features page for the full feature guide, and check interface terms and rule keywords in the Quick reference.
These steps assume you’ve purchased the app and already have your own subscription or server details. Start with a manual connection, then configure automatic connections and more specific rules. Check the result at each step so you can pinpoint where something goes wrong.
In Home, tap Add Server and first identify the type of information you have. To enter a server manually, select the Type shown in your original details, then enter Host, Port, and authentication fields. If you scan a QR code, use Scan QR Code and check the parsed protocol and address. A subscription link isn’t an ordinary web address: copy it in full, without chat text, spaces, or line breaks. Different formats require different entry points; don’t import every link as the same type of content.
After saving, return to Home and confirm the entry appears in the expected SERVER group, then select the server you want to test. If the list is empty, check that the import completed, the link is still accessible, and the returned content matches the selected entry point. If you have multiple subscription groups, give each a recognizable name and check whether the selected item changes after an update. For subscription updates, sorting, or backups, see the Server Management Manual.
Open Global Routing and choose Config, Proxy, or Direct for your test. To route traffic using domain and address rules, select Config and confirm which file is active in Config. If you switch to Proxy temporarily to isolate a problem, note the original mode and restore it after testing. Successful access after a mode switch doesn’t mean the original rules are fixed. Direct provides a comparison with a direct connection, but doesn’t indicate whether your existing proxy server is available.
Keep the initial setup simple. Avoid adding several rule sets, changing DNS, and enabling automatic connections all at once. Check rules against a specific destination: note the domain, expected policy, and actual result, then review the match conditions and their order. A fallback rule such as FINAL affects requests that haven’t matched earlier conditions; check both its position and assigned policy. example.com is used only to illustrate syntax. Decide whether to add a rule based on your own destination and configuration.
Return to Home and turn on the connection switch. On the first connection, read the system prompt to add a VPN configuration and follow the authorization steps. Then check the connection status, run Connectivity Test, and open a page you actually need to access. A connected status only indicates that the connection flow reached that state; DNS resolution, server forwarding, the destination site’s response, and rule selection can still fail independently. Consider the status, test results, and actual requests together.
If you can’t access a site, first check whether your local network works with the connection off, then review the selected server, Global Routing, and Config. Keep the test destination the same, change one setting at a time, and record the results before and after. Wi-Fi and cellular networks can help compare local conditions, but check the connection status again after switching. Enable On Demand only after testing, and make sure its automatic triggers won’t interfere with further manual troubleshooting.
A failed subscription import, a failed connection test, and a web page that won’t load are different issues. For a failed subscription, check the link is complete and accessible, and that its content type is correct. For a failed server test, compare the address, port, protocol, and authentication details. If only some sites fail, check DNS resolution and rule matches. If every entry behaves the same on one network, first rule out local network restrictions or VPN authorization issues rather than changing every server.
A troubleshooting note should include what happened, the network in use, the current mode, the selected server group, and each individual change you made. Keeping these details helps avoid repeated trial and error. When sharing information, include only what’s needed to diagnose the issue, and hide subscription URLs, passwords, and other credentials. Don’t share an entire configuration in place of describing the problem, and don’t delete everything and start over because one test produced a different result.
Browse guides by issue: identify the right import method, then check the connection path. To investigate speed or availability, look separately at your local network, server settings, routing mode, and DNS. Don’t rely on a single test result for the full picture.
For users with an existing subscription or server details, this guide explains what Subscribe, Add Server, QR scanning, and the clipboard are for. Identify the link type before importing, then check the group and selected server. Don’t confuse a server subscription with a Config file.
Read the import guide →Start with the server status, then check Global Routing, DNS, and rules such as FINAL. Distinguish system connection status from actual request results. Record each individual change to narrow down the issue instead of repeatedly replacing the entire configuration.
Read the connection troubleshooting guide →Compare local Wi-Fi with cellular first, then check protocol settings, server conditions, and individual servers. Distinguish test methods from actual traffic. Evaluate latency, access success, and download performance separately, using repeatable test conditions.
Read the speed troubleshooting guide →