Official Manual · App Store
A client for iPhone / iPad that uses rule-based routing to direct requests. The app is a one-time purchase on the App Store; get subscriptions and server details from your service provider.
This rule sheet is a documentation example; the sample domain does not represent an available service. Check the App Store listing for system requirements and purchase availability.
Feature overview
Check your information sources first, then choose Global Routing, and finally verify which rules match. These six topics cover the key parts of everyday configuration. Interface labels and rule keywords remain in English.
In Home > Global Routing, Config processes requests according to the selected Config file, Proxy sends applicable requests through the selected proxy, and Direct connects without a proxy. For everyday routing, choose Config first, then confirm which file is enabled in Config. Within [Rule], requests are matched in order; the first matching rule applies PROXY, DIRECT, or REJECT. FINAL handles requests that did not match any earlier rule. To troubleshoot a domain's route, check the current mode, rule order, and policy target together. The connection toggle alone does not tell you how a request is routed.
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTOn Demand establishes a connection when specified conditions are met. Review the related options in Settings. First confirm manually that the server and Config work, then set automatic connection conditions so a parameter error is not mistaken for an On Demand issue. During testing, note the current network, change one condition at a time, and check the system's connection status for unexpected triggers. On Demand controls when to connect; Global Routing controls how requests are handled after connection. They serve different purposes, and changing one does not automatically fix the other's configuration.
Settings → On Demand
Home → Global RoutingShadowrocket supports protocols including Shadowsocks, VMess, VLESS, and Trojan. To use existing server details, select Type in Add Server, then enter the Host, Port, and authentication fields provided by your service provider. Fields vary by protocol; TLS, SNI, and transport settings must also match the server. Saving an entry only confirms that it was added, not that the connection has been verified. If it fails, compare each field with the original details, especially the address, port, authentication information, and certificate validation. Don't cycle through Type options instead of checking the parameters.
Add Server → Type / Host / Port
Trojan → Password / TLS / SNIGet the subscription link from your service provider. In Add Server, select Subscribe, fill in the fields as shown, and save; then update to retrieve the server entries. After importing, check that the group and entries appear, then select an entry and test the connection. A single share link usually describes one server, while a subscription may add or remove entries when updated; link length alone doesn't tell them apart. If an update fails, determine whether the link is unreachable, authentication has expired, or the content format is incompatible. Never share a full link containing access credentials in public screenshots or logs; keep only the error message when troubleshooting.
Add Server → Type → SubscribeConfig manages files that affect DNS resolution, rule matching, and request handling. Common sections include [General], [Rule], [Host], and [URL Rewrite]. Keep a working copy before making changes, and change one setting at a time so you can compare results and roll back. The server list describes connection targets; a Config file describes how requests are handled. Importing one does not mean the other is ready. Before using iCloud sync, check your device's iCloud settings and the actual sync scope in the app. After syncing, confirm the selected Config and server; check system VPN authorization separately on each device.
[General]
dns-server = system
[Rule]
FINAL,PROXYConnectivity Test in Home is a useful starting point for checking connectivity. For a closer look at network status, use Diagnostics in Settings. Data shows traffic activity, which should be interpreted in context: the statistics range, time period, and routing in effect. Traffic shown for an item does not mean every request to its destination succeeded. If a test fails, note the current network, selected server, Global Routing mode, and failed destination, then check DNS resolution, the connection, and rule matches in turn. Changing one condition at a time makes the cause easier to identify than changing the server, DNS, and Config all at once.
Connectivity Test
Settings → Diagnostics
DataDevices & availability
The App Store is the only place to get Shadowrocket. Check the product page for compatibility and purchase information, then buy or redownload the app on the device you plan to use. Check the App Store listing for system requirements and purchase availability.
Verify the app on its App Store product page, then open Shadowrocket after purchase. When establishing a connection for the first time, the system may ask for permission to add a VPN configuration. Confirm which app is requesting authorization, then follow the system prompts. Once you have an existing subscription or server details ready, continue with import and connection testing.
See the iPhone guide →iPhone and iPad may share a purchase; check the App Store listing for purchase availability. Use the Apple ID used for the original purchase to check your purchases, then get the app on iPad. A wider display does not change the configuration principles: verify the server, Config file, and system authorization separately.
See the iPad guide →Shadowrocket is also available through the same App Store on Mac and Apple TV. Check the App Store listing for system requirements and purchase availability.
A working internet connection, an installed app, and an available proxy server are three separate requirements. Before configuring Shadowrocket, make sure your current network can access the services you normally use, then have your subscription or server details from your service provider ready. This makes it easier to distinguish basic network issues from client parameter errors, without repeatedly reinstalling the app.
When switching to another device, recheck the selected server and Global Routing. Even if both devices use the same filename, the file contents, enabled status, and local authorization may differ. Test with a specific destination before everyday use; “downloaded” or “synced” does not mean the connection is ready.
Purchase & Verification
Shadowrocket is a closed-source commercial app. This is the official Shadowrocket website and manual. Refer to the App Store product page for purchase information and the app's current interface for configuration details.
App Store search results may include apps with similar names or icons. The name “Shadowrocket” alone is not enough to verify an app. Open the product page, confirm the developer is Shadow Launch Technology Limited, compare the official icon, and check that the App ID in the product page URL is 932747118. All three details should identify the same product; don't combine information from different search results. The button on this page links to that product page, and the download guide shows where to check each detail.
Verify the app on its product page, not from a search snippet, list thumbnail, or name in a screenshot. You may need to expand the product information to see the full developer name; check the digits in the product page URL one by one as well. Once verified, review the price and compatibility to avoid purchasing an app with a similar name. Use the same product page if you need to get the app again. The purchase button or cloud download icon may vary with your account's purchase status.
Whether the product appears in your current store depends on the App Store storefront associated with your Apple ID and local availability. If you can't find it in search, first check the store account and storefront you're using, then open the product page and review any messages. A missing search result does not by itself mean your device is incompatible. Check the App Store listing for price, purchase availability, system requirements, and purchase eligibility. Manage account details and payment methods in Apple's system settings and store interface.
Before purchasing, check that the system account on your device and the account used for App Store purchases are the ones you expect. They may serve different purposes, so use the account currently signed in to the store when checking purchase history. If the page says you can't make a purchase, read the reason and check the storefront, payment status, and device compatibility. Closing the app or changing its configuration won't change the App Store's purchase requirements.
The US storefront price is about $2.99 as a one-time purchase. Prices appear in local currency in other storefronts; the amount charged is shown on the App Store page and at purchase confirmation. The purchase gives you the right to use the app; it does not provide server access or subscription links, authentication details, or rule files. Keep purchasing and configuration separate: get the correct app, connect using information you already have, then configure routing.
If the app opens but no servers are available to select, import the information you already have instead of buying the app again. If a server entry appears but authentication fails, check the parameters and status provided by your service provider. The app purchase does not determine server passwords, subscription contents, or network routing. Keeping these separate helps you identify whether to check your purchase history, app settings, or existing service details.
When reinstalling or switching devices, use the Apple ID associated with the original purchase to find Shadowrocket in App Store purchases, or open the verified product page to see the available options. Check the App Store listing for the terms that apply to using one purchase on iPhone and iPad. If the status differs from what you expect, check the purchase history, store account, and product ID before proceeding. Redownloading the app does not restore local configuration.
Purchase history confirms eligibility to get the app; subscriptions and Configs are materials for using it. Before changing devices, check the app's options for saving, exporting, or syncing with iCloud, and confirm what has been retained. After restoring, check the servers in Home, the selected Config, and Global Routing, then follow the system prompts to review VPN configuration authorization. Check the App Store listing for Family Sharing eligibility and its terms.
Update the app through the App Store; you can manage updates in your device's automatic update settings. This manual explains features by name rather than relying on a version number that may not match your interface. If connection behavior changes after an update, first check whether the original server, mode, and Config are still selected, then review system authorization and network conditions. Avoid changing several settings before noting their original values, or it will be difficult to identify the cause.
Permission to add a VPN configuration authorizes the client to establish a network connection; it does not prove that a server is reachable. The connection toggle, successful domain resolution, and access to a destination are separate steps. After granting permission, test a specific destination and check that requests follow the expected policy. If something fails, troubleshoot the connection, DNS resolution, and rule matching in sequence rather than relying on the status text alone.
For your first setup, follow the complete guide: import an existing subscription or server, choose Global Routing, allow the system to add a VPN configuration, and test access to a destination. If the connection works but some requests take an unexpected route, see the Config reference. Check whether earlier rules override the intended rule, whether FINAL is at the end, and whether the selected policy points to an available server. Handle purchase issues and request routing separately; there's no need to switch back and forth between the two.
If Shadowrocket won't connect, first note what failed: a subscription update, Connectivity Test, or access to a particular destination. For Shadowrocket DNS settings, check the DNS settings in the current Config and the system network conditions. For Shadowrocket global routing, distinguish the Config, Proxy, and Direct options in Global Routing. Changing the mode changes the request path, but it won't fix incorrect server authentication details.
View the Shadowrocket setup guide → See the complete rules and Config reference →
Articles & topics
Beyond basic setup, use these topic guides for specific questions. Share link formats, protocol authentication fields, and rule policies are different layers. Identify which layer you're changing before checking whether the result is what you expected.
A single share link usually describes one server, while a subscription link provides a list of entries that can be updated. This article explains the structure and encoding of four link types, what to check after importing, and why recognizing the format, importing its contents, and connecting to a server are separate steps.
Read the guide to link formats →REJECT is a policy applied when a rule matches; it is not a standalone content detection feature. See how real rule snippets such as DOMAIN-SUFFIX work, including match scope, order, and the risk of unintended blocking. A rule can affect only requests that it actually matches.
Read the REJECT rule guide →Starting with how Trojan uses TLS, this guide walks through the address, port, password, SNI, and certificate validation fields in Add Server. Get parameters from your service provider and check each one against the actual error message instead of changing several fields at once.
Read the guide to Trojan parameters →When reading Config examples, remember that sample domains illustrate syntax only; choose a policy direction that suits your needs. Before adding a code snippet to Config, understand which requests it will match, whether it overlaps with existing rules, and which FINAL rule handles unmatched requests. Keep a copy of the original file and test one change at a time to make troubleshooting and rollback more reliable.