Official Guide · Browse by Question

Shadowrocket FAQ

From App Store purchase to routing rules, identify where the issue occurs and check each step in order. The instructions assume you already have your own subscription or server details. Interface labels are kept in English.

Select a question to expand its answer. Each item opens independently for easy reference. For the full setup process, see Getting Started; for step-by-step troubleshooting, see Troubleshooting.

Verify the app and purchase on the App Store

Confirm the app's identity first, then check your purchase account and device compatibility. Use the App Store product page as the source for pricing and compatibility details.

Can't find Shadowrocket in the App Store? Check these first

Open the App Store product page from this site instead of relying on search results alone. Check the country or region of the Apple Account used for Media & Purchases, along with any availability notices shown in the store. To check the region, open Settings, tap your Apple Account, select Media & Purchases, then View Account and Country/Region. Before changing it, review the balance, subscriptions, and payment requirements listed by Apple. Availability is determined by the App Store product page.

How to identify the genuine Shadowrocket app in the App Store

Check three details: the developer is Shadow Launch Technology Limited, the icon matches the official icon shown on this site, and the app ID in the product page URL is 932747118. A similar name alone does not confirm an app's identity. Open the product page to verify its icon rather than relying on search results. Before purchasing, review the price, compatibility, and app details. If anything does not match, stop and reopen the product page from this site's app link. The App Store is the only way to get the app.

Do I need to buy Shadowrocket again after getting a new iPhone or reinstalling it?

Sign in to the App Store with the Apple Account used for the original purchase. Find Shadowrocket in your account's Apps or Purchased list, then use the redownload option. Your device's Apple Account and the account used for Media & Purchases may differ, so check which account made the purchase. If the app still shows a price, check your purchase history, hidden purchases, and account region before paying again. Purchase eligibility and device compatibility are determined by the App Store product page.

What does a one-time purchase include, and why do I still need a configuration?

Shadowrocket is a paid client, and a one-time purchase gives you the right to use the app. Buying the client does not include a service plan or automatically provide server details. The U.S. storefront lists the price as $2.99; other storefronts show local currency, and the current price is determined by the App Store product page. Before connecting, you need your own valid subscription or server details. This site explains how to use the client but does not provide, sell, or recommend servers or subscriptions.

Can I install Shadowrocket on iPad? How do I check compatibility with Mac and Apple TV?

Check and get Shadowrocket for iPhone and iPad from the same App Store product page. On iPad, first confirm the purchase account, then look for the redownload option. The layout may differ on a larger screen; use interface labels such as Home, Config, and Settings to find your way around. Check the compatibility section on the same product page for Mac, Apple TV, and Apple Vision. System requirements and purchase eligibility are determined by the App Store product page; do not infer compatibility from whether the app installs on another device.

Installation and first launch

Check your network, selected configuration, and system authorization before troubleshooting the connection switch. Reinstalling the app and restoring configurations are separate processes.

What should I do when iOS asks to authorize a VPN configuration the first time I connect?

Make sure your own valid configuration is selected in Shadowrocket before using the connection switch. When connecting for the first time, the system may ask to add a VPN configuration. Confirm the request is from the Shadowrocket app you just opened, then follow the system prompts and authenticate your device. This authorization sets up the client's network connection; it does not replace server details. If you dismissed the prompt, return to the app and try connecting again. If your device is managed by an organization, check whether its management policy allows VPN configurations.

Home connection switch won't turn on or turns off right away. What should I check?

Check that an entry is listed and selected in the SERVER section of Home, then confirm that system VPN authorization is complete. Next, check for another active VPN configuration or device management restrictions; keep just one connection configuration enabled while testing. If the switch still turns off immediately, note any system message, quit and reopen the app, and restart the device if needed. Don't start by deleting every configuration or reinstalling the app. Back up your existing settings first, then narrow down the cause using the troubleshooting guide.

The interface is in English. What are Home, Config, Data, and Settings for?

Home shows connection status, lets you select a SERVER, and provides common connection controls. Config manages configuration files and rules. Data shows available traffic or connection records. Settings contains app preferences. The exact options depend on the current app interface. The official guide keeps these English interface labels so you can match them directly; the descriptions explain what each area does. To get started, import and select an entry in Home, then check Global Routing. You don't need to change several Settings options at once just to connect.

Will my subscriptions and rules come back automatically after reinstalling the app?

Restoring an App Store purchase restores your eligibility to get the app; it does not restore all in-app configurations. Before reinstalling, save your subscription URL, any required server details, and the Config file you currently use. If you rely on backup or sync, make sure the backup can be read first. After restoring, check SERVER, the selected Config, and Global Routing before connecting. Subscription URLs and configurations may contain credentials. Store them securely, and don't post their full contents in screenshots or support requests.

Should I test Wi-Fi before connecting, or adjust the client settings first?

Disconnect Shadowrocket and make sure your current Wi-Fi or cellular network can open commonly used pages. If public Wi-Fi requires a sign-in page, complete network authentication first. Once the basic connection works, open the app and test your existing configuration. To compare networks, test Wi-Fi and cellular using the same configuration, keeping potential data charges in mind. If only one network fails, check its authentication, routing, or restrictions first. Leave protocols, rules, and DNS unchanged for now so you can identify the cause without changing several variables at once.

Import subscriptions and servers

This section covers information you already have. Check the result of each step separately: importing, updating, selecting a SERVER, and connecting.

Where do I import an existing subscription URL?

Make sure you copied your own complete subscription URL, not an account webpage or instructions page. In Home, open Add Server, set Type to Subscribe, enter the URL and a recognizable name, then save and wait for the import to finish. The location of options can vary, so follow the app's current interface. After importing, check that the group and entries appear, then select a valid entry. Saving a subscription URL does not connect you. A subscription and a Config file serve different purposes and aren't interchangeable just because their URLs look similar.

Subscribe import failed or returned an empty list. How should I troubleshoot it?

First make sure your basic network connection works. Check that the URL isn't missing characters or containing spaces or line breaks, and that you still have access to it. If the list is empty, confirm that the response is subscription content supported by the client—not a login page, notice, or error page. If the URL is valid but fails on one network, try again on another available network. If the problem persists, note the error and ask the provider of your existing service to check the URL's status and format. Don't share the full URL or try to fix the issue by repeatedly adding the same subscription.

How do I update an existing subscription? Do I need to select SERVER again afterward?

In Home, find the existing subscription group and use its menu to update it. Wait for the request to finish before checking the result. If automatic updates are enabled, check the relevant switch, conditions, and most recent result instead of assuming the update worked because the entries are still there. An update may change entry names or counts. If the selected SERVER was removed, select another one. Keep a record before manually editing entries generated by a subscription, as the next update may overwrite those changes. Updating a subscription is not the same as updating a Config.

When adding a server manually, which Add Server details are easiest to get wrong?

Match Type to the protocol in your existing server details, then check the address, port, and authentication fields one by one. Protocols such as VLESS, VMess, and Trojan require different fields; changing Type while keeping the other parameters may not work. If TLS or a specific transport is enabled, check the required SNI, Host, path, and other details in your existing instructions, including capitalization and extra spaces. Don't turn off certificate verification as a substitute for checking parameters. Save your changes, select the entry, and then test the connection.

Scan QR Code imported successfully, so why can't I connect?

A successful Scan QR Code usually means the code was recognized and added as an entry; it doesn't confirm that the server is available. First make sure the QR code came from your own valid configuration, then check that the imported protocol, address, port, and transport details are complete. If you scanned an image, make sure the app read the intended code. Next, confirm the entry is selected in Home and check Connectivity Test and actual access. QR codes may contain credentials, so don't share them publicly. You must still authorize the system VPN configuration and connect separately after importing.

Routing rules and troubleshooting

Distinguish system connection status, server reachability, rule matches, and DNS resolution. Change one condition at a time and keep a way to restore your settings.

How should I choose Config, Proxy, or Direct in Global Routing?

Config routes traffic according to the selected configuration file and its rules. Proxy sends eligible traffic through the proxy mode and still requires a valid SERVER. Direct handles traffic directly; it cannot be used to test whether a proxy server works. Use Config for everyday use when your rules are set up correctly. You can switch briefly to Proxy to compare results when narrowing down the effect of rules. Restore the original mode after testing. Don't confuse the Global Routing modes with the PROXY and DIRECT policy keywords in rules.

It says connected, but webpages won't load. What should I check next?

Connected means the system connection is established; it doesn't mean every destination is reachable. Disconnect first and make sure the basic network works. Then check that the selected SERVER is valid and use Connectivity Test as one diagnostic. Test several destinations rather than just one page. If only Config is affected, briefly compare with Proxy and focus on rule matches and policies. If domain access fails and other signs point to a resolution problem, check DNS. Change one setting at a time and note the original values; don't change rules, protocols, and DNS together.

What does a Connectivity Test timeout or a successful result tell me?

Connectivity Test results depend on the test method, destination, and current network. A timeout could mean the server is unreachable, authentication failed, the test destination is having issues, or the network is restricted; it doesn't prove the entire subscription is invalid. A successful result doesn't guarantee that every app and website will work. Compare existing entries using the same network and destination, then consider actual access and connection records. If the test fails only on Wi-Fi or cellular, check the network differences first. Don't treat a single test result as a complete speed assessment.

Rules aren't working as expected. Should I change DNS right away?

First confirm Global Routing is set to Config and that you're using the intended Config file. Then check the rule order to see which rule matches the domain or address first, and verify its policy and the final rule, FINAL. A broader rule earlier in the list may match before a more specific one. DNS affects domain resolution but can't fix every incorrect policy choice. Check system DNS, custom DNS, or DNS over HTTPS reachability only when evidence points to a resolution problem. Keep the original settings so you can restore them.

Battery drains during long connections. Should I turn off On Demand?

Compare battery use over the same period on the system's Battery page, and check background sync, signal strength, and actual traffic. Continuous transfers, frequent reconnects, and extensive diagnostic logging can all use more power; the VPN indicator alone doesn't identify the cause. On Demand starts connections based on conditions. If you're investigating unexpected reconnects, temporarily turn it off and connect manually for comparison. Avoid running frequent batches of tests. Keep network conditions and usage time similar in each round, then compare results. Restore any settings you still need once you identify the cause; there's no need to turn everything off at once.

Download Shadowrocket