A rule-based proxy client for iPhone / iPad. Buy it once through the App Store, then set up your connection using your existing server details and configuration.
Home screen
Getting started with Shadowrocket involves three steps: prepare your existing server details, choose how traffic should be routed, and turn on the connection. Purchasing the app only gets you the client; you’ll need to obtain the server address, credentials, and subscription link from your own provider.
On Home, check whether SERVER already has an entry. To add details manually, open Add Server; if you’ve already imported a server, tap the dot beside it to set it as the default. Then check Global Routing. Selecting a server and choosing a routing mode are separate actions.
The illustration on the right shows the Home screen layout; it is not an app screenshot. The connection toggle, Global Routing, and Connectivity Test are the places to check in sequence when connecting for the first time. The illustration identifies the menu items; actual field layouts may vary in the app. Check the App Store listing for system requirements and device compatibility.
Read the complete user guide by section →
Settings index
Servers, rules, and connection conditions each have their own settings. Identify what you want to change, then use the corresponding menu. When troubleshooting, change one setting at a time so you can tell what made a difference.
The three commonly used Global Routing modes are Config, Proxy, and Direct. In Config mode, rules in the selected configuration are evaluated in order; the first match determines where a connection goes. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches address ranges, and FINAL handles traffic that hasn’t matched an earlier rule. First confirm that the intended configuration is selected, then check rule order and policies. Otherwise, changes to rules won’t have the expected effect in Proxy mode. The example below routes specified domains through PROXY and everything else through DIRECT; the example domains are for illustration only.
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTOn Demand triggers system connections when specified conditions are met. It does not provide servers or change the order in which rules are matched. Open the relevant item in Settings, check the conditions, then decide whether to enable it. First make a manual connection to confirm that your existing server works, then test what happens when the network changes. If the connection starts again after you turn the toggle off, check whether any conditions here still match the current network. For troubleshooting, temporarily disable On Demand and record the result of a manual test. Once you’ve identified the cause, restore only the conditions you need so automatic connections aren’t mistaken for a faulty toggle.
Settings
On DemandShadowrocket supports protocols including Shadowsocks, VMess, VLESS, Trojan, and Hysteria2. In Add Server, choose Type based on the information from your provider, then enter the address, port, and authentication details. The fields vary by protocol; don’t copy just the address and reuse the other settings from a different server. Match TLS, transport, and certificate name settings individually when applicable. A protocol name alone doesn’t tell you whether a server will work. After saving, set it as the default and test the connection. Judge the result by actual connectivity, not just by the protocol label.
Add Server
Type
Host
PortSubscribe imports a server list from a link you already have. Before importing, make sure the link came from your own provider and preserve all query parameters. A website login URL is not a subscription URL. In Add Server, choose Subscribe and enter the link, then save and check the imported entries. Updating a subscription changes the server list; it does not necessarily change the active routing configuration. If the list is empty, check that the link is valid, review the response, and test your network, then consult your provider’s import instructions. Subscription links may contain credentials, so treat them as sensitive and don’t show them in public screenshots.
Type: Subscribe
https://example.com/sub?token=xxxxConfig stores rules and related network settings separately from the list of saved servers. Open Config, confirm which file is selected, then check the entries and order under Rule. Keep a recoverable copy before editing. Test with a few rules first, then add conditions gradually. Domain rules usually need to go before the fallback rule; otherwise, earlier rules may already have handled the traffic. If you use iCloud sync features, check the actual files and selection state on each device. Purchase records, configuration files, and the current connection are separate things; restoring one does not restore all settings.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECTConnectivity Test checks whether a test target can be reached. Its latency reading is not file transfer speed and cannot replace testing the sites you actually use. Select a server and turn on the connection before running the test. If the test succeeds but a particular site doesn’t, check which rule matched and how the domain was resolved. Data shows app-recorded readings such as uploads and downloads; its scope differs from your carrier’s bill. For further troubleshooting, open Diagnostics in Settings and review the error details alongside your network, credentials, and configuration. Remove server addresses and subscription parameters before sharing logs.
Home → Connectivity Test
Data
Settings → DiagnosticsGetting Shadowrocket on Apple devices
Shadowrocket is available only through the App Store. Check compatibility and purchase details on the product page before installing. Availability, purchase options, and system requirements are as listed on the App Store page.
After checking the App Store listing, purchase and open the app. The first time you connect, iOS will ask to add a VPN configuration. Review the prompt and approve it, then return to Home to check the toggle and default server. Approval lets the app establish a connection; it doesn’t confirm that the server works.
iPhone setup guide →Use the same Apple ID to view your purchases and confirm the purchase record before getting the app. Purchases may be shared between iPhone and iPad; check the App Store listing for eligibility. After installation, check the server, configuration file, and permissions on this device. Don’t skip setup just because the app is already connected on another device.
iPad setup guide →Shadowrocket is also available through the App Store on Mac and Apple TV. Check the App Store listing for device compatibility, system requirements, and purchase eligibility.
The App Store shows the app’s purchase status; connection status depends on permissions, your existing server, and the current network. When moving to another device, first confirm that the purchase is available, then check each imported item. An “Already Purchased” indicator does not mean your configuration has synced.
First connection: step by step
Start with a subscription or server details you already have. Check the result after each step. If something goes wrong, return to the last state you confirmed was working.
Open Home, then Add Server. To add a server manually, choose Type, then enter Host, Port, and the required authentication details. To use an existing subscription, choose Subscribe and enter the full link from your provider. After saving, return to the list and confirm the expected server appears. Tap the dot beside it to set it as the default.
If no entry appears after importing, first check that you entered a subscription link and that no trailing parameters were lost when copying it. Seeing a name in the list only confirms that a record was created; it doesn’t confirm successful authentication. Don’t change several fields at once. Check each one against the original details from your provider, especially the port, password, and protocol type.
To route traffic according to rules, choose Config and confirm the selected file on the Config page. Proxy and Direct route traffic through a proxy or directly, respectively; they work differently from Config, which selects a route based on rules. Decide whether you’re testing server connectivity or whether a particular rule is working, then choose the appropriate mode.
When editing rules for the first time, start with a few entries you can easily understand. Check that rules for specified domains appear before FINAL and that the policy keywords match your intended routing. A webpage opening occasionally doesn’t prove that the right rule matched. Compare the expected route with the connection records before adding more complex rules. For keyword definitions, see the glossary.
Return to Home and turn on the connection. The first time you’re prompted to add a VPN configuration, review the details and follow the system prompts to approve it. Check the status in the app, run Connectivity Test, then visit a site you actually need to use. The test only checks its test target, so also confirm that everyday traffic follows the selected route.
If the connection fails, first check that the default server is selected, then check the authentication details and current network. If the connection stays on but some sites fail, check the configuration rules, DNS resolution, and the status of the destination service. Differences between Wi-Fi and cellular results can help narrow down the cause, but don’t change every setting based on that alone. Repeat the same test after each change so you can tell whether it helped.
View the complete guide →App Store verification and one-time purchase
This is the official Shadowrocket website and manual. Shadowrocket is a closed-source commercial app. Get, purchase, and update it through the App Store. These instructions are based on the App Store listing and the wording shown in the app.
Official app iconCompare it with the icon on the App Store product page
When searching for the app, don’t rely on the name alone. Open the product page and check that the developer is Shadow Launch Technology Limited, then compare the official icon and the id932747118 in the product page URL. Similar names don’t mean it’s the same app; verify all three details together. The official icon on this site can help you identify it, but confirm purchases on the App Store product page.
If the expected app doesn’t appear in search results, check your current storefront region and whether the product page is available, then review any message from the App Store. App availability, local pricing, and purchase terms can vary by storefront. Follow Apple’s instructions for account region and payment matters. Server settings in the app don’t affect whether the app appears in the store.
The US storefront reference price is $2.99 as a one-time purchase. Other storefronts show local currency; the actual price is the amount listed on the App Store page when you confirm the purchase. The one-time purchase is for the client, not for connection services. Check server availability, account expiration, and access to your destination separately.
Subscribe is a way to import and update a server list in the app; it isn’t generated automatically when you purchase the app. A successful import doesn’t mean every entry will work. If authentication fails, the list has expired, or the response is incorrect, first check your own service details. For issues with the app’s connection process, follow this guide to check the default server, routing, and permissions.
After changing devices or reinstalling, use the Apple ID you purchased with to check your App Store purchases. Purchases may be shared between iPhone and iPad; check the App Store listing for purchase eligibility and Family Sharing availability. If you see another payment prompt, first check the account, app ID, and purchase record. Don’t assume the original purchase is no longer valid.
After restoring the app, separately check the servers, subscriptions, configuration files, and VPN permissions on this device. Verify iCloud sync features according to whether they’re enabled; an App Store purchase record does not mean your configuration has been restored. Keep a recoverable copy of your configuration and store subscription links securely. When asking for help publicly, describe only the error details needed and leave out credentials.
Manage app updates through the App Store and check the product page for release notes. If the interface changes after an update, identify the English menu item names first, then find the corresponding settings. Keeping a record of your current configuration and key conditions makes issues easier to reproduce than repeatedly toggling settings. For full setup instructions, see the user guide; for purchase and restoration questions, see the FAQ.
Topic guides
After your first connection, explore these guides as needed. Protocol guides explain server fields, rule examples help you check routing, and traffic guides clarify the readings. Each covers a different topic.
Learn how QUIC, UDP, and congestion control affect transport. Covers conditions to consider on high-loss links and networks that restrict UDP. Performance depends on the network path, server, and settings—not the protocol name alone.
Read the protocol guide →Learn to identify upload, download, and cumulative readings in Data, and understand the difference between per-server and per-app statistics. Before interpreting the numbers, check the view and reporting period, then consider why they differ from your carrier’s bill.
Read the traffic guide →Use DOMAIN-SUFFIX and DOMAIN-KEYWORD to specify matches, then use FINAL,DIRECT for other traffic. Explains rule order and how rules take effect when Global Routing is set to Config.
Read the rule example →