How to Use Shadowrocket: 10 Common Questions for Beginners

1. What should I prepare before using Shadowrocket?

Shadowrocket is a paid app for Apple platforms and is available exclusively from the App Store. Before purchasing, verify the product name Shadowrocket, the developer Shadow Launch Technology Limited, and app ID 932747118. The app is sold as a one-time purchase. Check the App Store listing for system requirements, compatibility, and purchase eligibility.

The app purchase does not include a connection service. After purchasing the app, you still need your own connection details or subscription. This guide explains how to use that information in the app; it does not provide, sell, or recommend nodes, subscriptions, or service providers.

• Get and verify the app: visit the getting the app page to check its App Store listing details.
• Connection details: identify whether you have individual connection settings, a share link, a QR code, or a subscription URL. Each uses a different import method.
• What each tab does: Home manages connection entries and connection status; Config manages rule configurations; Settings manages app preferences.
• Protect your privacy: treat tokens, passwords, and UUIDs in subscription URLs as sensitive information. Hide them before sharing screenshots when asking for help.

2. How do I fill in Add Server, and why isn't the address enough?

In Home, tap “+” in the top-right corner to open Add Server. Choose a Type first, then enter the fields required for it. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different parameter formats. Having a server address in common does not mean you can enter the same settings for different Types.

1. Choose the right Type

   Go to Home → + → Add Server and choose the Type that matches your connection details. If your details specify VLESS, choose VLESS; don't guess the protocol based on a latency test.

2. Check the address

   Enter the server address and Port exactly as provided. If the original settings specify port 443, enter 443. Don't change it just because another entry uses a different port.

3. Enter authentication details

   Enter the password, UUID, key, or encryption method required for the selected Type. After pasting, check for spaces at the beginning or end. Don't enter a note in an authentication field.

4. Check transport settings

   If your connection details include TLS, SNI, a transport path, or other optional fields, enter each one as specified. SNI may differ from the connection address, so use the values in your connection details.

5. Save and select the entry

   After saving, return to Home and confirm that the new entry appears and is selected. Saving an entry adds it to your configuration; it does not turn on the system connection.

If you have a complete share link or QR code, use the matching import option to avoid transcription errors. After importing, check the Type, address, port, and key authentication fields. A successful import only means the data was recognized; it doesn't confirm that the remote connection is currently available.

3. Why are there so many entries after importing a subscription?

A subscription URL retrieves a set of connection configurations; it isn't an address to enter in a server address field. Go to Home → + → Type → Subscribe, paste your own subscription URL, and save it. Then update the subscription. Once the configurations are retrieved, Home displays the subscription group and its entries.

• Several entries appear in the group: this usually means the subscription returned multiple connection options. You don't need to turn them all on at once.
• Only the subscription name appears: update it first, then check for network, authentication, or content-format errors.
• Nothing connected after importing: return to Home, select a specific entry, and check the connection switch and Global Routing.
• You have a single share link: import it using the matching method; don't set it up as a Subscribe entry.

Updating a subscription may replace entries in its group. Note any personal labels or manual changes you want to keep before updating. Don't assume a temporary change to a subscription entry will persist as a separate configuration.

4. Which of the four Global Routing modes should I choose?

Home → Global Routing determines how traffic is routed. The selected connection entry in Home determines which connection details are used for proxy traffic. These are separate settings. Changing Global Routing won't fix a password, port, or protocol, and it won't create rules that work for every destination.

For everyday rule-based routing, check the active configuration in Config, then go to Home and choose Global Routing → Config. To troubleshoot how rules affect a destination, you can temporarily compare the results under Proxy and Config. Note your original setting and restore it after testing. Direct doesn't mean the app is uninstalled or that a connection entry has been deleted.

Before using Scene, learn how your scene conditions are configured and check them. If you haven't set up any conditions, don't treat Scene as a universal button that automatically decides whether every website needs a proxy. If behavior changes when you switch networks, check the scene conditions too.

5. Should I allow the system prompt to add a VPN configuration?

The first time you turn on the connection, the system may ask to add a VPN configuration. This permission connects Shadowrocket's network extension to system network management; it's separate from purchasing the app or importing a subscription. Confirm that the request was triggered by an action you just took in Shadowrocket, then follow the system prompts to allow it and complete authentication.

1. In Home, confirm that the desired entry is selected, then turn on the connection switch.
2. Review the system permission prompt and allow the VPN configuration to be added. If prompted for your device passcode or biometric authentication, follow the system instructions.
3. Return to Shadowrocket to check the connection status, then test access to a specific website.
4. If you previously denied the request or removed the system configuration, turn on the connection from the app again and check whether the permission prompt reappears.

A connected status in the system VPN settings means the network extension is running. It doesn't confirm that remote authentication, DNS, or access to every website is working. Don't delete all your configurations just because one page won't load. Check the app status, selected entry, and routing mode first to preserve useful troubleshooting clues.

6. Latency looks fine, but websites won't load. What should I check first?

A latency test only shows the result for a particular test method and destination at that moment. A millisecond reading doesn't mean that the browser's DNS lookup, TLS handshake, and actual request have all succeeded. Keep the destination, connection entry, and network the same while comparing results one step at a time.

These are observations to help narrow down a problem, not test results from this guide. If you ask for help, include the network, Global Routing mode, destination domain, error message, and steps that led to the issue. That's more useful than saying only “it won't connect.” Don't expose subscription URLs, passwords, or keys in screenshots.

7. How do I update a subscription, and should I add it again if the update fails?

Updating a subscription retrieves the configuration from its existing URL; it doesn't update the Shadowrocket app. Update the subscription group in Home. If you pull down to refresh, wait for the operation to finish and check the group's status. Don't create another subscription with the same name after a single timeout; duplicate groups make it harder to choose entries and troubleshoot later.

1. Check that the subscription URL is complete, especially the token and query parameters, and make sure no spaces were added when copying it.
2. Confirm that your device has network access, then update the existing subscription group once.
3. A timeout usually means you should check the network path to the subscription URL. For an authentication error, check the URL and whether your existing account is still valid.
4. If the response is a webpage instead of configuration data, check whether you copied an account-management page URL or whether the link has expired.
5. After a successful update, check which entry is selected. Don't rely on your previous assessment if the original entry was removed or its settings changed.

A working connection entry doesn't guarantee that the subscription URL is reachable; they may use different addresses and network paths. If you need to change the update path, first check the Subscribe options in Settings and the in-app guidance. Don't bypass errors from unknown sources by disabling certificate verification.

8. The connection turns back on after I switch it off. Where do I check On Demand?

The manual connection switch, On Demand, and Global Routing each have a separate role: the switch controls the current connection, On Demand triggers connection behavior based on conditions, and Global Routing determines how traffic is routed while connected. So switching to Direct doesn't turn off On Demand, and a connection that resumes after you disconnect manually doesn't necessarily mean the switch is faulty.

To check whether On Demand is triggering the reconnection, first note the relevant conditions in Settings → On Demand and temporarily disable them. Then return to Home, disconnect manually, and repeat the network change that previously triggered a reconnection. If the behavior changes, check each condition individually. When finished, restore the settings you need instead of clearing all system network configurations.

9. How are Config and subscriptions different, and where does FINAL go?

Subscriptions are mainly used to retrieve connection entries. Config can also define rules, DNS, and other behavior. Some sources may provide a complete configuration, so identify what you're importing rather than judging its purpose by the appearance of a link. When Global Routing is set to Config, the rules in the active configuration apply—not every saved file.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
GEOIP,CN,DIRECT
FINAL,PROXY

This code sample illustrates the format and order of rules; it isn't a complete file to replace your existing configuration. DOMAIN-SUFFIX matches a domain suffix and its subdomains. IP-CIDR matches the network range containing a destination IP. GEOIP checks the destination IP's geographic location against the available data. FINAL applies when no earlier rule matches.

• Rules are generally checked from top to bottom, and the first matching rule determines the result. Put rules that need priority before broader rules.
• DOMAIN-SUFFIX,example.com,PROXY doesn't include https:// or a webpage path.
• 192.168.0.0/16 represents an IP network range, not a port range. Don't append :443 to it.
• Place FINAL,PROXY at the end of the rules. If it appears earlier, subsequent rules won't be checked.

Before editing, keep a copy of your current configuration. Add or change one rule at a time, then test the same destination. GEOIP results depend on the data used and the destination IP; a webpage's language alone can't tell you which regional rule matched.

10. How do I set up Shadowrocket on iPhone and iPad, and does a purchase carry over automatically?

Your app purchase and connection configuration are separate. On iPad, sign in with the same Apple Account used for the purchase and look for Shadowrocket in the App Store's Purchased section. Check the App Store listing for redownload availability and purchase eligibility. The purchase record doesn't replace the system VPN permission required on each device.

On iPad, landscape orientation or Split View changes the available width and how lists and details appear, but the key settings are still in Home, Config, and Settings. Don't create another subscription just because a button has moved. If access differs between devices, first check that both use the same entry, configuration, and network conditions. Then check any device limits imposed by your existing service.

After these checks, review the setup in order: connection details are correct → an entry is selected → system permission is granted → routing is clear → the destination is accessible. If something goes wrong, resume from the first step that didn't behave as expected; you don't need to start over with the purchase or installation each time.