Shadowrocket FAQ for Beginners: From App Store Purchase to Your First Connection

1. How can I make sure I'm buying Shadowrocket?

Shadowrocket is available only on the App Store. Check the app name, Shadowrocket, the developer, Shadow Launch Technology Limited, and the app ID, 932747118. Don't rely on similar names or icon colors in search results. See our app verification guide to check these details before opening the store.

Shadowrocket is primarily used on iPhone and iPad. The App Store compatibility section also lists information for Mac, Apple TV, and Apple Vision. Refer to the App Store listing for system requirements and purchase compatibility; an app being available to purchase on one device doesn't mean it can run on every device.

2. Does the one-time purchase include connection service?

No. The one-time purchase is for the app; connection service is separate. After purchase, your server list may still be empty because you need to import a configuration you’re entitled to use. This site does not provide, sell, or recommend nodes or subscriptions. The connection steps in this guide assume you already have your own service provider and subscription.

An app purchase receipt is not a substitute for valid service credentials. Likewise, having a subscription doesn't mean you've purchased the app. Troubleshoot these separately: whether the app is installed and opens depends on your App Store purchase and device compatibility; whether a connection works also depends on your subscription status, server settings, and current network.

• Purchase price: Check the price and currency shown in the App Store at the time of purchase. Don't treat older screenshots in articles as current pricing.
• Connection service: Check your existing service for its validity period, data allowance, and available addresses. Buying the app doesn't extend these benefits.
• Restoring on a new device: Find your purchase in the App Store first, then restore your connection configuration. Reinstalling the app and restoring a subscription are separate steps.

3. What are Home, Config, and Settings for?

Distinguish the server list, rule files, and app settings to avoid mixing up later steps. Home is mainly for choosing a server, toggling the connection, and viewing Global Routing. Config is for managing and selecting rule configurations. Settings is for adjusting app behavior. Seeing a server in Home doesn't mean you've selected a suitable rule file in Config.

For beginners, a subscription usually provides a list of servers to choose from, while Config determines how different requests are routed. They can be used together, but they aren't the same file. Importing one doesn't mean the other is set up.

4. How do I import an existing subscription?

In Home, tap “+” in the upper-right corner, open Add Server, set Type to Subscribe, enter your own subscription URL, and save. Keep all query parameters when pasting, and check for spaces or line breaks at either end. A token in the subscription URL may grant access, so don't share the full URL.

After saving, return to Home, update the subscription, and check that server entries appear. A subscription name without selectable servers doesn't count as a successful import. A subscription may include different protocols; keep the provider's original settings instead of changing Type across the board just to make the list look consistent.

• Before importing: Make sure you have a subscription URL intended for use in a client, not an account sign-in or information page.
• After importing: Expand the relevant group and check that entries appear and have an address and port.
• After updating: Check whether the previously selected entry was removed or replaced. A successful list update doesn't mean every server can connect.
• When asking for help: Describe the error message, and hide your subscription URL, password, UUID, and other credentials before sharing screenshots.

5. How do I enter a single server's details without a subscription?

Go to Home → “+” → Add Server and choose the Type that matches your existing configuration, then fill in each field. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different authentication and transport settings; you can't convert between them using only an address and port. If a field is missing, check the original configuration instructions instead of borrowing fields from another protocol.

For example, if your configuration specifies port 443, enter that value. Although 443 is a common HTTPS port, that doesn't prove the server uses TLS, and you shouldn't change every server's port to 443. Password, UUID, TLS, SNI, transport, and path settings must match the server configuration.

1. Check Type against the original protocol name to avoid choosing the wrong authentication method.
2. Check the address and port character by character. Don't append a webpage path to the address field.
3. Copy the matching authentication field. A password and UUID aren't interchangeable just because they look similar.
4. Check TLS, SNI, and transport settings against the original configuration. Don't weaken certificate verification just to clear an error.

6. Which Global Routing option should I choose first?

If you already have a usable rule configuration, choose Config and confirm which file is selected on the Config screen. To briefly test whether a selected server can handle requests, switch to Proxy for comparison, then restore your previous setting. Direct bypasses the proxy, so it can't test whether the server works. Scene is for scenario-based settings and isn't necessary for a first connection.

Rules under Config are generally matched from top to bottom. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP ranges, GEOIP matches against an IP geolocation database, and FINAL handles requests that didn't match an earlier rule. The example below shows syntax only; it's not a complete working configuration and shouldn't replace an existing file.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
GEOIP,CN,DIRECT
FINAL,DIRECT

7. What are the steps for a first connection?

Import and select your configuration before turning on the connection. The first time you connect, the system may ask to add a VPN configuration and confirm it with device authentication. This authorization creates a system network tunnel; it doesn't provide connection service or verify the server.

1. Check the server entry

   Return to Home and confirm that a server entry is available. Select the one you want to use. If it came from a subscription, make sure it's still there after the update.

2. Choose a routing mode

   Go to Home → Global Routing. If you have rules, select Config and check the current file. To test a server on its own, you can briefly select Proxy.

3. Allow the connection

   Turn on the connection in Home, allow the VPN configuration when prompted, and complete device authentication. If you canceled authorization, complete it before troubleshooting the server.

4. Test access

   Run Connectivity Test in Home and review the result, then open a website or app you want to use. Keep any error details; turning on the connection doesn't confirm that access works.

Change one setting at a time. Keep the server fixed and compare access with Proxy and Config first. Then keep the routing mode fixed and try another server you already have. This helps isolate whether the difference comes from the rules or the server, rather than leaving you unsure after changing several settings at once.

8. Why won't webpages load even though the connection is on?

The connection toggle and system VPN indicator show the status of the local tunnel; they don't independently confirm that remote authentication, DNS resolution, and access to the destination are all working. Check in this order: basic network, selected server, Global Routing, then the specific error. This is more useful than repeatedly deleting the app.

Connectivity Test results reflect only the specific test performed. A result doesn't guarantee that every website will load, and a timeout alone doesn't prove that a subscription has expired. If just one domain fails, note the domain, error type, selected routing mode, and network at the time. Check DNS and rules alongside the app logs instead of resetting every configuration.

9. Should I reimport a subscription if its update fails?

Don't delete the existing subscription yet. An update can fail while the app is trying to access the subscription URL; that's separate from whether a server already listed in Home can connect. Note the error, check that the URL hasn't expired and its token is intact, and make sure the current network can retrieve the subscription. Deleting and pasting the same URL again usually won't change any of these conditions.

• Timeout: Check your basic network first. If an existing server still works, connect through it and try the update again to see whether the result changes.
• Update via proxy: Check Settings → Subscribe → Update via Proxy. You need a working connection before enabling this; it won't help if no server is available.
• Unexpected response: Make sure the URL isn't a webpage. Check the subscription instructions from your existing service and don't remove query parameters.
• Entries changed after an update: Check the selected item in Home again. Don't rely on an old entry that the subscription has removed.

Verify import, update, and connection success separately. A successful update only means the app received subscription content it could parse; you still need to test authentication and access to the destination. When contacting your existing service provider, share the error and conditions that triggered it, but don't post the full subscription URL publicly.

10. Why does the connection turn back on, and what should I keep when switching devices?

If the connection comes back on after you turn it off, check Settings → On Demand and the corresponding on-demand settings in the system VPN configuration. On Demand can trigger a connection based on conditions; it doesn't fix server settings. For initial troubleshooting, pause the relevant automatic connection conditions, confirm that manual connect and disconnect behave as expected, then restore the conditions you need.

Before switching devices, prepare your purchase history and configuration data separately. Your App Store purchase lets you get the app again; it doesn't automatically restore your servers, subscription, or Config. Keep backups somewhere you control, and check whether they contain sensitive information such as passwords, UUIDs, or subscription tokens.

1. On the old device, check the server in use, Global Routing, and the current Config. Record how the settings you need correspond to each other.
2. Keep the source for your existing subscription and back up any Config you need to move. If you use iCloud, check the actual sync settings and what appears on the new device.
3. On the new device, restore the purchased app through the App Store. Refer to the App Store listing for compatibility and system requirements.
4. After restoring your subscription and rules, select a server again, confirm the routing mode, and complete system VPN authorization. Don't assume the old device's connection state has transferred.
5. After the manual test works, check Settings → On Demand and restore automatic connection conditions one at a time.