A rule-based proxy client for iPhone / iPad, with rule-based routing and a one-time purchase through the App Store. This manual covers verifying the official listing, importing an existing config, and checking connections.
Check the App Store page for device compatibility, system requirements, and eligibility for Universal Purchase.
Get the app / Verify the listing first
Shadowrocket is available only on the App Store. Use the name as a starting point for your search, then verify the developer, App ID, and official icon on the product page. If a page asks you to get the app outside the App Store, stop and return to the product page to verify it.
Check the App Store compatibility section, then follow the store prompts to purchase or restore your purchase. The first time you enable a connection, iOS asks to add a VPN configuration; check the app name in the prompt before confirming. Purchasing the app does not configure a server. You will still need to import your own subscription or server details.
See how to get Shadowrocket on iPhone →Use the Apple ID used for the purchase to check purchase history and device compatibility in the App Store. A purchase can be shared between iPhone and iPad; check the product page for details. A larger screen does not change what configuration fields mean. After switching devices, check the current server, Config, and permissions rather than assuming the setup is ready because the app is installed.
See how to get Shadowrocket on iPad →Shadowrocket is also available from the same App Store on Mac / Apple TV. Check the product page for compatibility and system requirements.
View the steps to get Shadowrocket →First identify the type of existing config, then choose a routing method. These six features cover request handling, connection conditions, server details, bulk updates, config management, and troubleshooting. They are not interchangeable switches.
Rule-based routing sends different requests through different routes. In Home, set Global Routing to Config to match requests against the rules in the active config. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR specifies an address range, and FINAL handles requests that did not match earlier rules. When troubleshooting, check rule order first, then the assigned policy; later rules do not override a rule that has already matched. example.com is used here only to explain the syntax, not as a ready-to-use configuration.
Settings
On Demand
Home
Global RoutingOn Demand starts connections when specified conditions are met. Set it up only after confirming that a manual connection works. Find On Demand in Settings and review the options available in your version of the app. It controls when a connection is attempted; it does not select a working server or replace the routing rules in Config. If the connection comes back on after you turn it off, check this setting and the system VPN status first. During troubleshooting, you can temporarily disable On Demand, change one condition at a time, and see whether the issue recurs.
Shadowsocks · VMess · VLESS
Trojan · HTTP · SOCKS5
WireGuard · Hysteria2Select a Type in Add Server to show the relevant fields. Parameters for Shadowsocks, VMess, VLESS, Trojan, WireGuard, and Hysteria2 are not interchangeable. Fill in HTTP and SOCKS5 details using the information for your existing server as well. Check Type, Host, and Port first, then review authentication and transport fields. Use the settings provided for your server to determine whether to enable options such as TLS. A protocol name alone does not predict speed or battery use; performance also depends on network quality, server status, and transport settings.
Read the protocol guide →Add Server
Type → Subscribe
Home
SERVERIf you already have a subscription, select Subscribe in Add Server and enter the complete URL. After importing, return to Home and check that SERVER shows the expected groups and entries. Updating a subscription refreshes server details; it does not guarantee that every server can connect, nor does it replace the active Config. If an update fails, check that the URL is complete and still valid, and that the current network can reach it. Subscriptions often contain personal access credentials, so redact the full URL before sharing screenshots or diagnostics.
Config
General · Rule · Hosts
URL Rewrite · HTTPS DecryptionConfig stores rules and related network settings, while the server list in Home serves a different purpose. Before editing, keep a recoverable copy and confirm which config is active; changing Rule will not fix an incorrect server password. Adjust sections such as General and Hosts for their intended use, and avoid replacing all settings at once. If you use iCloud sync features, check the sign-in and sync status on each device, then verify the contents on another device. Sync does not test connectivity, and a successful save does not confirm that the new rules match as expected.
Home → Connectivity Test
Settings → Diagnostics
DataConnectivity Test reports server test results, Diagnostics in Settings can help investigate connection issues, and Data shows traffic records. A test result does not mean every site or request will work; also check the routing method, DNS, and rule matches for the request you are testing. When recording an issue, note the conditions, selected server type, and error message. Change one setting per test. Traffic shown in Data alone does not prove that requests used the expected server; consider the active policy too.
These steps assume you already have your own subscription or server details. For the initial setup, make a manual connection and test real access before adding automatic connection conditions or complex rules. This makes it easier to pinpoint where an issue occurs.
To add a server manually, select the matching Type in Add Server and enter the address, port, and authentication details. For a subscription, select Subscribe, paste the complete URL, and save. Before using Scan QR Code, make sure the QR code comes from your own config. Return to Home, confirm that SERVER shows the expected entries, then select one. If the list has not changed, troubleshoot the import or update rather than repeatedly toggling the connection.
A subscription URL, a single-server share, and a Config file are different kinds of data. Use the import option that matches the content. If unsure, check with the provider of your existing config instead of truncating the content and trying it in a different field. When entering details manually, check for extra spaces, line breaks, and a complete numeric port.
Global Routing controls the overall routing mode. Config applies the rules in the active config; Proxy sends applicable requests through the selected proxy; Direct uses a direct connection. Usually, follow the instructions for your existing config and select Config. Compare other modes temporarily only when troubleshooting. Successful access in Direct does not prove that the server details are correct. If access works in Proxy but fails in Config, check the rules and related DNS settings.
Note the original selection before changing modes, and confirm which Config is active. Check the mode, server, and config file one at a time; changing several at once makes it hard to tell what affected the result. After testing, restore the settings you need for everyday use rather than leaving a temporary troubleshooting setup in place.
Turn on the connection switch in Home. The first time iOS prompts you to add a VPN configuration, verify the app name and follow the system prompts to allow it. Then check the connection status, run Connectivity Test, and visit a specific service you need. A connected status means the connection has started; it does not confirm that server authentication, DNS resolution, or every routing rule is working as expected. Test actual access as well.
If a connection fails, first check that your local network is working, then verify the server details, subscription validity, and routing mode. Save the error message and steps to reproduce the issue; this is more useful than repeatedly toggling the connection. Before sharing logs, remove personal credentials such as passwords, keys, and subscription URLs. The full guide covers first-time permissions, import options, and a step-by-step troubleshooting process.
Shadowrocket is a closed-source commercial app. This official site and manual are based on information verified on the App Store product page and in the app. Check purchase status, price, device compatibility, and system requirements at the time you use them.
On the App Store page, first check that the developer is Shadow Launch Technology Limited, then verify id932747118 in the URL, and finally compare the official icon. All three should match; do not rely on search ranking, the name, or a similar-looking graphic alone. The official icon shown here helps identify the app. Complete any purchase in the App Store.
If search results do not look right, return to the Get the App page and use the direct product link. The store's language and local currency may vary, but you should still verify the developer and App ID.
See how to verify the official listing →The client is a one-time purchase. The US reference price is $2.99; the actual price is shown on your local App Store page. The purchase gives you the right to use the Shadowrocket client; it does not provide a working server or configure your network. Before using the app, make sure you already have valid server details or a subscription.
Prices are shown in local currencies and vary by storefront. Check the price at checkout before purchasing. The client price is separate from any proxy service charges; the subscription import option is not a place to buy services within the app.
See pricing and one-time purchase details →When switching devices or reinstalling, first make sure the App Store is signed in with the Apple ID used for the purchase, then look for Shadowrocket in your purchased items. A purchase can be shared between iPhone and iPad; check the App Store page for device compatibility and Universal Purchase eligibility. Restoring the app does not restore its config. After reinstalling, check the server list and active Config separately.
If the store still shows a price, do not purchase again right away. Check the account, purchase history, and app identity first, then follow the App Store's guidance. Check the store page for current details about Family Sharing eligibility.
See how to restore purchases after switching devices →Whether the app appears in search results depends on the current App Store storefront and account status. The product page's compatibility section shows whether your device meets the requirements; this site does not list fixed system requirements. Even if you purchased the app on another device, check compatibility again on the new device instead of relying on its name.
App updates are managed through the App Store; check the product page for update history. Before updating, keep a copy of any config you may need to restore. After updating, check the selected server, Config, and connection status. This manual retains English interface terms so you can find them in the app; if the layout changes, use the current in-app labels as your guide.
See App Store availability and compatibility →Once the basic connection works, read the guide that addresses your specific issue. Speed, DNS, and protocol fields are separate topics. Identify the symptoms and review the current config before choosing what to check; changing everything at once makes it harder to draw useful conclusions.
Check your local network, protocol settings, proxy quality, and server load in turn. Distinguish test results from real-world performance. Note when the issue occurs, then compare one factor at a time so local network fluctuations are not mistaken for a protocol issue.
Read the full article →Starting with the Type selection in Add Server, this guide explains keys, addresses, endpoints, MTU, and AllowedIPs. Check whether each field is local or remote, then verify address ranges and formatting. Do not guess by entering sample values.
Read the full article →Compare different DNS resolution paths and learn how DNS settings interact with routing rules. If a domain fails to load, first distinguish a DNS resolution error from a later connection error. Then decide whether to change the resolution method instead of replacing the entire config.
Read the full article →