QUESTION / CHECK / VERIFY

Shadowrocket FAQ

Browse by stage: check your purchase and system permissions first, then your existing subscription, server, and rules. Each answer points to the next place to check, with interface labels kept in English.

Three checks for connection issues

System permission granted → server details valid → rule actually used by the request. Note the error, change one thing at a time, and retest the same destination.

STORE & PURCHASE

App Store verification and purchase

Check the product page and purchase account first, then review the storefront, purchase history, and device compatibility.

Can’t find Shadowrocket in the App Store? Start here

Open the App Store product page from the Get Shadowrocket page to check whether search results are missing it or the app is unavailable in your storefront. Check the country or region for the Apple Account used with Media & Purchases—not just your device language. To change it, go to Settings → Apple Account → Media & Purchases → View Account → Country/Region, then follow Apple’s instructions for your balance, subscriptions, and payment method. Availability is determined by the current App Store listing.

How can I verify that an app is the genuine Shadowrocket?

On the product page, check all three details: the developer is Shadow Launch Technology Limited, the app ID is 932747118, and the icon matches the official icon in this site’s header. You can confirm the app ID from id932747118 in the product page URL; don’t rely on the app name or search result position alone. Then check the price and compatibility details. Shadowrocket is available only through the App Store. See the Get Shadowrocket page for purchase and setup instructions.

Do I need to buy Shadowrocket again after changing or restoring my device?

Make sure the App Store on your new device is signed in with the account used for the original purchase. Then look for Shadowrocket in the App Store account’s Purchased section or Apps list. You can usually download it again from your purchase history. If a price still appears, check your purchase history, account, and storefront before paying again. Download eligibility, device compatibility, and Universal Purchase availability are subject to the App Store listing. Redownloading the app does not restore your server details; restore your configuration from your own backup.

Does a one-time purchase include a connection service?

A one-time app purchase is not a connectivity plan. Buying Shadowrocket gives you a license to use the client; you still need to provide your own subscription or server details to connect. The US price is about $2.99; the actual price, currency, and purchase terms are shown on the App Store page. This site provides the official manual, but does not provide, sell, or recommend servers or subscriptions. Check app purchase issues separately from connection issues with your existing service.

Can I use Shadowrocket on iPad? Where can I check support for other Apple devices?

Check Shadowrocket’s compatibility on its App Store product page for both iPhone and iPad. On iPad, first confirm the account used for the purchase, then check Purchased and the compatibility section. Window size may affect the layout, but the main controls are Home, Config, and Settings. Compatibility, system requirements, and Universal Purchase terms for Mac, Apple TV, and Apple Vision are also listed on the same App Store page. Don’t infer purchase eligibility from the device name.

See how to verify Shadowrocket on the App Store →

INSTALL & FIRST CONNECTION

Setup and first launch

App installation, VPN configuration permission, and server connection are three separate steps. Check each one independently.

What steps should I follow to connect after opening the app for the first time?

In Home, make sure your server details have been imported. Select the server you want to use, check Global Routing, then turn on the connection switch. If iOS prompts you to add a VPN configuration, review the app name and permission details, confirm, and complete the requested device authentication. Return to Shadowrocket to check the connection status, then run Connectivity Test. If you have only installed the client and haven’t imported your own server details, switching it on does not complete setup.

What does the system prompt to add a VPN configuration mean?

This prompt asks iOS to authorize the configuration Shadowrocket needs to establish a VPN connection. It is not a purchase confirmation and does not mean a server is ready to use. Check the app name shown in the prompt, confirm, and enter your device passcode or complete the requested authentication. If you previously denied permission, try connecting again from the app. You can check the authorization in the VPN and device management sections of Settings. The exact path may vary by system version; managed devices are also subject to their organization’s policies.

What should I do if the connection switch won’t turn on or turns off immediately?

Check that you’ve selected a working server and granted permission to add the VPN configuration. In Settings, check the current VPN status, temporarily disconnect any other active VPN connection, then try again in Shadowrocket. If your device is managed or restricted, check the applicable policies. If it still fails, note the system prompt and app error, restart your device, and test again. Back up existing configurations before removing them; repeatedly reinstalling the app shouldn’t be your first step.

The interface is in English. How do I find common controls?

Use the labels shown in the app: Home for servers and connection status, Add Server to enter server details, Config for configuration files, Global Routing for traffic handling, Settings for preferences, and Connectivity Test to check connectivity. This manual keeps these names in English so you can match them to the interface. If iOS offers per-app language settings, check Shadowrocket’s language options in Settings. Available options depend on your device and the app; changing the language isn’t necessary to troubleshoot a connection.

On Demand reconnects automatically. How can I pause it temporarily?

Check whether On Demand is enabled in Shadowrocket and whether connection rules are set to trigger under certain network conditions. To troubleshoot manually, temporarily turn off On Demand, turn off the connection switch, and check the status on the system VPN page. If the connection still starts automatically, check for On Demand settings in other VPN configurations. Restore your original settings when you’re done. On Demand triggers connections; it does not correct server settings or routing rules.

Follow the steps to connect for the first time →

SUBSCRIPTION & SERVER

Subscription and server imports

The steps below assume you already have your own subscription or server details. First identify what type of information you have.

An existing subscription link won’t import. What should I check first?

Make sure you copied the complete link. Remove any leading or trailing spaces or line breaks, and check that you haven’t included explanatory text. Confirm that the link is reachable on your current network, your provider account and subscription are active, and the response contains subscription data the client can read—not a login or error page. Use the Subscribe option for server subscriptions; subscriptions to configuration files in Config serve a different purpose from server lists. If it still fails, keep the error message and ask your provider to check the format and access permissions.

What’s the difference between a server subscription and a Config file?

A server subscription maintains a list of connectable servers. A configuration file in Config organizes settings and rules such as General, Rule, and Host. Importing one doesn’t mean the other is set up too. Check the details you already have, identify whether they’re for a server list or a full configuration, and choose the matching import option. Before using the Config routing mode, make sure the intended configuration file is selected. Policies such as PROXY depend on a valid server selection; rule text alone can’t establish a connection.

Can’t connect after entering details manually in Add Server? Check each field

Choose the Type that matches your server details, then check the address, port, and authentication fields. Requirements vary by protocol: the Shadowsocks encryption method and password, a VMess or VLESS UUID, and a Trojan password are not interchangeable. Match any TLS, Server Name, or transport settings in your details, and check capitalization and extra spaces. Save the entry, select it, and test again. Don’t turn off certificate verification at random instead of checking the domain, certificate, and device time.

Scan QR Code or clipboard import doesn’t add anything. What should I do?

For Scan QR Code, check that camera access is allowed and hold the full, clear QR code within the viewfinder. Before importing from the clipboard, copy the complete server-sharing content again. If iOS asks for paste permission, confirm it as needed. The QR code or text must contain supported server details; a regular web address or configuration instructions alone won’t work as a server. After importing, return to Home and check the new entry’s Type and address. Don’t assume the import succeeded just because a prompt disappeared.

How do I update an existing subscription, and what should I check afterward?

In Home, find the existing server subscription and use its management options to update it. The exact button location depends on the current interface. If the update fails, check your network, the link, and the service status before trying again. After a successful update, check whether the server list changed and whether the selected server is still there; if it was removed, select another server and test again. Manual changes to subscription-generated entries may be overwritten by later updates, so back up important notes and custom settings separately.

ROUTING & DIAGNOSTICS

Routing rules and troubleshooting

Use the same test destination to check your basic network, server, rules, and DNS separately.

How do I choose Config, Proxy, or Direct in Global Routing?

Config follows the rules in the selected configuration file to decide how requests are handled. Use it when you have routing rules set up. Proxy sends requests through the selected proxy and can be useful for a brief comparison test. Direct connects without a proxy. Note the original setting, test the same destination with another mode, then restore it. Global Routing modes operate at a different level from the PROXY and DIRECT policies in rules; similar names don’t mean the configuration is working as expected.

It says connected, but webpages won’t load. What should I check, and in what order?

Disconnect Shadowrocket and confirm that your device’s network can still open a site that normally works. Reconnect and run Connectivity Test. Then check the selected server, your existing service status, and Global Routing. A brief test with Proxy can help distinguish server connectivity issues from rule issues. If only some domains fail, check DNS and the policy shown in the connection log. Connected only describes the tunnel status; it doesn’t guarantee access to every destination. Change one setting at a time and keep a record of each test.

Rules in Config aren’t working as expected. What should I check?

First, make sure Global Routing is set to Config and that the edited file is selected in Config. Then check the order of rules in the Rule section. Rules are matched from top to bottom, and the policy for the first match applies. Put specific domain rules before broader ones; FINAL usually goes last. For example, DOMAIN-SUFFIX,example.com,DIRECT should appear before FINAL,PROXY. Save the file, make a new request, and check the destination and policy in the connection log. Reconnecting may make an existing connection easier to verify.

Think your DNS settings may be causing problems? How can you narrow down the cause?

Note the current General section and in-app DNS settings, and make sure your device’s date, time, and basic network connection are correct. Test the same domain repeatedly and identify whether the issue is a DNS lookup failure, connection timeout, or certificate error; don’t treat different errors as the same problem. If your configuration uses dns-server = system, keep that as your baseline while checking for other DNS overrides. Change one setting at a time, reconnect, and test again. Changing the server, rules, and DNS all at once makes it hard to identify the cause.

Battery use increases during a continuous connection. How can I find out why?

Check the relevant time period in Settings → Battery. Consider actual data transfer, weak signal, background activity, and network changes—not just the app’s percentage. Check whether tests, detailed logging, or subscription updates are running frequently, and stop them when they’re no longer needed. If an unstable server is causing repeated reconnects, test on a stable network first, then check the On Demand triggers. Keep conditions similar when comparing results. Battery use depends on network conditions and workload, so a single test can’t predict a fixed battery life.

See rule types, matching order, and configuration examples →