App Store purchase Official user manual

Shadowrocket User Guide

Name: Shadowrocket
Price: 2.99 USD
Author: Shadow Launch Technology Limited

A rule-based proxy client for iPhone / iPad, with rule-based routing and a one-time purchase through the App Store. Start by verifying the official listing, then import an existing configuration.

Shadowsocks VMess VLESS Trojan Hysteria2 WireGuard

How to read the configuration

Requests, rules, and policies

First, choose how Global Routing should work, then review the rules in Config. In Config mode, requests are checked in rule order, and the first match determines the policy. PROXY, DIRECT, and REJECT are different handling actions, not protocol types. The example below explains the syntax; it is not a ready-to-use configuration for every network.

Server protocols, authentication details, and transport settings must match. The required fields differ for Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard. When adding a server, choose its Type based on the information you already have rather than trying different protocols to guess how to connect. Get subscription details from your service provider. After importing them, test the connection.

Request Rule Policy

DOMAIN-SUFFIXGEOIPPROXYDIRECT

Global Routing: choose a mode

Open Global Routing from Home and choose Config, Proxy, or Direct for your needs. Config routes traffic according to the rules in the active configuration. Proxy sends traffic through a proxy and is useful for checking whether the selected server is available. Direct connects to the destination without using a proxy, so it does not test the proxy server. For everyday rule-based routing, select Config and check which configuration file is active. After switching modes, make a new request and check Logs to see how it was handled. Existing long-lived connections may continue using their previous route, so don't judge the result solely by whether a page is already open.

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECT

On Demand: connection triggers

On Demand starts connections when system conditions are met. It is separate from Global Routing and does not replace rules in a configuration file. Review the available options in Settings, then choose settings for your network needs. Before using it for the first time, test a manual connection and verify access so that server configuration errors aren't mistaken for automatic connection failures. After enabling On Demand, manually disconnecting and allowing the system to reconnect may produce different results. For troubleshooting, temporarily turn it off, note the manual connection result, then restore your previous setting. Available conditions and authorization status depend on what appears on your device.

# On Demand: determines when to connect
# Global Routing: determines how traffic is handled
# Rule in Config: determines the policy for a request
[Rule]
DOMAIN,api.example.org,DIRECT
FINAL,PROXY

Subscribe: import an existing subscription

Get subscription details from your service provider. Before importing with Subscribe, make sure you have copied the complete URL, including its query parameters. Treat authentication details in the URL as sensitive and don't include them in public screenshots. After importing, check that the expected entries appear, then select one and test the connection. Updating a subscription refreshes the server information from its source; it does not update the rules in the active Config. If an update fails, check the URL, whether your current network can reach its source, and whether the provider's content is compatible with the client. Avoid repeatedly adding the same subscription.

# Subscribe manages the source of server information
# Rule determines the policy used for a request
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

Config: manage configuration sections

Config lets you view and manage configuration files. When reviewing one, first understand the roles of General, Rule, Host, and URL Rewrite. Don't put rules in server authentication fields. Keep a working copy before making changes, adjust one type of setting at a time, and confirm that the intended configuration is still selected after saving. When moving to a new device, prepare to restore your setup using configuration export and iCloud sync. Check that servers, rules, and local settings are all present; syncing does not necessarily restore every state. The example shows the structure only. Fill in valid values for your existing network before using it.

[General]

[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

[Host]
example.org = 192.0.2.10

Rule: the first match applies

Rules are checked in the order they are written. Once a rule matches, its policy applies and later similar rules are not checked. DOMAIN matches an exact domain, DOMAIN-SUFFIX covers a domain and its subdomains, IP-CIDR matches an IP address range, and FINAL handles requests that did not match any preceding rule. Put specific exceptions before broader rules. When troubleshooting, find the rule that actually matched and check whether its policy is expected. The presence of a rule in the configuration doesn't prove that a request will reach it. After editing, make a new request and check the match in the logs.

[Rule]
DOMAIN,api.example.com,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXY

Host: map a domain to an address

Host records the association between a domain and an address. Use it when you know the destination address and want to set an explicit mapping. Host handles name resolution; it does not select a proxy policy, so a mapping cannot replace DIRECT or PROXY in Rule. Before editing, check that the address is still valid. An internal address may no longer be reachable after changing networks. If a domain behaves unexpectedly, check its Host mapping, DNS result, and matched rule one by one. The reserved address below is for documentation only; don't use it as a real service address or apply it to a domain without verifying the details.

[Host]
example.org = 192.0.2.10

[Rule]
DOMAIN,example.org,DIRECT
FINAL,PROXY

URL Rewrite: limit the match scope

URL Rewrite matches request URLs against expressions and applies an action; it serves a different purpose from rule-based routing. Before writing a rule, confirm the protocol, domain, and path scope, then choose the redirect destination and status code. An overly broad expression may affect other requests on the same domain, so start with one test path and keep a rollback copy. For encrypted requests, consider whether the request is visible and whether relevant security settings are enabled. Adding a line alone does not guarantee that it will take effect. The example domain below illustrates redirect syntax; test only with a destination you are authorized to manage.

[URL Rewrite]
^http://example\.com/ https://example.com/ 302

Proxy Group: separate rules from selection

Proxy Group organizes policy choices into groups that rules can reference, so Rule can focus on matching request scope. Before using a group, make sure its name exactly matches the reference in the rule and that it contains an available option. Manual selection groups are useful when you need to choose an outbound server explicitly. Check the behavior and test conditions of other group types against your needs; group types are not protocol types. If a rule matches but the connection fails, check which server the group currently selects. The example below shows manual group syntax. Its PROXY reference still depends on an existing server configuration and does not provide a connection service by itself.

[Proxy Group]
Reading = select,PROXY,DIRECT

[Rule]
DOMAIN-SUFFIX,example.com,Reading
FINAL,DIRECT

Scan QR Code: scan, then verify

Scan QR Code reads a QR code containing an existing configuration, but you still need to check the result. Before scanning, make sure the code comes from your own configuration materials. After scanning, verify Type, Host, Port, and authentication fields, then save and test. Camera access is controlled by system permissions. If scanning fails, check the permission and QR code clarity rather than changing protocol settings. QR codes may contain complete connection credentials, so protect them as carefully as subscription URLs and don't share them publicly. A successful import only means the client read the information; it does not confirm that the server is reachable. Select a server, connect, and verify an actual request.

# Verify the server fields after importing
# Then test the request path with an explicit rule
[Rule]
DOMAIN,example.com,PROXY
FINAL,DIRECT

Logs: trace issues by request

Use Logs to check the request destination, matched rule, and connection result. Data shows traffic usage over a period of time; the two serve different purposes. To diagnose an issue, note when it occurred, make one request to the destination, then check the steps from domain resolution through rule matching and policy selection to the connection result. Connectivity Test can provide a clue about reachability, but it doesn't replace testing access from the specific app. Before sharing diagnostic material, hide subscription URLs, authentication fields, and private browsing records. A single test reflects conditions at that moment and doesn't establish long-term status.

# Compare the destination and matched policy in Logs
[Rule]
DOMAIN,api.example.org,DIRECT
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

Need a field-by-field explanation? Read the Rule and configuration field reference →. Importing existing information for the first time? Follow the Getting Started guide to connect and test, then adjust the rules.

Devices and availability

Get Shadowrocket for iPhone and iPad

Shadowrocket is available only through the App Store. Before purchasing, check the product name, developer, and app ID. System requirements and purchase eligibility are as listed on the App Store product page. If you've already purchased the app, check your Purchased items before trying to buy it again. Also verify the account currently signed in to the store separately from the account used for device sync.

iPhone

Verify the App Store listing, then purchase and install the app. Add your existing server or subscription, then follow the system prompt to allow a VPN configuration. Test a manual connection first and confirm that requests reach their destinations before setting up On Demand.

View the iPhone setup guide →

iPad

Use the same Apple ID you used to purchase the app to check your Purchased items, then follow the App Store prompts to get it. After installation, verify the server, active Config, and system permissions on this device. A successful connection on another device doesn't confirm that this device is configured correctly.

View the iPad setup guide →

Shadowrocket is also available from the same App Store for Mac and Apple TV. Compatibility, system requirements, and purchase eligibility are as listed on the App Store product page.

Before connecting for the first time, understand the two types of authorization

Purchase confirmation happens in the App Store; adding a VPN configuration happens in the device's system settings. These are separate steps. Installing the app doesn't establish a connection, and allowing a system configuration doesn't mean the server details are correct. When you first open the app, check that your existing configuration is complete, select a server, and connect. If the system asks to authorize a configuration, confirm after reviewing what it does, then follow the device prompts to complete verification. If you cancel, return to the client and start the action again.

Verify each device separately, even when using two devices. The same subscription may provide the same server information, but the current network, Config selection, and local permissions may differ. First complete a minimal working setup on one device and note the protocol and mode. Then check each item on the other device. If results differ between Wi-Fi and cellular, keep the test destination the same and change only the network. This makes it easier to tell whether the issue is network reachability or a setting on the device.

What to read after installation

For your first setup, start with Getting Started: prepare existing subscription or server details, choose the right import method, check Global Routing, connect, then verify with a specific request and Logs. If you already have a configuration but some destinations are routed incorrectly, consult the configuration field reference and check rule order, policies, and domain mappings. Checking installation, connection, and routing separately helps avoid changing multiple settings at once and losing track of what caused the issue. It also makes it easier to keep a recoverable configuration copy.

On the App StoreDownload Shadowrocket View setup steps →

Authenticity and purchase details

Verify the App Store listing, then manage your configuration

Shadowrocket Docs is the official website and user manual for Shadowrocket. The app is closed-source commercial software; purchases, installation, and updates are managed through the App Store. This manual explains how to use the client and does not provide, sell, or recommend servers or subscriptions. Verify the product details before purchasing, and make sure you already have a valid configuration before connecting.

Developer Shadow Launch Technology Limited App ID 932747118 One-time purchase

Authenticity Check: verify the name, icon, and app ID

Search for Shadowrocket in the App Store and open the product page rather than relying on the name in search results. Check that the developer is Shadow Launch Technology Limited, compare the icon with the official icon used on this site, and confirm that the product page URL contains app ID 932747118. A similar name does not mean it's the same product; use the product page to verify the details. The links and purchase instructions on this site refer to this product page.

The icon is one way to identify the app, but it can't replace the other two checks. If the search results don't look right, open the specified product page from the App Store purchase guide and review the information shown for your current storefront. Verify the product before reading reviews or feature descriptions. Before purchasing, check the displayed price and system compatibility. App Store listings may change, so rely on the current product page rather than an old screenshot.

App Store availability: check your storefront and account

Visibility and currency display can vary between App Store storefronts. If the app doesn't appear in search, check the spelling, the storefront for your current App Store account, and any product page notices. An unavailable purchase, an incompatible device, and an incomplete payment are different issues with different next steps; don't treat them all as installation failures. Prices, system requirements, and purchase eligibility are as listed on the App Store product page. This manual does not replace the store's current information.

Device sign-in and App Store purchase status are separate. To check a past purchase, make sure you're signed in with the account used to buy the app and confirm that the transaction was completed. If the page offers a way to get the app again, follow the system prompts. If it still shows a price, check your purchase history and account details before assuming the purchase failed. Keeping the App Store transaction record can help with verification. Don't share account, billing, or payment information when asking for help publicly.

One-time purchase: the app and connection services are managed separately

A one-time app purchase is not a service plan. The US storefront price reference is $2.99; prices are shown in local currency in other storefronts, and the final amount is as listed on the App Store product page. The one-time purchase covers the client. It doesn't add a server to Home or create a subscription URL. Get an existing subscription from your service provider. For an existing server, enter its protocol, address, port, and authentication details. Check that the information is complete before importing, then test the connection.

A failed subscription update and a successful app purchase are separate matters. The App Store manages purchase records; your service provider supplies subscription content and determines whether it is valid. First identify where the issue occurs: if you can't get the app, check the store; if the expected entries are missing, check the import; if an entry is present but won't connect, check the server details and network; if only some requests fail, review the rules and name resolution. Troubleshooting by stage preserves evidence and reduces the risk of losing configuration, unlike repeated reinstalls.

Restore a purchase: restoring the app doesn't restore its configuration

Use Purchased items under the same Apple ID to find Shadowrocket. Purchase eligibility for iPhone and iPad is as listed on the App Store product page. When switching devices or reinstalling, restore the app first, then restore server details and configuration files. Check the App Store page and account settings to see whether Family Sharing applies. Having the app installed on one device doesn't mean another device has the same purchase status. If the store displays a prompt during recovery, complete the relevant account verification first.

For configuration recovery, check whether iCloud sync is enabled in advance and prepare an export copy of any configuration you need. Confirm separately what sync and export include, especially the active Config, manually edited rules, and server details. After restoring, review the list, selected server, Global Routing, and system permissions. Verify an actual request before enabling automatic connection conditions. Backups may contain authentication details, so keep them somewhere you control and remove sensitive information before sharing diagnostic material.

App updates and configuration changes: verify one variable at a time

App updates are managed through the App Store. Use automatic updates or check manually in the store settings on your device. The interface and available options depend on the installed version of the app. Keep important configurations before updating, then check existing connections and frequently used destinations. There's no need to rebuild everything just because an interface element has moved. Subscription refreshes, Config edits, and app updates are separate changes. Record them separately so you can identify what changed if an issue occurs, rather than replacing everything at once.

For routine maintenance, keep a copy of a configuration you've tested successfully. To change routing, note the destination domain and expected policy, then edit the relevant rule and make a new request after saving. If the result differs from what you expected, find the first matching rule and check whether an earlier, broader rule takes precedence. Then check the server or group referenced by the policy. Make one change at a time: keep it if verification succeeds, or roll it back if it fails. The same approach works for small tests of Host mappings and URL Rewrite.

Related guides

Purchase verification, first-time setup, and configuration migration

These three articles cover identifying the right product before purchase, making your first connection, and restoring your setup on a new device. Choose the article that fits what you're doing; there's no need to change every setting at once. The instructions assume you already have a configuration. For prices, compatibility, and purchase eligibility, check the App Store product page.

Authenticity Check

How to identify a counterfeit Shadowrocket app: check the developer, icon, and app ID

Open the product page from the search results and check Shadow Launch Technology Limited, the official icon, and app ID 932747118. Learn what to verify when a listing has a similar name and which App Store details to check before confirming a purchase.

Read the verification guide →

Getting Started

10 common Shadowrocket questions for beginners: subscriptions, connecting, and first-time authorization

Follow the first-use workflow for importing with Subscribe, authorizing a VPN configuration, selecting a server, and toggling the connection. Learn the difference between an item being added, a connection being established, and a request working as expected, and when to configure On Demand so you can troubleshoot step by step.

Read the beginner FAQ →

Advanced Setup

Back up and restore Shadowrocket configurations when switching devices: iCloud sync and configuration export

Review app purchase recovery and configuration migration separately, including the order for checking iCloud sync, exported copies, and post-restore verification. After switching devices, check the list, active Config, and authorization status before restoring your usual automatic connection settings.

Read the migration steps →

View all articles →