Shadowrocket
FAQs and Troubleshooting
Identify where the issue occurs, then open the relevant answer. Check each step based on your current status, from App Store purchase and first-time authorization to importing an existing subscription. When troubleshooting connection issues, change one variable at a time.
20 questions across 4 categories. Select a question to expand the answer. Keep configuration credentials somewhere only you control.
Before You Buy
Authenticity Check & Purchase
Verify the app and purchasing account first, then check the price, device compatibility, and how to restore a purchase. See the official App Store purchase guide for the only way to get the app.
Can't find Shadowrocket in the App Store? What should you check first?
First, make sure the search term is exactly Shadowrocket, then open the App Store product page from this site's authenticity check page. Search results and app availability may vary by storefront region, so don't rely on search ranking alone. Check the country or region for your App Store account. If you need to change it, follow Apple's official steps under Media & Purchases > View Account > Country/Region, and review the requirements for your balance, active subscriptions, and payment method first.
How can you verify that an App Store listing is the genuine Shadowrocket?
Check each detail on the App Store product page: the name is Shadowrocket, the developer is Shadow Launch Technology Limited, and the app ID in the page URL is 932747118. Compare the icon with the official icon used on this site; don't rely on the name or a similar-looking rocket image alone. Before confirming a purchase, check the app name and developer again. Price, system requirements, and purchase availability are as listed on the App Store page.
Does the one-time purchase include a connection service?
A one-time app purchase is not a service plan. Buying Shadowrocket gives you a license to use the app; get any subscription or server details needed to connect from your service provider. The US storefront lists a one-time price of $2.99; the actual price is as shown on the App Store page, and other storefronts display local currency. App purchase records and connection service validity are managed separately. Owning the app doesn't mean an existing subscription is still active.
Do you need to buy Shadowrocket again after getting a new iPhone or reinstalling it?
Sign in to the App Store with the Apple Account used for the original purchase. Find Shadowrocket in your purchased apps and download it again. If the page still shows a price, check the purchasing account, purchase history, and current storefront region before paying again. Eligibility for use on your current device is as stated on the App Store page. Restoring the app doesn't restore its data, so back up your configuration separately before changing devices and check what the backup includes.
Can you install Shadowrocket on iPad? Where can you check compatibility with other Apple devices?
Shadowrocket is primarily for iPhone and iPad, and the app is available only from its App Store product page. On iPad, use the account that made the purchase to check your purchase history and confirm eligibility on the product page. Check the Compatibility section on that page for Mac, Apple TV, and Apple Vision; system requirements are always as listed on the App Store page. App compatibility and configuration data syncing are separate matters, so check for your existing servers and configuration files when you first open the app.
Before You Connect
Installation & First Launch
Complete system authorization first, then check your connection selection in the app. For the full step-by-step process, see Getting Started.
Why does iOS ask to add a VPN configuration when you connect for the first time?
Shadowrocket needs an iOS VPN configuration to establish a connection. Make sure the prompt was triggered by an action in the Shadowrocket app you're using, then approve it and complete any device passcode or authentication steps. The prompt may not appear as soon as you open the app; it usually appears when you start a connection. If you previously denied permission, try connecting again in the app. If a managed device restricts VPN configurations, check its management policy rather than changing unrelated settings.
What should you check if the connection switch won't turn on or turns off right away?
First, make sure a complete server entry is selected in Home, then check that you've completed the system authorization required for the first connection. Next, check whether another VPN configuration is connected in iOS Settings; disconnect it before trying again if needed. If the switch still turns off immediately, note the error message and check Logs. Look for missing configuration details such as the address, port, or authentication fields. Fix errors you can reproduce instead of repeatedly tapping the switch.
The interface is in English. Which sections should you start with?
Start with these key sections: Home shows servers and connection status; Add Server lets you add existing server details; Config manages configuration files; Settings contains app settings; Global Routing controls how traffic is handled. This manual keeps these interface labels in English so you can match them directly. To check the app's language options, look at the Shadowrocket page in iOS Settings. Available languages depend on what the app and system currently show; you don't need to reimport data just because the interface language is different.
Why does the connection start again after you turn it off with On Demand enabled?
On Demand can start a connection when specified conditions are met. Network activity that meets those conditions may trigger another connection, so disconnecting manually doesn't necessarily stop the triggers. To pause this behavior, check and turn off On Demand in Shadowrocket, disconnect the current session, then check the VPN status in iOS Settings. Before turning it back on, review the existing conditions and make sure they suit your current network. Repeated automatic connections don't necessarily indicate an app problem.
What should you back up before updating the app, and will you need to set it up again afterward?
Update the app through the App Store. Before updating, keep important configuration files, existing server details, and any necessary group settings. Check exactly what your backup includes; remembering a subscription name alone isn't enough to import it again. Backups may contain authentication details, so store them somewhere only you control. After updating, check the active file in Config, the selected server in Home, and the Global Routing setting before testing the connection. Don't delete existing entries until you've verified your data.
Use an Existing Configuration
Subscription & Server Import
The steps below assume you already have your own subscription or server details. This is the official Shadowrocket website and user manual; it doesn't provide server access. Get subscriptions from your service provider.
How do you import an existing subscription?
Get the subscription link from your service provider. Open Add Server, select Subscribe as shown in your version of the interface, and paste the complete link into the appropriate field. Check that the beginning, end, and query parameters are all intact, then save and wait for the import to finish. Confirm that the expected entries appear in the list, then select one to test. Subscription links may contain credentials, so don't share the full link in public screenshots or posts. When copying, leave out any explanatory text, quotation marks, or line breaks.
What should you check first if a subscription import fails or returns an empty list?
First, make sure the device has a working internet connection. Then check that the link is complete, the subscription is still active, and its content format is supported by Shadowrocket. A login page, error page, or empty response doesn't mean server details were imported successfully. Retry the request without deleting existing entries, and note the exact error. If the link may have expired or the content looks wrong, check with your service provider. Redact authentication parameters from the link when reporting the issue, and don't repeatedly delete older entries that still work.
How do you update a subscription, and do you need to select a server again afterward?
Use the update option in the action menu for the existing subscription and wait for the request to finish. Then check whether the number or names of the entries have changed; the exact menu location may vary by interface. If the update fails, keep the old configuration and check your network and subscription validity. If your provider renames entries or removes a server, check any previous selections or group references. A successful update doesn't confirm that the connection works: select a server and test access again.
If you have server details only, what should you enter in Add Server?
Choose the protocol specified by your service provider, then enter the server address, port, and any required authentication details. Required fields vary by protocol; don't assume that TLS, transport, or hostname settings can be used interchangeably just because their names look similar. Compare each field with the original details before saving, paying close attention to spaces in the address, port digits, and capitalization in authentication fields. Don't turn off security checks just to troubleshoot. If a parameter is unclear, ask your service provider to confirm the original configuration.
What should you check after Scan QR Code succeeds?
Allow camera access when prompted, then use Scan QR Code to scan the QR code for an existing configuration. After it's recognized, check the protocol, server address, and port, then save and select the entry to test it. A QR code may contain a single server or a subscription link; a successful scan doesn't necessarily mean all content has been imported. If scanning fails, check image clarity and make sure the QR code is complete, or compare its format with the original details. Store QR codes containing authentication details securely with your personal configuration data.
From Status to Cause
Routing Rules & Troubleshooting
A connected status confirms the connection state, but you still need to verify the route used by the actual request. For rule syntax and configuration file structure, see the Configuration Reference.
How should you choose Config, Proxy, or Direct in Global Routing?
Config applies the rules in the active configuration file to decide how requests are handled, making it suitable for everyday rule-based routing. Proxy sends applicable traffic through the selected proxy route and can help you check connections outside your rules. Direct uses a direct route. Select one mode and test the same destination to avoid changing both the server and rules at once. Before using Config, make sure the file is enabled and contains the rules you expect; seeing a configuration name in the list isn't enough.
The app says it's connected, but websites won't load. What should you check, and in what order?
Disconnect and confirm that your current Wi-Fi or cellular network can access the internet on its own. Then reconnect and check the selected server and Global Routing setting. Use Connectivity Test to check reachability, and also test the pages you actually need; a test result alone doesn't confirm full access. If Proxy works but Config doesn't, check your rules, policy groups, and DNS. If both fail, verify the server details and service validity, then check Logs for errors on the relevant requests.
Why aren't the rules in Config working as expected?
First, confirm that Global Routing is set to Config and that the active configuration file contains the Rule you changed. Rules are generally checked from top to bottom, and the first match determines the policy. A broad rule near the top can therefore take precedence over a more specific rule below it. Check that rule types such as DOMAIN and DOMAIN-SUFFIX match the target, and verify that PROXY or policy group references are valid. FINAL should be the fallback rule at the end. Use Logs to see which rule matched, then make the smallest change needed.
How can you tell whether a request is using a direct connection?
Distinguish Global Routing's Direct mode from DIRECT in a Rule: the former is an overall routing mode, while the latter is the policy specified by an individual rule. Send a new request in Direct mode, or use Config and make sure the target matches a DIRECT rule, then check the request's policy and route in Logs. Existing connections may keep their previous state, so send a new request to test. Don't infer the route from whether a web page loads; the same page may work under different policies.
How can you narrow down the cause of increased battery use during a continuous connection?
Check app activity for the same period in iOS Battery settings, and consider data transfer, signal strength, and background tasks. Battery percentage alone doesn't tell the whole story. Frequent network changes, continuous data transfer, and repeated reconnections can all increase battery use. Check Logs for repeated failed retries, review your On Demand conditions, and change one setting at a time. Compare battery use over similar periods on similar networks before deciding whether to change how you connect.