Shadowrocket
Frequently Asked Questions

Check the storefront country or region for the Apple Account used to buy apps—not just your device’s language or region settings. Shadowrocket isn’t available on the mainland China storefront, and search results depend on your account’s storefront. On your device, go to Settings, open your Apple Account, then select Media & Purchases to check the account’s country or region. If you need to change it, follow Apple’s on-screen process and review the requirements for account balance, subscriptions, and payment methods first. Not finding the app doesn’t necessarily mean your device is incompatible; check the App Store listing for compatibility details.

Open the product page from our App Store verification guide, then check all three details: the developer is Shadow Launch Technology Limited, the app ID is 932747118, and the icon matches the official icon shown on this site. You can confirm the app ID from the product page URL ending in id932747118. Don’t buy based only on the app name or its position in search results. If names look similar, return to the product page and check each detail. Check the same page for the current price, compatibility, and update history rather than relying on a search snippet.

Sign in to the App Store with the Apple Account used for the original purchase, then find Shadowrocket in your purchased apps and download it again. The account currently used for cloud services may not be the account that bought the app. If you see a price button, check your purchase history, storefront, and signed-in account before paying again. Availability for redownloading and purchase eligibility across devices depend on the App Store listing. Restoring the app doesn’t restore its configuration; save and verify your existing subscription or server details separately.

Shadowrocket is primarily used on iPhone and iPad, and the iPad version is available from its App Store product page. If you’ve already purchased it, check that you’re using the original purchasing account and review the availability shown on the page. The same product page lists compatibility with Mac, Apple TV, and Apple Vision. System requirements and purchase eligibility are always subject to the App Store listing. Screen layouts and controls can vary by device, so don’t assume buttons are in the same place as on iPhone.

Shadowrocket is a paid commercial app. The US storefront lists it for a one-time purchase of $2.99; the actual price may vary by storefront and is shown in local currency. Buying the app is not the same as buying a service plan: it grants access to the app but doesn’t provide a server or subscription. To connect, you’ll need your own existing subscription or server details, and you’ll need to verify that the service and settings are valid. This site does not provide, sell, or recommend servers or subscriptions. Check the app purchase separately from the validity period and usage limits of any service you already have.

Shadowrocket uses a system VPN configuration to create a network tunnel, so iOS displays an authorization prompt the first time you connect. Make sure the prompt was triggered by the Shadowrocket session you just opened, then follow the system instructions to authorize it. If you previously denied permission, try connecting again in the app and check for an existing configuration in the VPN section of Settings. This permission allows the app to handle the relevant network traffic; it doesn’t mean the server is ready to use. After authorization, check the selected entry, Global Routing, and the results of an actual connection.

First, make sure a valid server entry is present and selected on Home, then check that system VPN authorization is complete. If the switch immediately turns off, note the error shown in the app and check the port, authentication details, protocol, and system time. Repeatedly tapping the switch won’t help diagnose the issue. Stop any other active VPN connection and try once more. If your device is managed, check whether a management policy is restricting VPN use. Save a copy of your current configuration before changing settings. Recreate the configuration only if you’ve confirmed that it’s corrupted or authorization is failing.

Home is generally where you view server entries, choose one, and control the connection. Config is for managing configuration files. Data shows traffic and connection-related information. Settings is where you adjust app preferences. Config under Global Routing is a routing mode, not the configuration-file management screen. This manual keeps the interface labels in English so you can match them to what’s on screen. Check which page you’re on before following a step. Layouts may vary by device or app version; if a control isn’t in the same place, look for the English label and its function.

First, confirm that the system shows a connected status. Then use a browser to open a site you know is reachable and check the destination and policy for that request in Data or the relevant connection log. If you’re using Config, test a domain explicitly covered by a rule in the configuration and verify which rule is matched. Connected only confirms that the tunnel is established; it doesn’t mean every destination is reachable. Change one condition at a time and note the current network, server entry, and Global Routing setting so you can identify what affects the result.

Check background activity for the relevant period in Settings > Battery, then consider whether the app was transferring data continuously, switching networks often, or repeatedly reconnecting. On Demand triggers connections based on configured conditions; it doesn’t guarantee lower battery use. Poorly chosen conditions can cause unnecessary connection attempts. Compare behavior with On Demand enabled and disabled under similar conditions, leaving other settings unchanged. If you need reliable automatic connections, keep suitable triggers enabled. If you don’t need automatic connections, turn it off and check the system VPN status after closing the app.

Make sure you copied the full URL for your existing subscription—not an account sign-in page, instructions page, or truncated text. Check for extra spaces or line breaks and confirm that the URL’s parameters are intact. Next, verify that your current network can reach the URL and that your existing service is still active. A URL may open to a sign-in prompt or error page, so opening it successfully doesn’t prove that its format is correct. If import still fails, note the error and ask the original service provider to confirm the format. Subscription URLs contain access credentials; don’t post them in screenshots, comments, or troubleshooting notes.

On Home, find the relevant subscription entry or group and use its update action. When it’s done, check whether the number or names of entries and the current selection have changed. Before updating, save important manually added entries and settings, and check for groups with similar names to avoid updating the wrong one. An update fetches content from the remote source; it may not preserve every local change and won’t extend your service’s validity period. If an update fails, check your network and the URL. Don’t delete the original subscription and repeatedly reimport it before saving information you may need to restore it.

Choose the same protocol as the existing server, then check the address, port, and authentication details. For Shadowsocks, verify the encryption method and other relevant settings. For VMess, VLESS, Trojan, and other entries, check fields such as the ID, TLS, transport, Server Name, and path as required by the service. The fields aren’t the same for every protocol. Enter only values explicitly provided in your existing service details; don’t guess from a name or try connecting by changing protocols. Save and test one entry first, then organize it into a group after confirming it works. This makes input errors easier to find.

Check that the QR code contains sharing details for a server you already have—not payment information, an account sign-in, or an ordinary web URL. When using Scan QR Code, allow camera access if needed and make sure the code is fully visible, sharp, and free of glare. If scanning from an image, use the original high-resolution image. After recognition, verify the protocol, address, port, and authentication fields; readable text doesn’t necessarily mean all parameters were captured. If the format isn’t supported by the current import method, use your existing server details to fill in Add Server manually. Don’t mistake your account password for connection credentials.

The subscription list comes from a remote source, so its contents and names can change when the original subscription is updated. Check whether only some groups are expanded or a filter is active, then confirm that you updated the intended subscription. Compare the information you saved before updating and check with the original service provider about changes to entries or service status. A name change alone doesn’t confirm that connection settings are unchanged. If the selected entry was removed, choose another valid entry and test it. For help reviewing an issue, share only redacted error messages and non-sensitive fields; keep subscription URLs and authentication details private.

Config applies the rules in the current configuration to decide how requests are handled. Proxy routes requests that can normally use a proxy through the selected proxy. Direct primarily connects without a proxy. If you have a verified routing configuration, Config is usually the appropriate mode. To check whether a rule affects a specific request, you can temporarily compare the results in Proxy or Direct, but switching modes won’t fix incorrect server settings. Restore the original mode after testing and check the connection log. System traffic and special exclusions may also be affected by related settings.

Pause the connection and confirm that your Wi-Fi or cellular network can reach a site you know is available. Reconnect, then check the selected server. Next, determine whether all sites fail or only specific ones. If all fail, check the server settings, service status, and DNS first; if only some fail, check the matched rules and the destination’s status. You can compare results temporarily in Proxy and Direct, changing only one condition at a time. Establishing a tunnel and completing a request to a remote site are separate steps. Use the error message and connection log in Data to narrow down the issue rather than relying on the connection icon alone.

Don’t conclude that a server is unavailable based on a single Connectivity Test timeout. Results depend on the test method, destination, current network, and server response; they don’t represent the full load time of a real web page. Check that the system time is correct, run a few more tests, and verify with an actual request. Then check the protocol, port, authentication, and TLS settings. If the test fails only on one network, keep the same entry and compare it on another network. Recording the test method and error type is more useful than comparing a single number. A temporarily low test result doesn’t guarantee consistent performance.

Make sure Global Routing is set to Config and that the configuration you edited is the one currently enabled. Check the actual request domain or address in the connection log, then find the first matching rule from top to bottom. A broad rule placed earlier may take effect before a more specific rule below it. DOMAIN matches a specific domain; DOMAIN-SUFFIX includes that domain and its subdomains; FINAL handles requests that didn’t match an earlier rule. Also verify that the policy name is valid. Test with a new request after making changes so an existing connection isn’t mistaken for a rule that failed to take effect.

First distinguish a domain lookup failure from a connection timeout or certificate error; these symptoms don’t necessarily have the same cause. Check the DNS settings and Host mappings in the current configuration, along with the relevant connection logs. On the same network, compare access with the connection stopped and started. Don’t change DNS, rules, and server settings all at once, or it’ll be difficult to identify the cause. A temporary improvement after switching to a particular address doesn’t make it a universal fix. Save the configuration before making changes and keep only changes that work. For certificate errors, check the system time and Server Name; don’t disable verification to mask the problem.