Shadowrocket · Official Manual
Shadowrocket Troubleshooting
First identify when the issue occurs, then check the relevant settings. Use the App Store page to verify purchase and installation details. Import and connection steps assume you already have your own subscription or server details. Expand a question to see the troubleshooting steps.
App Store · Purchase history
Verify and purchase
Check the product page, then your purchase account. Price, compatibility, and purchase eligibility are as listed on the App Store page.
Can't find Shadowrocket in the App Store? Start with these checks.
Open Shadowrocket’s App Store product page from the download guide, then check the country or region of the account currently signed in to the App Store. If search results don’t show the app, that doesn’t necessarily mean your device is incompatible; the app may not be listed in your current storefront. If the product page says it’s unavailable, read the notice and check your account region. If you need to change it, follow Apple’s steps for changing your account country or region, and first address any balance, active subscriptions, or Family Sharing restrictions. Availability for purchase depends on the current storefront.
How can I verify that I’m viewing the genuine Shadowrocket App Store page?
Check the app name, Shadowrocket, the developer, Shadow Launch Technology Limited, the official icon, and id932747118 in the product page URL. The app ID is 932747118, and its icon should match the official icon used on this site. Don’t rely on the name in search results alone. Before purchasing, check the compatibility and price details on the product page. System requirements are as listed on the App Store page; get and update the app through the App Store.
Do I need to buy Shadowrocket again after changing or restoring my device?
Sign in to the App Store with the account used for the original purchase, then look for Shadowrocket in your account’s purchased apps. If it appears, tap the redownload option shown by the store; you usually won’t need to buy it again. If a price is still shown, check the account used for Media & Purchases, your original purchase history, and the current storefront before paying again. Redownloading the app and restoring its configuration are separate steps. Save server details and settings from your original device separately; don’t assume they’ll be restored with your purchase history.
What does the one-time purchase include?
The one-time purchase covers the right to use the Shadowrocket client. It does not include a service plan, server details, or a subscription. The US storefront lists the price as $2.99; other storefronts show local currency, and the price shown on the App Store page before payment is the one that applies. Further setup requires your own subscription or server details. This site does not provide, sell, or recommend servers or subscriptions, and does not handle related service fees.
Where can I check purchase eligibility for iPad, Mac, and Apple TV?
Check the compatibility and purchase details on the same App Store product page. This manual focuses on iPhone and iPad; device support, system requirements, and purchase eligibility for Mac, Apple TV, and Apple Vision are as listed on the App Store page. To get the app on another device, first check your purchased apps using the account that made the original purchase. Family Sharing eligibility depends on the store page and your family settings. Don’t assume a purchase on one device automatically applies to every device.
See the download guide’s steps for verifying the genuine app →
Home · Settings · VPN
Installation and first launch
Installation, import, and system authorization are separate steps. First make sure the app opens normally, then check the connection requirements.
What should I do first after installing Shadowrocket on iPhone?
First, make sure the app opens normally, then have your existing subscription or server details ready. Use the add option on Home to import them, check the selected server and Global Routing, then try connecting. The first connection may prompt you to add a VPN configuration. Authorize it only after confirming that Shadowrocket initiated the request. Installing the app doesn’t configure your network or route every request through a proxy. System requirements are as listed on the App Store page.
What does the system prompt to add a VPN configuration mean?
This system prompt asks for permission to create a VPN configuration; it is not a purchase prompt. Once approved, Shadowrocket can use the system network extension to connect and apply the selected routing settings. Confirm that the prompt appeared when you started a connection in the app, then authenticate as requested by the system. If you previously denied permission, try connecting again in the app and check the VPN configuration status in system Settings. If device management restrictions apply, ask your administrator which settings are allowed; repeatedly toggling the connection won’t resolve those restrictions.
Can I install Shadowrocket on iPad, and how does it differ from iPhone?
Open the same product page in the iPad App Store and check that your device meets its compatibility requirements. System requirements are as listed on the App Store page. If you’re using the account that made the original purchase, redownload the app from your purchased apps. The iPad’s landscape layout and visible area may differ from iPhone, but you can still follow the English interface labels, such as Home, Config, and Settings. After importing, recheck the selected server and configuration; using the same account doesn’t mean connection settings have fully transferred.
The interface is in English. How should I follow this manual?
This manual keeps interface labels in English so you can find them directly in the app. Home shows servers and connection status, Config manages configuration files, Settings contains app settings, and Data shows available traffic statistics. In Global Routing, Config, Proxy, and Direct are the three routing modes. When you see Add Server or Subscribe, follow the corresponding import steps. Don’t confuse the Config tab with the Config option in Global Routing.
What if the connection switch won’t turn on or turns off immediately?
First, check that you’ve granted system VPN permission and selected a working server. Temporarily disconnect other active VPN connections, check for device management restrictions, and try again. If you recently changed settings, note them and switch back to a known-working configuration for comparison. If the problem persists after restarting your device, check the app logs for configuration or connection errors. Don’t delete the app as a first step. Before deleting it, save any existing subscription URLs, server details, and configuration to avoid losing data while troubleshooting.
Subscribe · Add Server · Scan QR Code
Subscription and server imports
Verify imports and connections separately. These steps are for checking subscriptions or server details you already have.
Subscribe import failed. What should I check, and in what order?
First, make sure you’re using your own existing subscription URL and check for spaces, line breaks, or missing parameters introduced when copying it. Confirm that your current network can reach the URL and that the response contains subscription data the client can read—not a login page, error message, or ordinary web page. Then check whether the subscription has expired or its provider changed the URL or format. A link opening in a browser only confirms that it returned a response, not that the content is valid. Don’t post the full subscription URL publicly while troubleshooting.
Which fields are most often entered incorrectly when adding a server manually with Add Server?
Choose the protocol that matches your existing server details, then check the address, port, and authentication fields one by one. Shadowsocks, VMess, VLESS, Trojan, and Hysteria2 require different fields; changing only the protocol name while keeping another protocol’s parameters won’t work. If the server uses TLS, check the server name and related fields against the original details. The address field usually takes a hostname or IP, not a full web URL. Don’t guess at encryption, authentication, or transport settings.
Scan QR Code succeeded, but why can’t I connect?
A successful Scan QR Code means the code was recognized and an entry was created; it doesn’t confirm that the server is currently available. Open the imported entry and check its protocol, address, port, and authentication details, then select it and run Connectivity Test. If it times out, check your network, server status, and whether the parameters are still valid. If the test gets a response but web pages don’t load, check Global Routing, DNS, and the route taken by the actual request. A QR code may contain credentials, so remove them before sharing a screenshot.
A subscription update changed the server list. How can I avoid losing my settings?
Before updating, note the currently selected server and subscription group, and save a local copy of your configuration if needed. After the update, check the number and names of entries and confirm that your current server is still listed. Select an available entry and test it again. Updates refresh the entries based on the returned content; don’t assume manual changes will be preserved. Record important custom settings separately. Check the server list under Subscribe and the routing rules under Config separately; updating a subscription doesn’t necessarily update all rules.
How can I tell if a subscription has expired, and what should I hide when sharing troubleshooting details?
Note whether the failure occurs while fetching the subscription, parsing its contents, or connecting to a server, then check the app’s message. If the URL returns an authentication error, empty content, or invalid format, ask the original provider to confirm the subscription is still valid and check its format. A timeout from one server alone doesn’t mean the entire subscription has expired. When sharing troubleshooting details, include only the necessary error text, protocol, and steps. Hide the full subscription URL, authentication parameters, passwords, and QR codes. Use redacted information for comparison, and never share credentials that could be used directly.
Global Routing · Connectivity Test · DNS
Routing rules and troubleshooting
Check the system connection, server response, DNS resolution, and rule matching separately. Compare the same destination each time to see whether a change helped.
How should I choose Config, Proxy, or Direct in Global Routing?
Config applies the rules in your current configuration to route requests; use it for everyday traffic when you’ve confirmed the rules are correct. Proxy handles requests routed through the client using proxy mode, which can help you check whether rules are affecting access. Direct uses a direct connection path and can help you check your underlying network. Before selecting Config, confirm which file is enabled on the Config page. These modes change routing behavior; they don’t fix incorrect server parameters. Restore your normal configuration when troubleshooting is complete.
The app says connected, but web pages won’t load. What should I check first?
A connected status only confirms that the system connection is established; it doesn’t guarantee that the server, DNS, or rules are working. First, confirm that your current network can open regular pages, then test the selected server. Compare Proxy and Config using the same destination. If only Config fails, check which rule and policy match and which configuration is selected. If both fail, check the server parameters, DNS, and logs. Change one setting at a time and record the result so you can identify the cause. Restore your usual routing mode after testing.
Connectivity Test passes, but why does actual browsing still fail?
Connectivity Test results depend on the test method and destination. A response only confirms that the specific test succeeded; it doesn’t mean every domain, protocol, or request will work. First, confirm that actual browsing uses the same server, then check whether the rules route the request to DIRECT, PROXY, or REJECT. If only one domain fails, check DNS resolution, the destination site’s status, and the relevant rules. If all pages fail, prioritize checking the actual proxy connection and authentication parameters. One latency reading doesn’t prove that all network access is working.
DNS lookup fails or a domain won’t open. How can I find the cause?
Check the logs for resolution errors and note the DNS settings in the current configuration. Confirm that the resolver is reachable through your current network or route, then check whether you recently changed DNS, Host, or related rules. Restore one known-working setting at a time, reconnect, and test the same domain. Don’t try several unfamiliar resolver addresses in a row. Opening an IP directly is only a limited comparison: a site may rely on its domain name and TLS, so an IP response doesn’t prove the full site will load correctly.
Rules don’t seem to apply. Should I check the configuration file or the server?
First, set Global Routing to Config, then check the active file under Config. Rules are usually matched in order, and the first match determines the policy. The placement of conditions such as DOMAIN-SUFFIX and GEOIP, as well as the fallback FINAL rule, affects the result. Then check the actual requests and policies in the logs, and confirm that a usable server is available for the rule’s proxy policy. Switching servers alone won’t fix rule order. example.com is used only to illustrate syntax; it isn’t a universal rule for every site.
How should I troubleshoot increased battery use, slower speeds, or issues after an update?
Compare results on the same network, using the same server and destination, and rule out background downloads or changes in signal strength. Check whether frequent tests, detailed logging, or On Demand are enabled; adjust as needed and observe the results. Don’t infer the cause from a single reading on the system battery screen. After an update, reconnect, check the current configuration and authorization status, then revert recent changes one at a time. If the issue persists, save redacted logs and reproduction steps, then continue with the troubleshooting manual. Save your configuration before reinstalling so data loss doesn’t create another problem.