Official Guide / FAQ

Shadowrocket FAQ

First identify where the problem occurs, then check each item in turn. Purchase history, subscription contents, and connection status are three separate things.

01 / APP STORE

Verify & purchase

Check the product page and purchase account first. Compatibility, price, and eligibility are as shown in the current App Store listing.

Can't find Shadowrocket in the App Store? What should I check first?

Open the App Store product page from this site's purchase verification page and confirm that it lists Shadowrocket; don't rely on the search name alone. If the store says the app isn't available in your region, check the country or region for the Apple ID used with the App Store. This is separate from your device's language setting. To change it, follow Apple's instructions under Settings → Apple ID → Media & Purchases → View Account → Country/Region, and first resolve any balance, subscription, or payment-method requirements. Availability is determined by what the current storefront displays.

How can I confirm the Shadowrocket app in the App Store is genuine?

Check three details: the app name is Shadowrocket, the developer is Shadow Launch Technology Limited, and the product page URL contains id932747118. Compare its icon with the official icon shown on this site. Similar names or artwork aren't a substitute for these checks. Before buying, expand the store page's compatibility and purchase information to confirm your device and account meet the requirements. The App Store is the only place to get the app; updates are also handled through the App Store.

Does buying Shadowrocket include access to a server?

A one-time app purchase is not a service plan. Buying Shadowrocket gives you a license to use the client; to connect, you'll need your own subscription or server details and must confirm that the service is still active. This site doesn't provide, sell, or recommend servers or subscriptions; it explains how to import, configure, and troubleshoot details you already have. The US storefront lists a one-time purchase price of $2.99. Other storefronts show local currency; check the App Store page for the final price and purchase terms.

Do I have to buy Shadowrocket again after getting a new iPhone or reinstalling it?

Sign in to the App Store with the Apple ID used for the original purchase. Find Shadowrocket in your account's purchased items or app list, then follow the store prompts to download it again. If a price still appears, check the current store account, purchase history, and storefront before paying again. Your purchase history is separate from your configuration data: downloading the app again won't restore subscriptions, server settings, or rule files. Check your backups separately before changing devices. Eligibility for purchases across devices and Family Sharing depends on the App Store page and your account's details.

Can I install Shadowrocket on iPad? Where can I check Mac and Apple TV compatibility?

Find Shadowrocket on the App Store using the same product page to check availability and install it on iPad. First confirm the purchase is associated with your Apple ID, then check compatibility. The iPhone and iPad layouts may differ by screen size, but the steps for importing existing details, choosing Global Routing, and authorizing a connection are the same. Check the compatibility section on the same store page for Mac, Apple TV, and Apple Vision support. System requirements and whether the purchase is universal are as listed on the App Store page.

Check App Store purchase and authenticity details →

02 / FIRST CONNECTION

Installation & first launch

System authorization determines whether a configuration can be created; verify server availability separately after connecting.

Why does Shadowrocket ask to add a VPN configuration the first time I open it?

This is a system permission prompt for setting up a network connection, not a purchase confirmation from the App Store. First import and select your existing server details. When you start a connection, confirm the app name, then allow the configuration and complete authentication as prompted. Authorization means the system allows a connection to be created; it doesn't guarantee the remote server is available. If you tapped Don't Allow, return to Shadowrocket and try connecting again. Also check whether a VPN configuration appears under Settings.

What if the connection switch on Home won't turn on or switches off right away?

First select a complete server configuration, then check whether the system is prompting you for VPN permission or authentication. The switch may not stay on until you complete the prompts. Next, review existing VPN configurations under Settings and check for conflicts with other network connection tasks. If the device is managed by an organization, its policies may restrict permissions; check with the device administrator. If the problem persists, note the exact error and when it occurred, then check Log. Don't assume every connection problem means the subscription has expired.

The app is in English. How do I follow the instructions?

This guide keeps the app's English interface labels so you can match them directly: Home is the main screen, Add Server is for adding server details, Config is for viewing configuration files, and Settings is where you check app settings. Under Global Routing, Config, Proxy, and Direct select the corresponding routing mode. To change the app language, check Settings on your device to see whether Shadowrocket offers a language option. Available options depend on the app and system; if you can't find one, continue using the English labels above.

If the system shows VPN, does that mean Shadowrocket is working normally?

The VPN indicator alone can't confirm that. It mainly reflects the system's connection state; remote server authentication, DNS resolution, or rule matching may still fail. After connecting, test a website you can normally access, then test the destination you need to reach through the proxy. Check Log for errors on the corresponding requests. If only some destinations fail, check the rules and DNS first. If all requests fail, review your server details, service validity, and current network. Connectivity Test results are diagnostic clues, not definitive proof.

What should I back up before updating the app?

Make sure you can retrieve your existing subscription URL, manually entered server settings, and the Config file you're using. Save a restorable copy of any rules you've edited. If you use iCloud sync, confirm that syncing has completed; turning it on doesn't guarantee a successful backup. App updates are delivered through the App Store and usually don't require another purchase, but updating isn't the same as reinstalling. Before deleting the app, switching devices, or clearing configurations, verify that your backup is readable and store any credentials securely.

Follow the quick-start steps →

03 / EXISTING CONFIGURATION

Subscription & server import

The steps below assume you already have your own subscription or server details. Identify the type of information first, then verify the import.

Where do I import an existing subscription, and how is it different from Config?

First identify what kind of details you have. An existing subscription usually provides and updates a server list. In Home, go to Add Server, choose Subscribe, enter the full subscription URL you already have, and save it; the exact location may vary in the current interface. Config files mainly contain rules, policies, and related settings. Don't enter an arbitrary rule-file URL as a server subscription. After importing, confirm the expected entries appear in the list, then select a server. Saving a URL without successfully retrieving its contents doesn't complete the import.

Subscription import failed or the list is empty. What should I check, and in what order?

First make sure the URL was copied in full, including any trailing parameters, capitalization, and without extra spaces. Confirm it's an existing subscription URL, not an account sign-in page or an ordinary webpage. Read the exact update error to distinguish a failed network request from an authentication or parsing failure. Then confirm the subscription is active and the current network can reach its URL. Avoid changing several settings at once, and never post a full URL containing authentication parameters publicly. Redact sensitive details before sharing an error.

How do I update an existing subscription, and what should I check afterward?

In Home, find the existing Subscribe group or subscription entry and use the update option available in the current interface. Wait for the request to finish, then check for errors and review the server list. Updating rereads the subscription's contents; it doesn't renew the service. If an old entry is removed or renamed, you may need to select a server again. After a successful update, check your current selection, Global Routing, and actual access results. Verify manually added entries that aren't part of the subscription separately; they aren't updated with it.

Why can't I connect after importing with Scan QR Code?

Scan QR Code reads the details encoded in a QR code; it doesn't check whether the remote service is available. First confirm whether you imported a single server or a subscription URL, then check that the protocol, Address, Port, and authentication fields are complete. For TLS configurations, compare parameters such as SNI with the original details; don't change values just because names look similar. QR codes may contain sensitive information, so protect them like passwords. If scanning succeeds but the connection fails, check the server settings, current network, and Log errors in that order.

Can I reuse the same settings when adding VLESS, Trojan, or WireGuard manually?

Settings aren't interchangeable between protocols. In Add Server, choose the protocol that matches your existing details, then enter the address, port, and required authentication fields for that protocol. VLESS identity fields, the Trojan Password, and WireGuard keys and Peer settings each have specific meanings. Match the transport, TLS, and SNI settings to the original details; an address and port alone may not be enough. If you see a certificate error, check the domain and certificate settings rather than weakening certificate verification to hide an entry error.

Learn how Subscribe and Config differ →

04 / ROUTING & DIAGNOSTICS

Routing rules & troubleshooting

Change one thing at a time. Keep the original configuration, record the exact error, and retest under the same network conditions.

How do I choose between Config, Proxy, and Direct in Global Routing?

For everyday rule-based routing, choose Config, provided the active Config file contains applicable rules. To temporarily test the proxy path, choose Proxy so requests handled by the client are routed through the proxy. To check access over your regular network, choose Direct. Direct doesn't turn off the system connection switch, and Proxy isn't a universal fix for access problems. After switching, retry the target request and check Log. Restore the previous mode when you're done testing.

Connected, but webpages won't load. Should I check DNS or the server first?

Narrow down the scope of the problem before choosing what to check. Disconnect and confirm that the current network can access the internet, then reconnect and test different destinations. Check Log for resolution errors, authentication failures, or timeouts. For resolution errors, check the active Config and the DNS settings currently in effect under Settings. For authentication failures, check the server credentials. For timeouts, check the address, port, and network reachability. Change one thing at a time and keep the original values; changing DNS, rules, and server settings together makes it hard to identify the cause.

Only one website takes the wrong route. How do I check the rule order?

First confirm that Global Routing is set to Config and that the active Config file is the one you're reviewing. Reload the destination, then use Log to check the actual request domain and matched rule; don't rely on the browser's address bar, since one page may request multiple domains. Review conditions such as DOMAIN, DOMAIN-SUFFIX, and IP-CIDR from top to bottom, along with their policies. Earlier matching rules may take precedence over later entries. FINAL handles requests that didn't match an earlier condition. Test again after editing and keep a backup of the original configuration.

On Demand keeps connecting automatically. How can I switch back to manual control?

Check the On Demand settings and existing network conditions under Settings to see what is triggering automatic connections. To restore manual control, turn off On Demand first, then turn off the connection switch on Home. If you only disconnect while leaving On Demand conditions in place, a network change may trigger another connection. Test separately on Wi-Fi and cellular. If the device still connects automatically, check the system VPN configuration and device management policies so you don't mistake another configuration's behavior for an unsaved setting.

Battery use seems higher. How can I tell if connection settings are the cause?

Compare similar usage periods in your device's battery statistics under Settings, taking screen time, signal strength, and actual data transfer into account. The system may attribute VPN-processed network activity to related processes, so one percentage alone isn't conclusive. Check for frequent reconnects, continuous detailed logging, overly frequent connection tests, or On Demand conditions that keep triggering. Change one setting at a time and compare similar periods. Don't disable certificate verification or remove necessary rules just to lower a statistic.

See the Settings guide →