OFFICIAL GUIDE · TERMS
Look up terms by interface name or check matching boundaries by rule keyword. This page keeps interface terms in English and explains how they differ. Button locations and available fields may vary by device and Shadowrocket version.
There are two ways to get Shadowrocket: the iPhone and iPad app is a one-time $2.99 App Store purchase; the Mac, Windows, Android, and Linux versions are free. Mac downloads are available for Apple silicon and Intel. See Downloads for all platforms for download options and installation instructions. Desktop and Android installers are served from this site's /dl/ path.
INTERFACE / 01
Keep three things separate: which server is selected, which routing mode is active, and whether a connection is established. They determine the connection target, how requests are handled, and the current connection state, respectively.
Home is where you view server entries and control the connection switch. An entry in the list means its settings have been saved; it does not mean authentication succeeded or a connection is active. After importing, check the selected entry, confirm Global Routing, then connect and test an actual request.
Global Routing sets how requests are handled overall: Config uses the current configuration, Proxy sends requests through the proxy route, and Direct connects directly. If a rule does not seem to work, first check whether Config is selected before editing the rule.
Config is both the configuration manager and a mode in Global Routing. A configuration file can include rules, DNS settings, and more, but it is separate from the server list. Importing a configuration does not make it the active one. Before making changes, note the current selection and keep a backup.
On Demand lets the system start a VPN connection when specified conditions are met. It controls when a connection starts; it does not fix a password, server address, or rule. First confirm that a manual connection works. If the connection starts again after you turn it off, check the existing On Demand conditions instead of repeatedly toggling the main switch.
Add Server is where you enter details for an existing server manually. Select the protocol, then enter the address, port, and required authentication fields. Additional options such as TLS and transport must match the server. Required fields vary by protocol; do not copy an entire set of settings from a different type of entry.
Connectivity Test checks reachability under specified conditions. Results depend on the test target, local network, and server status. A successful test does not mean every website or app will work, and a lower value does not guarantee faster downloads. For a useful comparison, keep the test method and network conditions consistent.
PROTOCOLS / 02
Protocol names describe how two endpoints communicate; they are not a speed ranking. Whether a protocol works depends on the server configuration, local network, and transport conditions. Use the details from your existing server when configuring it.
Shadowsocks is an encrypted proxy protocol. Common settings include the server address, port, encryption method, and password. The encryption method must match the server; even a correct password may not work with the wrong method. Check any additional transport options in the existing entry as well—address and password alone may not be enough.
VMess is a proxy protocol. Authentication and transport settings together determine whether a connection can be established. UUID, transport, path, and TLS are separate settings; matching one does not make two entries equivalent. Compare each field with your existing server details. If authentication fails, also check that the device's date and time are correct.
VLESS is a proxy protocol with authentication and transport security as separate concerns. Selecting VLESS does not mean TLS or other security settings are configured automatically. Set the UUID, server name, and transport fields to match the server. Do not combine settings from different entries.
Trojan is commonly used with TLS. Password authentication and the TLS handshake are separate checks. Make sure the address, port, password, and server name match your existing settings. For certificate or server-name errors, check the domain and device time first; disabling certificate verification is not a routine fix.
Hysteria2 is based on QUIC and relies on UDP connectivity. It may work well on some high-loss links, but can fail when UDP is restricted or the network path is unstable. The protocol name does not guarantee speed. When testing, compare reachability and actual app performance before and after switching networks.
WireGuard is a key-based tunneling protocol. Configure the endpoint, interface address, peer public key, and routing scope together. Treat the private key as sensitive; never include it in public screenshots, logs, or shared content. A successfully established tunnel does not guarantee every destination is reachable, so check the routing scope and DNS settings too.
HTTP and SOCKS5 are different proxy protocol types. Authentication and available features depend on the server implementation. The protocol name alone does not mean a connection has the same encryption protection; an HTTP proxy is not automatically an HTTPS connection. Select the type actually provided by the server and check its security settings separately.
For more on transport requirements, see When to use Hysteria2 and QUIC.
RULE KEYWORDS / 03
A rule usually consists of a match type, match value, and action. Rule order affects the result. These explanations are for reading rule syntax; they do not mean you need to add every example to your configuration.
A Rule describes what to do when a condition is met. In a list checked in order, the first valid match usually determines where a request goes, so consider placement carefully for more specific rules. After adding a rule, verify that it matches as intended; its presence in a file alone does not prove it is active.
DOMAIN-SUFFIX matches a domain suffix. For example, example.com can match that domain and its subdomains. It matches domains, not URL paths or query parameters. Check the scope to avoid a broad suffix rule matching a subdomain that needs separate handling.
DOMAIN matches an exact domain, while DOMAIN-KEYWORD checks whether a domain contains a specified keyword. The latter has a broader scope and may match similarly named domains with different purposes. If you only need to handle one host, understand the boundaries of exact matching; do not use a keyword rule as a suffix rule.
GEOIP uses an IP geolocation database to determine an address's location. For example, GEOIP,CN,DIRECT sends matching addresses to DIRECT. Database results do not indicate a company's place of registration or the user's physical location. Both DNS results and database contents can affect the match; if it seems wrong, check the destination IP.
IP-CIDR matches IPv4 address ranges; IP-CIDR6 matches IPv6 address ranges. The number after the slash is the network prefix length. These rules match IP ranges, not domain text. A service may use multiple addresses or both IPv4 and IPv6, so one range may not cover every connection.
FINAL handles requests that did not match any earlier rule and is usually placed at the end of the list. It determines what happens to the remaining requests; it does not match a specific domain. Before changing FINAL, check that the existing action works and understand which requests are not covered. Do not stop after testing only a few websites.
These uppercase terms are rule actions: PROXY sends requests through a proxy, DIRECT connects directly, and REJECT blocks the request. They are distinct from the Proxy and Direct interface terms in Global Routing. DIRECT does not mean the client stops processing the request; consider the current configuration, including DNS and routing behavior.
USER-AGENT matches recognizable User-Agent information in requests. This information is not visible in every connection and is not a reliable substitute for app identification; one app may also make different kinds of requests. Visibility into encrypted requests depends on the circumstances, so do not assume this rule identifies all app traffic.
DOMAIN-SUFFIX,example.com,PROXY
GEOIP,CN,DIRECT
FINAL,PROXYSUBSCRIPTION & CONFIGURATION / 04
Subscriptions manage existing server entries; configurations organize rules and related behavior. They can be used together, but check which one you are importing, updating, or backing up.
Subscribe imports or updates server entries in bulk using a subscription URL you already have. An update may change names, settings, or the number of entries, so do not assume local edits will always be preserved. Subscription URLs may contain access credentials and should be treated as sensitive. If an update fails, first check that the URL is complete and that the network is working.
SERVER usually refers to a server address field or a related entry identifier. It may contain a domain name or an IP address. A working server entry also needs a protocol, port, authentication, and other details; an address alone is not enough. The display name is only a label and does not indicate the server's actual location or connection quality.
Scan QR Code reads import data encoded in a QR code; the code itself is not a proxy protocol. After scanning, check whether the contents are a single server entry, a subscription URL, or something else before saving. Do not share QR codes containing passwords or subscription credentials publicly. A successful import still needs to be tested.
DNS resolves domain names to IP addresses, an important step before a connection can be established. Check the path used for DNS requests separately from the path used for subsequent traffic. Changing DNS will not automatically fix every routing issue. If a domain is unreachable, distinguish a DNS failure from an unreachable address or failed server authentication.
URL Rewrite handles URL requests according to specified conditions; it is different from routing rules that send requests through PROXY or DIRECT. Whether a request can be handled depends on the rule, request type, and other requirements. Keep a copy of the original configuration and enable changes only when you understand their scope, to avoid disrupting normal requests.
Latency is the wait time under specific test conditions; it is not bandwidth or sustained download speed. Results depend on the test target, network congestion, and protocol handshake, so values from different test methods are not directly comparable. When choosing an entry, consider stability and actual app performance across multiple tests, not just a single ranking.
For setup steps, see the subscription guide. For the sequence from first import through connection testing, see the setup guide.
IPAD & APP STORE / 05
Purchase records, app installations, and configuration data are separate things. After redownloading the app on an iPad, check separately whether your server details and configurations have been restored.
The Apple ID linked to an App Store purchase is the account used to check purchase history. Check the account under Media & Purchases separately from the iCloud account signed in on the device; being signed in to iCloud does not establish which account made the purchase. The store region can also affect whether the app can be found and downloaded.
Purchased lets you find apps acquired with the original purchase account. Sign in to the same account to find and redownload Shadowrocket on iPhone or iPad. An app purchase record is not a backup of server data, so check your configurations after reinstalling. If prompted to buy again, first verify the account and the specific app listing.
iCloud syncing depends on the data the app supports, the account, and system settings; it does not mean all local settings are copied automatically. It is separate from restoring App Store purchase records, and restoring the app does not prove its configurations have synced. Before changing devices, check what can sync and separately back up any configurations you need to keep.
To verify the listing, see the Shadowrocket App Store page. For account regions, redownloading purchases, and options for each platform, see the download guide.
This page is the glossary for the Shadowrocket guide. If you run into a connection issue, note the current mode, selected entry, and error message, then work through the Troubleshooting steps. Remove passwords, private keys, and complete subscription URLs before sharing troubleshooting details.