Official manual · Troubleshoot by symptom

Shadowrocket FAQ
Purchase, import, and connection troubleshooting

First identify where the problem occurs, then change the relevant setting. For purchase issues, check the App Store account. For import issues, check the content and format. For connection issues, work through the device network, server, rules, and DNS in order.

  • 4 issue categories
  • 20 troubleshooting guides
  • Open a question to see the steps

New to the app? Start with the user guide. To buy the app or restore a purchase, see App Store purchase verification.

App Store

Purchase verification

Check the account, product page, and purchase history before deciding what to do next. See the App Store guide for details on regions and purchase availability.

Can't find Shadowrocket in the App Store? What should you check first?

First check the storefront associated with the Apple Account used for App Store purchases—not just your device language or current location. In Settings, go to Apple Account, Media & Purchases, View Account, then Country/Region to confirm the storefront. Next, open the Shadowrocket product page to check availability. If you need to change your region, use the official option shown there and review the requirements for your balance, existing subscriptions, and payment method first. Changing your device region does not change your storefront account region or guarantee that the app will be available.

How can you verify that the Shadowrocket listing is genuine?

Check the app name, official icon, and developer information together: the product is named Shadowrocket, the developer is Shadow Launch Technology Limited, and the product page URL contains id932747118. The icon should match the official App Store icon shown in this site's header. Don't rely on search ranking, a similar name, or icon colors alone. Open the product page to check compatibility, price, and the purchasing account. Refer to the App Store listing for system requirements and purchase availability. Our App Store guide points out where to check these details.

How much does Shadowrocket cost, and what does the one-time purchase include?

Shadowrocket is a paid App Store app sold as a one-time purchase. The US storefront price is $2.99; actual pricing and purchase terms depend on the current store listing, and other storefronts show local currency. Buying the app does not include a server or connection service. You’ll still need your own subscription or server details. We don’t provide, sell, or recommend servers or subscriptions. Check the original service provider’s management channel for the validity and availability of any service you already use.

Do you need to buy Shadowrocket again after switching iPhones or reinstalling it?

Sign in to the Apple Account used for the original purchase. In the App Store account page, open Purchased or your app list, find Shadowrocket, and try downloading it again. If a price appears, first confirm that Media & Purchases is using the correct account and check your purchase history; don’t pay again right away. Store region, app availability, and purchase eligibility can affect restoration, so refer to the App Store listing. Restoring the app does not restore your personal configuration. Keep your server details, subscriptions, and configurations backed up separately.

Can you install Shadowrocket on iPad, and does Family Sharing apply?

Shadowrocket is available for iPhone and iPad. Check the App Store listing for system requirements and device compatibility. On iPad, first confirm that Media & Purchases is signed in to the account used for the original purchase, then look for the app under Purchased. For Family Sharing, check whether the product page indicates support and review your family group’s purchase-sharing settings; don’t assume every account can restore the app directly. Check the same listing for Mac, Apple TV, and Apple Vision compatibility and purchase eligibility. App Store is the only place to get the app.

Home / Settings

Installation and first launch

Start by checking your existing server, system authorization, and current configuration. Interface labels remain in English so you can match them without guessing.

After opening Shadowrocket for the first time, should you import a configuration or turn on the connection first?

First prepare and import your existing subscription or server details. Confirm that a server is available in Home, check Global Routing and the active Config, then turn on the connection. Installing the app alone does not create a working connection. For your first test, use a configuration you know is valid, and avoid changing DNS, rules, and multiple advanced options at once. If the list is still empty after import, troubleshoot the import first. If servers appear but won't connect, check the server parameters and system authorization; treat these as separate issues.

The system asks to add a VPN configuration. What should you check?

When you first enable a connection, the system may ask permission to add a VPN configuration. This authorization step is required to establish a system network connection. Confirm that the prompt appeared immediately after you turned on the Shadowrocket connection, then follow the system instructions and authenticate your device. If you previously canceled, return to the app and try connecting again. A system VPN configuration is separate from a subscription or rules file, and granting permission does not guarantee that a server is available. On a work- or school-managed device, check whether its management policies restrict adding VPN configurations.

The connection switch won't turn on, or turns off right away. How can you troubleshoot it?

First check that a server is selected and the current configuration loads correctly. Then confirm that system authorization hasn't been canceled. In Settings, open the VPN management page and check whether a Shadowrocket configuration is listed. Stop other tasks using the VPN connection and try again. If the connection still drops immediately, review the available connection logs to distinguish incorrect parameters, a configuration loading failure, and system restrictions. Don't repeatedly erase all data. Save your current settings and the error message, check for an app update in the App Store, and restart the device if needed before testing again.

The interface is in English. Where can you find Home, Config, and Settings?

This manual keeps interface labels in English so you can match them directly. Home is where you check the server list and connection status. Add Server is for entering server details, Config manages configurations, and Settings contains related options. Global Routing is where you choose how traffic is handled; it is not where you select a server protocol. The available app languages depend on what the app and system currently display. When following a guide, start with the screen name, then locate the specific option. Don't confuse the similarly named system VPN settings with Config inside the app.

Shadowrocket uses more battery after connecting. Which settings should you turn off?

Check battery usage and timing in the system battery settings. Distinguish continuous traffic, repeated reconnections, frequent speed tests, and background activity from other apps; battery drain alone doesn't identify a protocol as the cause. During testing, avoid running Connectivity Test repeatedly, check whether On Demand is triggering frequent connections, and look for repeated disconnects when the network changes. Change one setting at a time and compare under similar conditions. Don't remove necessary rules or change security settings just to save battery. If the issue persists, save a record and check the configuration and connection status.

Subscribe / Add Server

Subscription and server import

These steps assume you already have your own subscription or server details. Identify the content type before importing, updating, or organizing it.

How do you import an existing subscription, and how is it different from adding a single server?

A subscription typically imports and maintains a group of server details, while a single server requires you to enter parameters such as its address, port, and protocol. First identify whether you have a subscription URL, a single-server share link, or a complete configuration, then use the matching import option in the app. Don't enter a subscription URL in a server address field. Check the available types and fields in Add Server, enter the information as provided, and save it. Return to Home and confirm the entries appear. These steps assume you already have your own subscription or server details.

Subscription import failed or the list is empty. What should you check first?

First check that you copied the full address and that it doesn't contain extra spaces, line breaks, or punctuation added by a messaging app. Then verify that the address is still valid and accessible. A web page, sign-in prompt, or empty response does not mean the app received readable subscription data. Next, check whether your current network can reach the address and whether the content format matches the import method you selected. Change one thing at a time and retry. If it still fails, note the error and ask the original provider to verify the format and status. Don't share the full subscription URL or its credentials when reporting the issue.

Adding VMess, VLESS, or WireGuard manually: which parameters should you never guess?

The protocol must match the details for your existing server; don't switch protocols just to test. For VMess and VLESS, verify the address, port, UUID, transport, and TLS-related fields against the supplied details. For WireGuard, check the keys, addresses, and peer parameters. Match every other protocol to its own fields instead of reusing settings from a different one. Some fields have a specific meaning when left blank; don't treat an unknown value as a default. If authentication fails after saving, first check for copying errors and mismatched parameters, then check the network instead of changing several settings at once.

How do you update an existing subscription, and why might its entries change?

Find the relevant subscription group in Home and use its available update action, then check the result message. The exact location of the action depends on the current app interface. Updating reloads the original subscription content, so names, entry counts, and parameters may change to match it. Note which entry you're using before updating, then confirm it's still there afterward. If the update fails, don't delete a working group right away; check the address and network first. Updating a subscription, updating Config, and updating the App Store app do different things and are not interchangeable.

After importing multiple subscriptions, duplicate entries appear. How should you organize them safely?

First group entries by their original subscription source. Check whether the same URL was imported more than once or whether different subscriptions contain servers with the same name. Matching names don't mean the parameters are identical, so don't delete entries in bulk based on names alone. For a confirmed duplicate subscription group, keep the group used by the current connection, remove the extra group, and check the list again. Manually edited server parameters generated by a subscription may be overwritten on the next update. Keep long-term standalone configurations separate from subscription-managed entries. Hide addresses, credentials, and full subscription URLs in screenshots you share for troubleshooting.

Config / Diagnostics

Routing rules and troubleshooting

Change one setting at a time and retest the same destination. For an overview of what each option does, see Features and settings.

In Global Routing, how should you choose Config, Proxy, or Direct?

For everyday rule-based routing, use Config. The active configuration's rules determine where traffic goes. Proxy routes traffic through the selected proxy, while Direct connects directly. These modes describe different traffic-handling behaviors, not speed levels. You can temporarily switch modes for comparison while troubleshooting, but note the current server and configuration and avoid changing several variables at once. If Proxy works but Config doesn't, check the rules and policies first. Restore your preferred mode after testing, and verify traffic handling against your current settings.

It says connected, but webpages won't load. What order should you check things in?

Disconnect first and confirm the device's network can open a page you know is working. Reconnect and check the selected server. Then test the same destination against the current routing mode, rule matches, and DNS results to see whether only some domains fail. A result from Connectivity Test only confirms that the specific test received a response; it doesn't prove that every webpage is reachable. If switching networks resolves the issue, check the original network conditions. If only Config fails, inspect the rules and policies. Keep the destination the same, change one thing per test, and record error messages as you go.

Connectivity Test passes. Why could DNS still be the problem?

A server test and resolving a website's domain are separate processes, so a successful server test doesn't rule out DNS issues. Check which DNS-related settings are actually active in the current Config and Settings, then look for resolution errors, unexpected results, or incomplete requests for the failing domain. Don't keep adding unfamiliar DNS addresses or copy snippets that don't match your configuration. Record the original values, restore a clearly defined set of settings according to your configuration instructions, and test the same domain again. If resolution succeeds but the connection still fails, check the rules, server, and destination service.

Only certain websites are affected. How do you check rule order and FINAL?

Confirm that Global Routing is set to Config and that the expected configuration is active. Then check which rule actually matches the affected domain. Review the order of rules such as DOMAIN, DOMAIN-SUFFIX, and DOMAIN-KEYWORD; an earlier match may prevent later rules from being applied. FINAL is the fallback policy when no earlier rule matches. It can't change traffic already matched by an earlier rule. Save the original configuration before editing, change only the relevant entries, and test the same destination again. Also check that the policy referenced by the rule still points to an available server.

On Demand keeps reconnecting. How can you switch back to manual troubleshooting?

Note the current On Demand conditions, then temporarily disable automatic triggers. Return to Home and connect manually once to check that the server and basic configuration work. Next, check network conditions, rule matches, and behavior when switching networks, without confusing automatic triggers with server disconnections. If the manual connection is stable, re-enable only the On Demand conditions you need, one at a time, and check that they trigger as expected. Automatic connection conditions determine when a connection starts; routing rules determine how traffic is handled afterward. Check them separately.