A rule-based proxy client for iPhone / iPad, with rule-based routing and a one-time purchase on the App Store. You’ll need your own subscription or server details to get started.
Shadowrocket is available exclusively on the App Store. Check device compatibility and store details, then purchase the app or restore a previous purchase. After installation, prepare your own connection configuration.
Use Home to select a server, configure Global Routing, and check the connection. The first time you connect, iOS may ask to add a VPN configuration. Confirm that Shadowrocket initiated the request, then follow the on-screen prompts. Check the App Store page for system requirements.
Learn moreShadowrocket works on iPhone and iPad. After purchasing with the same Apple ID, you can restore it on eligible devices. A larger screen can make it easier to review rule order in Config. App purchase records and connection settings are managed separately, so check that your existing configuration is complete after restoring the app.
Learn moreShadowrocket is also available on Mac and Apple TV through the same App Store. Check the store page for compatibility details.
Available on the App StoreGet ShadowrocketThe App Store handles the app purchase, installation, and updates. Server addresses, authentication details, and subscription content come from services you already use. An empty SERVER group after installation does not mean the purchase failed; it means no connection details have been added yet. If you have a subscription, import it with Subscribe. To add a single server, enter its details under Add Server. Either way, check that the information is complete before testing the connection.
If the product page isn’t available, first check the account and storefront currently used by the App Store, then review device compatibility, network access, and purchase status. The storefront path in a product link does not determine the account’s actual storefront, nor does it guarantee that the app will be visible in every region. See the App Store guide for the right order of checks. Don’t choose an app based on its name in search results alone.
Understand how modes, rules, and servers work together before changing connection behavior. The snippets below illustrate syntax and fields; they do not contain connection details you can use as-is.
Open Global Routing from Home to choose Config, Proxy, or Direct. Config follows the rules in the active configuration. Proxy sends typical traffic through the selected proxy policy, while Direct is useful for checking a direct connection. Changing modes does not add server details or replace valid connection information. Before connecting for the first time, confirm the server you want to use and choose the appropriate mode. To route traffic differently by website, use Config and check the policy at the end of the rules.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTOn Demand connects the VPN when your chosen conditions are met. Its options are in Settings. It controls when a connection is made, not which rule a domain matches; that is determined by Global Routing and Config. Before enabling it, establish a working connection manually and confirm the server and authentication details. Then review each trigger condition. If automatic reconnection causes issues, check the On Demand status first, then review the system’s VPN settings so you don’t mistake an automatic trigger for a failed manual switch.
[Rule]
# Set connection triggers in Settings
# These rules only determine traffic handling after connection
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXYEach routing rule pairs a matching condition with an action. Common keywords include DOMAIN-SUFFIX, DOMAIN-KEYWORD, IP-CIDR, and FINAL. In Config mode, rules are generally evaluated in order, so put specific domains or address ranges first and leave FINAL as the last fallback. Back up your current configuration before editing, then change one rule at a time and check the result. DOMAIN-SUFFIX matches a domain suffix, not a URL path. IP-CIDR specifies an address range and cannot be replaced with a domain.
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,DIRECTShadowrocket supports protocols including Shadowsocks, VMess, VLESS, Trojan, WireGuard, and Hysteria2. In Add Server, select the Type that matches your existing connection details, then enter the address, port, and authentication fields for that protocol. Parameters are not interchangeable between protocols. TLS settings, transport methods, and server requirements must also match. A protocol name alone says nothing about connection quality. Test the connection after entering the details, and use the specific error to identify which fields to check instead of switching types at random. Configure HTTP and SOCKS5 according to your service details as well.
[Rule]
# Enter Type and authentication details in Add Server
# PROXY in a rule refers to a configured proxy policy
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTIf you have your own subscription link, select Subscribe under Add Server, enter the address, and save it. Then update the subscription to retrieve its server entries. Subscription import differs from adding a single server: the link manages a set of details, and later updates may change entry names and parameters. If an update fails, check that the address is complete and the subscription is valid, then confirm that your current network can reach it and review the response. Subscription links may contain personal authentication details. Hide them before sharing screenshots or troubleshooting records.
[Rule]
# Subscribe manages server details; Config manages routing rules
# Check them separately
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTConfig manages configuration files, which can contain sections such as General, Rule, and Hosts. After selecting a configuration, set Global Routing to Config to apply its rules to traffic. When editing, preserve section headers and check keywords, commas, and policy names. Saving a file and activating it are separate actions, so verify both. Remote configuration updates may overwrite local edits; keep a copy before making changes. To organize details across devices, you can review the iCloud sync options, but keep an independent copy of important configurations.
[General]
dns-server = system
[Rule]
DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECTA VPN connected status means a local connection has been established; it doesn’t guarantee that every website will load. Connectivity Test checks the response from selected items, while Data can help you observe traffic changes. Interpret both in the context of the current mode, matched rules, and actual browsing results. If a test responds but a webpage won’t load, check DNS, server authentication, and the destination site. Don’t judge the entire connection path by a single test result.
For routine changes, follow this order: record the current settings, change one thing, then verify the result. Note the server, Global Routing mode, and active Config, then repeat the same access test after each change. This helps distinguish changes caused by a subscription update, rule order, or invalid connection details. If a term is unfamiliar, check the quick reference before editing, so you don’t confuse interface options with rule keywords.
Follow this sequence for your first connection: details, mode, verification. These steps assume you already have your own subscription or server information.
From Home, open Add Server. If you have a subscription, choose Subscribe and enter the complete URL. If you have details for a single server, choose the matching Type and enter each field. Before using Scan QR Code, confirm that the code contains your own connection details and grant camera access if needed. After saving, return to the SERVER group, make sure the entry appears with a recognizable name, and select the one you want to connect to.
If the list is still empty after import, first check whether the update succeeded, then make sure the URL is complete and still valid. Don’t troubleshoot by repeatedly creating new entries, and don’t enter a subscription URL as a server Host. Hide passwords, authentication fields, and personal subscription details before sharing screenshots.
For rule-based routing, choose Config and confirm the active file in Config. To test the proxy connection alone, you can temporarily use Proxy after considering its scope. Direct is useful for checking direct access. Your server details must remain valid after switching modes; changing the mode alone won’t establish a working proxy connection if no usable server is selected.
Starting with an existing configuration is easier to troubleshoot than changing several settings at once. First check that it has a suitable FINAL fallback, then confirm that the domains you want to proxy match the right policy. example.com in a rule snippet is only a demonstration domain. Replace it according to your needs; don’t treat the example as a complete personal configuration.
Return to Home, turn on the connection, and approve the VPN configuration when prompted by the system. Once connected, run Connectivity Test, then visit one destination expected to connect directly and another expected to use the proxy. Check each result separately. A VPN indicator alone doesn’t confirm that routing is working correctly; also check the selected mode and configuration rules.
If the connection fails, check these in order: whether a server is selected, whether the subscription has been updated, whether authentication details match, whether the current network is available, and whether DNS meets the configuration requirements. Change one thing at a time. If On Demand is enabled, note its trigger conditions so automatic connections don’t interfere with manual checks.
The full guide walks through importing details, choosing a mode, system authorization, and troubleshooting, step by step.
Shadowrocket is closed-source commercial software. Verify the app using its App Store product page, and check purchase records, app configuration, and connection services separately.
On the App Store product page, confirm the name is Shadowrocket and the developer is Shadow Launch Technology Limited. Compare the app icon with the official icon in this site’s header, then check that the product link ends with id932747118. Verify all three details together; don’t rely on the nickname “Little Rocket” or a similar name in search results. Once verified, review the price, compatibility, and purchase button.
The app ID identifies the specific product; the storefront region affects page visibility and displayed prices. These are separate things. If you can’t find the app in search, open the fixed product link from this site’s purchase guide and check the App Store’s message. Read the information on the product page, device, and account separately. Whether a webpage opens does not determine purchase eligibility.
Shadowrocket is a one-time purchase. The US storefront reference price is $2.99; other storefronts show local pricing. The amount shown on the purchase confirmation screen is the actual price. Shadowrocket works on iPhone and iPad, and purchases made with the same Apple ID can be restored on eligible devices. For compatibility, system requirements, and purchase availability on other devices, check the App Store page.
Before purchasing, check which account is currently used for the App Store, especially if you’ve switched store accounts on the device. Don’t confuse the device’s signed-in account with the account that owns the app purchase. For details about storefront regions, purchase history, and Family Sharing, see the complete App Store guide and check what your own page shows. Don’t infer your purchase status from someone else’s screenshot.
When switching devices or reinstalling, sign in to the App Store with the account used for the original purchase and look for Shadowrocket in your purchased items. If the page still shows a price, check the account and purchase history before paying again. Family Sharing availability depends on what the App Store page and family settings show. Manage family members’ purchases separately from your personal configuration.
Restoring the app does not guarantee that all server details have been restored. After opening it, check the SERVER group, selected server, Subscribe update status, and Config files. If you use iCloud sync, also check the device’s sync status and the app’s options. Keep your own copy of important configurations. When re-entering details, verify authentication information; don’t rely on outdated test results.
App updates are managed through the App Store. You can enable automatic updates in your device settings or check the store’s update history. Interface locations and available options may change as the app is updated; follow the labels shown in your current version. If the connection behaves differently after an update, note the active mode, configuration, and server, then review the related settings instead of changing everything at once.
This page provides an overview of how to get the app and how its features fit together. For purchase and availability questions, see how to verify the app. If installation is complete but the connection fails, follow the import, mode, and network checks in the FAQ. First identify whether the issue is with the store, configuration, or connection to find the right steps.
Start with first-connection issues, then learn how protocol fields and transport methods work. These articles cover client settings and using your existing connection details, not where to get a service.
Answers common first-time setup questions about VPN configuration approval, choosing a mode, updating subscriptions, scanning a QR code, and testing latency. Also explains where to start when webpages won’t load after connecting.
Read the guide →Starting with the WireGuard Type in Add Server, this guide explains the roles of keys, interface addresses, allowed IP ranges, and MTU. Learn how to check each field against your existing configuration and avoid entering values in similarly named fields.
Read the guide →Learn how QUIC relates to UDP, what affects performance on unstable networks, and how fields such as password, sni, and obfs correspond to your server details. A protocol name alone doesn’t guarantee a particular connection experience.
Read the guide →