Home
Home is where you view server entries, the current selection and the connection toggle. Selecting an entry means it is ready to use; it does not mean a connection is active. Check the toggle and any system prompts as well.
Shadowrocket Glossary
Available for iPhone, iPad, Mac, Windows, Android and Linux. The iPhone / iPad version is available on the App Store for a one-time $2.99 purchase. The Mac (Apple silicon and Intel), Windows, Android and Linux versions are free. Check the App Store listing for iPhone / iPad system requirements.
Look up terms by interface entry, protocol, rule syntax or diagnostic step. Interface labels and configuration keywords remain in English. Menus may differ by platform; these explanations clarify concepts and are not universal, platform-specific instructions.
To get the app, visit the downloads for all platforms page. Installers for desktop and Android platforms are available from this site at /dl/. For system prompts the first time you open the app, see the installation guide.
Interface & Toggles
First, distinguish where you make a change, when a connection starts, and how traffic is routed. These refer to interface entry points, connection triggers and routing modes, respectively, and are not interchangeable.
Global Routing
Global Routing sets the overall routing mode: Config, Proxy or Direct. If rules do not seem to take effect, first check that Config is selected, then review the current configuration file instead of immediately changing domain rules.
Config
In Global Routing, Config means connections are handled according to the current configuration file, including matching rules to their policies. Config is also the page used to manage configuration files. Use its location in the interface to tell which meaning applies.
Proxy / Direct
Proxy and Direct mean proxy mode and direct mode, respectively, and can help determine whether an issue is related to rule configuration. These are Global Routing mode names; PROXY and DIRECT in configuration text are rule actions. Preserve their capitalization and use them in the appropriate context.
On Demand
On Demand starts connections when preset device or network conditions are met; it controls when a connection starts. Rule routing determines which policy applies once traffic enters the connection. Enabling On Demand does not configure routing rules.
Add Server
Add Server lets you enter your existing server details manually. Choose the protocol that matches the source information, then enter the address, port and authentication fields. Similar fields do not make protocols interchangeable, and saving an entry does not guarantee that the remote server is reachable.
Protocols
A protocol describes how the client communicates with a remote server. Use the details you already have; the protocol name alone does not indicate speed, battery use or stability. These also depend on the network path, server load and settings.
Shadowsocks
Shadowsocks is a proxy protocol. Common details include the server address, port, encryption method and password. The encryption method must match the remote server, so check more than just the password. If your source details include a plugin or other extensions, verify each one as well.
VMess
VMess uses identity information such as a UUID for authentication and supports different transport methods. After importing, check the transport type, path, Host and TLS settings. A correct UUID alone does not confirm that the entire configuration is complete.
VLESS
VLESS uses a streamlined authentication design and does not encrypt payloads by itself, so it needs suitable secure transport. It is not the same protocol as VMess; changing only the protocol name while keeping the UUID does not convert a configuration.
Trojan
Trojan is commonly used with TLS and password authentication. Check the authentication details and certificate-related names separately. The connection address and TLS verification name serve different purposes. If you get a certificate error, check the name, device time and remote certificate rather than disabling verification.
HTTP / SOCKS5
HTTP and SOCKS5 are common general-purpose proxy interfaces, with different authentication fields and traffic-handling capabilities. The protocol name alone does not mean the connection is encrypted. HTTPS between an app and a website is separate from encryption between the client and proxy server.
WireGuard
WireGuard creates a tunnel using keys and Peer configuration. Common parameters include Endpoint, addresses and Allowed IPs. Endpoint specifies the remote entry point; Allowed IPs describe the address ranges associated with a Peer. These details are not ordinary username and password fields.
Hysteria2
Hysteria2 is based on QUIC and requires a reachable UDP path, along with matching authentication and TLS settings. Normal web access does not prove that UDP is available on the path. If your details include bandwidth or obfuscation parameters, follow those settings rather than entering arbitrary higher values.
For more on parameter fields and design trade-offs, see the protocol guide.
Rule Keywords
Rules combine matching conditions with handling policies and are usually checked in the order listed in the configuration. First identify whether a rule matches a domain or an IP address, then check its final policy. A keyword is not itself a proxy toggle.
DOMAIN
DOMAIN matches an exact domain, for example DOMAIN,example.com,PROXY. This rule does not automatically include www.example.com. To cover a domain and its subdomains, check the matching scope of DOMAIN-SUFFIX.
DOMAIN-SUFFIX
DOMAIN-SUFFIX matches a specified domain and its subdomains, for example DOMAIN-SUFFIX,example.com,PROXY. Enter a domain, not a full web address; do not include the protocol prefix, page path or query parameters in the domain field.
DOMAIN-KEYWORD
DOMAIN-KEYWORD matches when a domain contains a specified string, for example DOMAIN-KEYWORD,ads,REJECT. It does not understand a website's purpose, and short strings may match unintended domains. For more precise boundaries, check exact-domain or suffix conditions first.
IP-CIDR / IP-CIDR6
IP-CIDR matches IPv4 ranges, while IP-CIDR6 matches IPv6 ranges, for example IP-CIDR,192.168.0.0/16,DIRECT. The number after the slash is the prefix length. These rules match IP addresses, not domain names; resolution results and IPv6 connectivity may also affect which rule matches.
GEOIP
GEOIP matches categories in an IP geolocation database. It does not use webpage language, domain suffixes or website ownership. Address classifications can change as databases and network allocations change. If a site behaves unexpectedly, check the actual destination IP and rule match records.
FINAL
FINAL handles connections that did not match any preceding rule and is usually placed at the end of the rule list. FINAL,DIRECT sends remaining connections directly; it does not override earlier matching PROXY or REJECT rules.
PROXY / DIRECT / REJECT
PROXY routes traffic through the relevant proxy policy, DIRECT connects directly, and REJECT blocks the connection. A policy name is not the same as a specific server entry. If the configuration uses a custom policy group, check which entries it references and which one is currently selected.
Subscriptions & Configurations
Server details determine where to connect; a configuration file determines how connections are handled; a subscription retrieves or updates existing entries in bulk. Before importing, identify what kind of information you have.
Subscribe
Subscribe is used to import and update your existing subscription details, allowing you to maintain multiple server entries at once. Subscription links may contain access credentials; do not include them in public screenshots or shared records. A successful update does not necessarily update rule configuration, so check the imported content separately.
Server
A Server is a connection entry containing protocol, address, port and authentication fields. Its display name is only a label and does not prove location or performance. When troubleshooting, check the actual parameters and distinguish between an entry being saved, selected and connected.
Configuration Files
A configuration file organizes settings such as rules, DNS and policies, unlike an individual Server entry. After importing, make sure it is selected as the current configuration and that Global Routing is set to Config. Keep a copy of the original file before making changes so you can compare or restore it.
Scan QR Code
Scan QR Code reads connection or subscription details from a QR code, which is simply a way to present data. After scanning, check the content type, protocol and required fields. Treat QR codes containing passwords or subscription credentials as sensitive information.
Purchased
On iPhone and iPad, Purchased is where you can find and redownload apps using the Apple Account originally used for the purchase. It does not restore server entries or configuration data within the app. The iPhone / iPad version costs a one-time $2.99 on the App Store for use on both devices; the Mac, Windows, Android and Linux versions are free.
When you're ready to import your details, follow the quick start guide. For help getting the app again, see moving to a new device and reinstalling.
Connections & Diagnostics
Troubleshooting should distinguish DNS resolution, remote reachability, authentication and actual app access. A successful test only confirms that its specific conditions were met; it does not verify everything.
DNS
DNS resolves domain names to IP addresses and is an important step before accessing a website. Successful resolution does not mean the connection policy is correct: a domain may resolve but still fail at the connection, authentication or rule stage. Record the original DNS settings before changing them, and avoid changing several things at once so you can identify the cause.
Connectivity Test
Connectivity Test checks server response or reachability using the current test method. Results depend on the test target and network path. Success does not prove that all websites, UDP or sustained transfers will work. Compare results using the same network and test method, then verify the apps you actually need.
Latency
Latency usually means round-trip time under specific test conditions. It is not download bandwidth and cannot measure stability on its own. Results vary with the test method, device network and remote server load. Compare under the same conditions and consider packet loss, connection failures and actual access as well.
TLS / SNI
TLS protects data in transit and verifies the remote identity; SNI tells the server which name is being requested during the handshake. The server address, SNI and other Host fields may differ, so check each against your existing details. If a certificate error appears, first check the name, device time and certificate status.
UDP
UDP sends data as datagrams without a TCP-style connection handshake and is used by some real-time apps and protocols. Availability depends on support from the client settings, protocol, server and intermediate networks. Normal web access does not prove that UDP traffic is working.
Choose the next step based on the issue
- Not sure how Global Routing relates to rule policies? Compare Global Routing with PROXY / DIRECT / REJECT.
- Have server details but aren't sure what the fields mean? Open the protocol guide and check the protocol type shown in your details.
- Imported successfully but can't connect? First check the current selection and connection status, then test DNS, authentication and rule matches separately. See feature guides for the relevant settings.
Before sharing diagnostic information, hide passwords, keys, subscription credentials and personally identifying data. Error types, steps to reproduce and relevant setting names are usually more useful.