How to Use Shadowrocket: 10 Common Questions for New Users

1. I bought Shadowrocket. Why don't I have a server to use?

Buying Shadowrocket gives you a license to use the client, not a server service. Shadowrocket is a closed-source commercial app distributed through the App Store and sold as a one-time purchase. Buying the client does not include a server plan. The connection steps in this guide assume you already have a service provider and subscription, or server details you can use.

Before buying, check the App Store listing for the product name Shadowrocket, developer Shadow Launch Technology Limited, official icon, and app ID 932747118. Shadowrocket is primarily used on iPhone and iPad. Check the App Store listing for compatibility, system requirements, and purchase availability on other Apple devices.

• Home: View existing servers and subscription groups, choose a default server, and control the connection switch.
• Config: Manage configuration files and their rules. Adding a server does not automatically select a suitable rules configuration.
• Settings: Review app settings, including options such as On Demand that affect connection behavior.

2. What order should I follow when connecting for the first time?

First, make sure a valid server appears in Home, then select it as the default server. A server appearing in the list does not mean it is selected. Check which row has the DOT marker. Authorize the system VPN configuration before testing the connection. Repeatedly tapping the switch is not a substitute for checking the server details.

1. Add an existing subscription

   Go to Home → tap “+” in the upper-right corner → Type → Subscribe. Enter the URL for your existing subscription and save it. If you have details for a single server, choose the corresponding Type instead of entering the server address under Subscribe.

2. Select a server

   Return to Home and wait for the subscription contents to load. Select the server you want and check that its row has the DOT marker. Do not mistake a subscription group name for the server used for the connection.

3. Authorize the system configuration

   Turn on the connection switch at the top of Home. When the system asks to add a VPN configuration, confirm the app source, allow it, and complete any verification requested by your device. If authorization is incomplete, the switch turning off does not necessarily indicate a server problem.

4. Test access

   Run Home → Connectivity Test, then visit a site you want to access. Record the test result and the actual site behavior separately. The VPN icon alone does not confirm that every request succeeded.

3. The connection switch won't turn on, or turns off right away. What should I check first?

First, distinguish between “the system did not allow a VPN configuration” and “the connection was established and then dropped.” Both can look like the switch turning off, but they require different checks. Start with authorization and the default server, then check the remote server details. This avoids making changes to rules without a clear reason.

If you turn the connection off manually and it reconnects on its own, check Settings → On Demand first. It may trigger a connection when enabled conditions are met; this is different from a faulty switch. You can temporarily turn off On Demand while troubleshooting, then test a manual connection again.

4. Does the VPN icon in the status bar mean every website is accessible?

No. The VPN icon indicates that the system has a corresponding VPN connection state. It does not prove that the server can reach every destination or that the current request is going through a proxy. If Global Routing is set to Direct, or a rule in Config matches DIRECT, the request may still take a direct route.

For example, if Connectivity Test succeeds but a particular site fails, that only shows that the test destination and the actual destination behave differently. Check which rule matches the site, its domain resolution, and whether the server can reach it. Do not conclude that the entire client is unusable. The status bar may look different depending on the device layout, so also check the app and system VPN status.

5. How do I choose Config, Proxy, Direct, or Scene in Global Routing?

If you have a trusted rules configuration and understand how it works, choose Config for everyday use. To check whether rules are causing differences in access, temporarily switch to Proxy for comparison. Note the original setting first and restore it when you finish testing. The four options determine how requests are routed, not whether the VPN icon appears.

6. How do I update Subscribe, and why can't I connect after an update?

Updating a subscription refreshes the server list; it does not extend your service. Find the relevant Subscribe group in Home and use its update option. You can also pull down to refresh after adding it and check the result. Once the update finishes, review the list and DOT marker to make sure you are not still testing an entry that was removed or replaced.

• Fetch failed: Check that your current network can reach your subscription URL and that the URL is complete, especially any parameters at the end.
• Fetch succeeded, but the list is empty: Check that the server returned subscription content, not a sign-in page, error page, or expiration notice.
• The list looks correct, but the connection fails: Open the server details and check the protocol, address, port, and authentication information against your provider's current documentation.
• Worried about exposing credentials: A token in a subscription URL may grant access to service information. Do not share the full URL in public screenshots or support requests.

Subscribe and Config are separate items. Updating a server subscription does not necessarily update the rules in the current configuration file. If the servers have changed but the rules still refer to an old policy or name, check the server list and Config separately instead of repeatedly refreshing the subscription.

7. Why can I still not open a website when Connectivity Test shows a latency result?

A latency result applies only to the test method and destination used at that time; it is not a full test of your actual use case. Real-world access also depends on domain resolution, TLS, rule selection, and the route from the server to the destination. Compare results using the same network and server, and avoid changing multiple conditions at once.

1. In Home, confirm the default server, note the current Global Routing setting, then run Connectivity Test and record whether it succeeds or fails.
2. Visit the destination with the problem. Note whether all sites fail or just one domain, and record timeouts separately from certificate errors.
3. If the current setting is Config, temporarily switch to Proxy and visit the same destination. If behavior changes, check the rules in Config. If it still fails, continue checking the server and network.
4. Check the parameters for the selected protocol. Shadowsocks authentication and encryption settings, VMess or VLESS identity and transport settings, and Trojan authentication and TLS settings are not interchangeable. Fill in Hysteria2 and WireGuard details using the information from their respective servers as well.
5. In Settings → General → Date & Time, check that automatic time setting is enabled. A significant time difference can interfere with authentication or certificate validation.

Use the port specified in your own server details. For example, if the documentation says 443, check that the port is 443; do not change another port to 443 just because the name includes TLS. Switching between Wi-Fi and cellular can help compare network conditions, but do not also rewrite authentication details, or you will not know which change made a difference.

8. Are Config rules and On Demand the same thing?

No. Config primarily determines where requests go; On Demand determines when a connection is triggered by conditions. If a domain takes the wrong route, check Config and Global Routing. If the device reconnects automatically on a particular network, first review the existing conditions in Settings → On Demand.

DOMAIN-SUFFIX matches domain suffixes; IP-CIDR applies to IP ranges; GEOIP uses the geographic location associated with an IP address; FINAL handles requests that did not match earlier rules. Do not put a broad rule ahead of a more specific one and expect the later rule to take effect. Save the original configuration before making changes, then test with the same destination.

9. If I sign in to the same account on iPhone and iPad, will my settings sync automatically through iCloud?

Using the same App Store account does not, by itself, mean that your servers, subscriptions, and configuration files have synced. App Store purchases and iCloud data use separate systems: the former lets you check your app purchase eligibility, while the latter depends on the devices' iCloud accounts, app permissions, and any relevant options enabled in the app.

Syncing also does not grant additional permission for simultaneous server connections. Even if two devices have the same subscription, whether they can connect at the same time depends on the terms of your existing service. On the new device, check the default server, On Demand, and access to actual destinations again; do not rely only on matching list names.

10. When something goes wrong, what should I save, and what should I avoid resetting right away?

Preserve the current state before troubleshooting, then check one item at a time. Deleting the app or clearing configurations can remove useful settings and records, making it harder to identify the problem and restore your setup. The most useful record is not simply “can't connect,” but the step where the failure occurred and the result after changing one condition at a time.

• Connection stage: Record whether system authorization was completed, whether the Home switch stays on, and whether the DOT marker is on the expected server.
• Routing status: Record Global Routing and the current Config filename. Include only rules relevant to the destination; do not share a full configuration containing credentials.
• Test results: Record Connectivity Test, access to the destination, and comparisons between Wi-Fi and cellular separately.
• Server details: Check the protocol, port, transport, and TLS parameters locally. When sharing details, hide passwords, identity credentials, keys, and subscription tokens.
• Automatic behavior: Record whether Settings → On Demand is enabled and whether you changed any related conditions before the issue started.