Shadowrocket FAQ and Troubleshooting
First identify whether the issue concerns a purchase, import, or connection, then check it step by step. Change one setting at a time and keep the original configuration and error messages for retesting.
Select a question to expand the answer. New users can start with the setup guide. For details on store regions and restoring purchases, see the getting the app guide.
App verification and purchases
Check the App Store listing first, then review availability, device compatibility, and purchase history.
Can’t find Shadowrocket in the App Store? Start here
Check the spelling first, then open the App Store product page from this site to distinguish missing search results from an unavailable product page. On your device, go to Settings → Apple Account → Media & Purchases → View Account → Country/Region. App availability depends on your current store region, not your device’s display language. If you need to change regions, follow the official steps on that page and check your balance, subscriptions, and payment requirements. Don’t switch regions repeatedly just to change search results. If the product page says the app is incompatible, refer to the system requirements listed on the App Store page. If the store itself won’t open, check your internet connection and store account status first.
How can I verify that an App Store listing is the genuine Shadowrocket app?
Check three details: the app name is Shadowrocket, the developer is Shadow Launch Technology Limited, and the icon matches the official white icon with a blue-purple outlined rocket shown on this site. Then check that the product page URL contains app ID 932747118. Similar names or icons aren’t enough, and search ranking doesn’t verify authenticity. Find the developer details in the product page information section, or confirm the app ID by sharing the product page link. Before purchasing, check the price and compatibility; refer to the App Store page for the applicable terms. This site’s app page brings all three details together for easy verification.
Can I install Shadowrocket on iPad, and does the one-time purchase include connectivity service?
Shadowrocket is primarily used on iPhone and iPad. Open the same App Store product page on your iPad and check compatibility and purchase status before downloading. For system requirements, Universal Purchase, and supported devices, refer to the App Store page; an app installed on another device doesn’t guarantee compatibility with this one. A one-time client purchase is not a service plan: buying the app grants use of the client but does not provide a server to connect to. Get subscriptions and nodes from your service provider. After installation, import your existing details and check Global Routing and the connection settings.
Do I need to buy Shadowrocket again after changing or restoring my device?
Sign in to Media & Purchases on the App Store with the account used for the original purchase. Find Shadowrocket in your account’s purchased items or app list and check whether a redownload option is available; menu names may vary by system version. If you see a price instead, check your purchase history, current store region, and signed-in account before paying again. Refer to the App Store page for eligibility, Family Sharing, and compatibility. Redownloading the app does not restore its configuration. Before changing devices, save your existing subscription details and back up your configuration separately. After restoring, check your nodes, rules, and authorization status; an App Store purchase record is not a configuration backup.
Installation and first launch
System permission, app settings, and server availability are separate steps. Completing one doesn’t mean the connection is working.
How should I handle the VPN configuration permission prompt on first connection?
When you first enable a connection in Shadowrocket, the system may ask to add a VPN configuration. This permission is required to establish a connection. Make sure the prompt appears after an action you initiated in Shadowrocket, then follow the system instructions and authenticate your device if required. Granting permission only allows the system to create a connection configuration; it doesn’t mean your subscription, server, or rules are set up correctly. Return to Home, confirm that you’ve imported and selected an available node, then enable the connection. If device management or system restrictions prevent authorization, check your device’s management policy. Don’t repeatedly delete other configurations or change managed settings unless you understand their purpose.
The connection switch on Home won’t turn on or turns off right away. What should I check?
First, confirm that a selectable node appears on Home and that you’ve granted the system VPN configuration permission. Then check whether the switch won’t turn on or disconnects immediately after turning on. See whether another connection configuration is taking over automatically. For troubleshooting, temporarily disable known automatic connection conditions, including On Demand, to prevent them from triggering in turn. Next, check the selected node’s address, port, authentication, and transport fields, and note any error message. If your regular internet connection is unavailable, restore it first. Reopening the app can be a useful retest, but don’t make repeated reinstalls your first step; you could lose configurations that haven’t been backed up.
The interface is in English. How can I find the settings described in this guide?
This guide uses the original English interface labels, so you can look for names such as Home, Config, Settings, Global Routing, and Add Server. Check which screen you’re on, then follow the instructions for that screen. Configuration file names and provider-defined groups aren’t fixed menu labels. To change the display language, check whether the app has a language option in system settings, then review your device’s preferred language. Available options depend on the app and system. A language change isn’t a reason to modify server settings. If the interface differs, follow the feature names and current prompts rather than looking for an exact position in an old screenshot.
What should I check if battery use or heat increases while Shadowrocket is enabled?
Check activity for the relevant time period in your device’s battery settings. Distinguish sustained data transfer, background activity, and frequent reconnects; the app name alone doesn’t identify the cause. Compare performance before and after connecting under similar network and usage conditions. Check for repeated speed tests, heavy data transfer, or retries caused by an unstable connection. Pause unnecessary tests while troubleshooting, and check whether On Demand is triggering repeatedly. Don’t change several DNS, rule, and protocol settings at once to save battery; that makes the cause harder to identify. If the issue persists, record when it happens, the network type, and any errors, then retest by changing one variable at a time.
Subscriptions and node imports
These steps assume you already have a subscription or server details. Check the information you entered first, then review the network response and import results.
How can I tell whether a failed subscription import is caused by the link or the network?
Make sure you copied the complete subscription URL, not a provider’s website address, instructions, or a share link for a single node. Get the subscription link from your service provider. When pasting it, check for extra spaces or line breaks and make sure no query parameters are missing. If you see a connection timeout, check whether your current network can reach the subscription URL. If the content can’t be recognized, check the response and subscription format; a login or error page can’t be imported as a node list. Also confirm that the subscription hasn’t expired or been reset. Don’t post the full subscription URL in a public discussion: its credentials may let others access your subscription details.
Should I add a single node manually or import it from a link or QR code?
Choose an import method based on the information you have: use a supported import option for a complete node link, Scan QR Code for a QR code, or Add Server to enter parameters manually when you only have a parameter list. After importing, check the protocol, server address, port, and authentication fields. Matching names don’t guarantee matching settings. VMess, VLESS, Trojan, and Hysteria2 use different fields; follow your provider’s details for transport, TLS, server name, and other parameters. Don’t mix settings from different protocols or disable security options by guesswork if the import fails. Note the specific error, then check the fields.
How do I update an existing subscription, and what should I check afterward?
On Home, find the item for the existing subscription and use its update option. Wait for the result, then check whether the node list has changed; the exact option depends on the current interface. Before updating, confirm that the saved subscription URL is valid. If the update fails, note the error instead of repeatedly importing the same URL and creating duplicates. After an update, check the selected node again because your provider may have changed its name, settings, or availability. Updating a subscription and updating rules in Config are separate operations; success in one doesn’t mean the other has been updated. If the original URL no longer works, get a replacement from your service provider.
The import succeeded, but there are no nodes, or every node test fails. What should I do?
First determine whether the list is empty or has nodes that won’t connect. If it’s empty, check whether the imported content is actually a node subscription, whether it returned valid entries, and whether a filter or group is hiding them. Saving a subscription item doesn’t mean nodes were retrieved successfully. If nodes are listed, check the update result and service status, then run one Connectivity Test on a node and compare it with actual access. A failed test could be caused by the test target, network restrictions, or server status; don’t delete everything based on one result. Keep the original configuration and retest using a different internet connection and another existing node to narrow down the cause.
Routing and troubleshooting
Check the underlying network, node connection, DNS, and rule matching separately. A connection indicator or a single test result doesn’t replace verifying actual access.
Which Global Routing mode should I use: Config, Proxy, or Direct?
Config follows the rules in the current configuration to choose how traffic is handled. Proxy routes traffic through the proxy overall, but configuration exceptions and actual connection records still matter. Direct sends traffic directly. For everyday routing based on domains and addresses, choose Config and confirm that the active configuration contains the rules you need. Proxy can help you check whether rules are affecting access; Direct can show whether a destination is reachable over your current network without the proxy. Switching modes won’t fix incorrect authentication, an expired subscription, or an unreachable server. Change one setting at a time for testing, then restore the mode you want to use day to day.
It says connected, but websites and apps have no internet access. What should I check first?
A system connection indicator doesn’t guarantee that a destination is reachable. Disconnect first and confirm your regular internet connection can reach a destination that normally works. Reconnect, then check the selected node, Global Routing, and active Config. If nothing is reachable, check server availability, authentication, and DNS first. If only a few destinations fail, review their connection records for the domain, matched rule, and handling policy. You can temporarily compare Proxy and Config, but don’t change the node and configuration at the same time. If another existing node works, check the original node’s settings or service status. If the problem only occurs on one network, note the network conditions and troubleshoot from there.
Why does access still fail when I select Direct or add a DIRECT rule?
Direct in Global Routing sets the overall routing mode; DIRECT in a rule is the policy applied when that rule matches. They operate at different levels. A rule only takes effect when its configuration is active and the request matches it. First check that Global Routing is set to Config, then review the connection record for the rule and policy that actually matched. Rules are usually evaluated in order, so an earlier rule may handle the request first. Direct only means using your current network; it doesn’t guarantee the destination is reachable. If access still fails, check your local network, DNS resolution, and destination service instead of adding more identical DIRECT rules.
What troubleshooting information should I save if DNS or rules seem to be causing a problem?
Record when the issue occurred, the destination domain, network type, selected node, Global Routing mode, and active Config. Then review the connection records and diagnostic results provided by the app. Comparing resolved addresses, matched rules, and policies for successful and failed requests is more useful than replacing the entire configuration. Before changing DNS, save the original value. Change one setting at a time and retest the same destination; a successful Connectivity Test alone doesn’t confirm that DNS resolution and actual access are working. Before sharing records, remove subscription URLs, authentication details, and unnecessary personal browsing information. If server settings may be involved, share redacted error details with your service provider.