Official Manual · Glossary

Shadowrocket
Interface, protocol & rule terminology

Look up terms by where they appear: interface labels explain screens and actions, protocol names describe connection methods, and rule keywords define matching conditions. A term can mean different things in different contexts. For example, Config names both a configuration-related screen and a Global Routing mode.

This glossary assumes you already have your own subscription or server details. Learn the terminology first, then follow the parameters you have. Protocol names, field labels, and rule keywords remain in English so you can compare them directly with the labels in Shadowrocket.

Interface & Controls

Screens, modes & connection checks

First identify the screen you are viewing. Then determine whether a setting changes the connection target, routing method, or app behavior.

Home: The main screen for viewing saved server entries, choosing a connection, and toggling the connection on or off. After adding an entry, confirm that the intended one is selected before connecting. A saved entry only means its details are stored; it does not mean the server is currently available. When connecting for the first time, review the system VPN configuration permission in the context of the action you initiated.

Global Routing: Sets the overall routing method for traffic handled by Shadowrocket. Common options are Config, Proxy, and Direct. This is separate from server selection: choosing a server does not determine how every request is handled. After changing the mode, test the same destination again to avoid changing multiple variables at once.

Config / Proxy / Direct: Config applies the rules in the active configuration. Proxy routes traffic handled by the app through a proxy policy. Direct connects directly. Use Config to retain rule-based routing, and make sure the intended configuration is active. Proxy and Direct can help with comparisons during troubleshooting, but one successful test does not guarantee the same result under all network conditions.

On Demand: Starts a connection when configured conditions are met, useful when connection behavior needs to adapt to network conditions. It does not repair a server or replace a valid configuration and system permission. Test a manual connection first, then check the trigger conditions one at a time. Include this setting when troubleshooting repeated connection attempts.

Add Server: The entry point for adding a server using existing details. You typically select a protocol and enter the address, port, and authentication parameters. Fields vary by protocol; do not reuse a set of fields for a different protocol. After saving, reopen the entry and check it, especially the transport method, TLS, and server name.

Connectivity Test: A diagnostic tool for checking reachability and response time. Available test options depend on what is shown in the current app. Results vary with the target, test method, and network at the time; they cannot be converted directly into download speeds. If a test succeeds but a request fails, check DNS, Global Routing, and the matching rule instead of simply running the test again.

Settings: The screen for viewing and changing app settings. Available options depend on what is shown in the current app. Note the original value before making changes. If an issue occurs, change one setting at a time and test the same request. Similar setting names do not necessarily mean similar behavior; understand connection triggers, DNS resolution, and data management separately.

Data: View upload, download, and other app traffic statistics. Interpret the figures using the reporting scope and period shown on the screen. Total traffic is not current speed and may differ from usage recorded by a service. Record any figures you need before resetting them. For details on statistics views and grouping, see the Data feature guide.

See how to use Global Routing →

Protocols

Protocol names and parameter requirements

A protocol defines how the app communicates with a server. Enter the details you already have; do not infer speed from a protocol name or guess the protocol from a port.

Shadowsocks: A proxy protocol with common settings for server address, port, encryption method, and password. The encryption method must match the server, and passwords are case-sensitive. If a connection fails after importing, check these basic fields first, then see whether additional transport parameters are required.

VMess: A proxy protocol that uses credentials such as a UUID for authentication. Transport settings are part of the configuration. A correct address, port, and UUID do not guarantee a connection; also check the transport method, path, and applicable TLS fields. Treat the UUID as sensitive authentication data and never expose its real value in public troubleshooting records.

VLESS: A proxy protocol that identifies users with credentials such as a UUID. Differences in its name do not simply indicate a difference in speed. Assess connection security using the actual transport and authentication settings, not the protocol name alone. After importing an entry, check its transport method and security parameters; do not copy VMess fields without checking.

Trojan: A proxy protocol commonly used with TLS. Check the server address, port, password, and server name. The connection address and the name used for TLS verification may differ; follow the details in the configuration you have. If certificate verification fails, first check the name, certificate, and device time. Do not treat skipping verification as a standard fix.

Hysteria2: A QUIC-based proxy protocol that depends on suitable UDP connectivity. Performance under high latency or packet loss also depends on bandwidth, congestion, and server configuration; the protocol name alone cannot guarantee results. Check the authentication, TLS, and applicable bandwidth parameters against the details you have. If UDP is unreachable, investigate the network conditions first.

WireGuard: A protocol that creates an encrypted tunnel using public and private keys. Configuration typically includes keys, an endpoint, interface addresses, and routing scope. A private key is sensitive and must not appear in public screenshots or shared troubleshooting records. A correct endpoint alone is not enough; also check the peer's public key and allowed address ranges.

HTTP / SOCKS5: Two distinct proxy protocols with different handshakes and authentication methods. Use the type specified in the server details you have; the same port does not make them interchangeable. Check encryption in transit and support for specific requests against the server's capabilities and the corresponding app settings.

Rule Keywords

Match conditions and handling policies

A rule typically consists of a match type, match value, and handling policy. Check what it matches first, then what happens when it matches.

Rules: A set of rules that determines how connections are handled in a configuration. Rules are generally checked in order, using the first applicable match. Put specific rules before broad ones to help prevent unintended overrides. Rules only take part in decisions when the relevant configuration is active, so check both Global Routing and the selected configuration while troubleshooting.

DOMAIN / DOMAIN-SUFFIX / DOMAIN-KEYWORD: DOMAIN matches an exact domain. DOMAIN-SUFFIX matches a domain suffix and its subdomains. DOMAIN-KEYWORD matches a keyword in a domain. The latter two can cover a broader range, so a single test request may not reveal their full impact. Enter the domain itself as the match value; do not include a URL path, query parameters, or protocol prefix.

GEOIP: Uses an IP geolocation database to determine an address's region and apply the corresponding policy. It matches address data, not a website's language, domain suffix, or visitor location. Database contents and DNS results can both affect matching. Check the actual connection address when troubleshooting rather than inferring the result from a page's language.

IP-CIDR / IP-CIDR6: Keywords for matching IPv4 and IPv6 address ranges. The prefix length after the slash specifies the range. A broad subnet can affect more destinations than a single address, so confirm the intended range before adding it. A domain may resolve to multiple addresses; if only some match, requests may behave differently.

FINAL: The final rule used when none of the preceding rules match, usually placed at the end of the rule list. It determines the handling of remaining traffic; it does not override rules that already matched. Check that FINAL has an available policy and behaves as intended, since requests that match no other condition fall through to it.

PROXY / DIRECT / REJECT: Rule actions: PROXY routes traffic through a proxy policy, DIRECT connects directly, and REJECT blocks it. PROXY in an example must refer to a policy or policy group available in the active configuration; do not assume every configuration supports it. These rule actions are at a different level from Proxy and Direct in Global Routing.

USER-AGENT: Matches User-Agent information visible in an HTTP request; it does not identify all traffic by the names of apps on a device. Relevant information is not automatically visible in encrypted requests, so applicability depends on the request and configuration. Check available request records to determine whether a match occurred; this is not a general per-app routing rule.

Rule example: match a domain first, then handle the remaining traffic

This example illustrates rule structure only; example.com is a sample domain. Before using it, confirm that PROXY is available in the configuration and note that FINAL,DIRECT sends unmatched requests directly.

DOMAIN-SUFFIX,example.com,PROXY
FINAL,DIRECT

See the Rules feature guide →

Subscriptions & Configuration

Entries, DNS & configuration data

Server entries contain connection parameters; configuration files define how traffic is handled. After importing, check the selected connection and configuration separately.

SERVER: An interface label for a server field or section. Use an address you already have. A server entry may also require a port, protocol, authentication, and transport parameters; an address alone is usually not enough to connect. The display name helps identify an entry, but changing it does not change the actual connection target or credentials.

Config: In a screen name, Config refers to configuration file management. In Global Routing, it means routing traffic according to the active configuration's rules. A configuration file may contain rules, policies, and other applicable settings; a server subscription is not automatically a configuration file. After importing, check which file is actually selected. Saved does not necessarily mean active.

DNS: DNS resolves domain names to IP addresses before a connection can be made. A resolution failure can prevent a website from opening even when the server connection itself is working. When changing DNS settings, consider both how DNS requests are routed and which rules apply, then test the same domain again on the same network.

URL Rewrite: Rewrites a request URL when specified conditions are met, typically changing the request destination or part of the request. This differs from Rules: rules determine which policy handles traffic, while rewriting changes the request itself. Only requests that meet the relevant conditions are affected. Confirm the matching scope before using a configuration you already have.

Latency: Response time under specific test conditions. Depending on the test method, it may include connection setup or the time for a specified target to respond. Low latency does not mean high sustained throughput or that every destination is reachable. For a useful comparison, keep the test method, target, and network consistent; repeated readings are more informative than a single result.

iCloud Sync: Syncs data supported by the app through its iCloud features. The exact scope depends on the current app settings. iCloud sync and App Store purchase records are separate systems; restoring the app does not mean configuration data will appear automatically. Before changing devices, check the sync setting, account, and actual sync results, and keep data containing authentication details secure.

App Store & Accounts

Verifying the listing, storefront & purchase history

Shadowrocket is a closed-source commercial app for Apple platforms, available exclusively on the App Store. iPhone and iPad are its primary devices. Check the App Store listing for system requirements and purchase eligibility.

Verifying the official App Store listing: On the product page, check the developer, Shadow Launch Technology Limited, the official icon, and app ID 932747118. The official icon shows a rocket outlined in blue and purple on a white background; find the app ID in the product page URL. Do not rely on the name in search results alone. Confirm all three details match the official listing, then check the price and compatibility.

Storefront: The App Store storefront associated with a purchasing account. It may affect app availability, displayed currency, and payment options. Device language or current location alone cannot confirm the storefront; check the account's country or region setting. Before changing regions, review requirements such as account balance, existing subscriptions, and payment methods. See the App Store region guide.

Purchased: Use this option to find an original App Store purchase and restore access to the app on an eligible device. When changing devices or reinstalling, first make sure you are using the original purchasing account, then look for Shadowrocket. Restoring a purchase restores eligibility to get the app; it does not restore server details, subscription URLs, or configuration files.

One-time purchase: A payment model for purchasing a license to use the app. The US storefront price is approximately $2.99; check the App Store listing for the current price. A one-time app purchase is not a service plan. After purchasing, you still need to import your own subscription or server details. App updates are available through the App Store; check the product page for eligible devices and Family Sharing conditions.

See App Store verification and purchase details →