Start by checking the link prefix to tell an individual configuration from a subscription, then verify the credentials, server address, port, and transport parameters for the protocol. This guide is for users who already have configuration details from a provider and want to import them into Shadowrocket. You’ll learn whether to import a text string as an individual configuration or save it as a Subscribe entry, and how to spot common problems such as truncated links and missing parameters. All configuration examples below use placeholder values for syntax illustration only and cannot be used to connect.
Share Links vs. Subscription URLs: Identify What You’re Importing
In ss://, vmess://, vless://, and trojan://, the part before the colon is called the scheme. It identifies the link format and tells the importer how to interpret the text that follows. It does not indicate that a service is available, credentials are valid, or a connection is reliable. An individual share link usually contains the connection parameters for one server and creates one configuration when imported.
A subscription URL is usually an HTTPS address that returns a collection of configurations. After saving the URL, Shadowrocket can request it again to refresh the list. The collection may contain just one server, and its configurations do not have to use the same protocol. A single entry alone is not enough to tell whether something is a subscription.
| What to check | Individual share link | Subscription URL |
|---|---|---|
| Typical prefix | ss://、vmess://、vless://、trojan:// | https://; check the provider’s instructions to confirm |
| Where the configuration comes from | Parameters are included directly in the link | A collection of configurations is fetched over the network |
| What happens when details change | The original link does not update itself with new parameters | Refreshing retrieves the provider’s updated list |
| Sensitive information | Password, UUID, address, and connection parameters | May contain a token that grants access to the entire collection |
For example, https://example.com/sub?token=xxxx illustrates the format of a subscription URL. Regular webpages, account pages, and subscription URLs can all start with HTTPS. Pasting an arbitrary webpage into Subscribe will not create a server configuration. Use a subscription URL explicitly provided by a provider you already use. This site does not provide, sell, or recommend servers or subscriptions.
ss://: Tell User-Info Encoding from Full-Link Encoding
ss:// is used for Shadowsocks. A common SIP002 format puts the encoded encryption method and password before a plain-text server address and port. In the example below, decoding YWVzLTEyOC1nY206dGVzdA gives aes-128-gcm:test: the value before the colon is the method, and the value after it is the password.
ss://[email protected]:8388#Example%20SSss://: Select the Shadowsocks share-link format.YWVzLTEyOC1nY206dGVzdA: Base64URL-encoded user info, not a subscription token.server.example.invalid: Server address. This example domain cannot be used for a real connection.8388: Example server port. The actual value must match the provider’s configuration.#Example%20SS: Display name;%20represents a space.
You may also encounter older links where the entire string method:password@host:port is Base64-encoded. So a missing @ does not necessarily mean the link is invalid. Let the importer parse it first, then check the result. Don’t insert an @, colon, or slash just to make the link look familiar. Links with a plugin parameter may include additional encoded settings, so don’t discard everything after the question mark.
vmess://: Decode the JSON and Check What Each Field Means
A common VMess share-link format uses vmess:// followed by a Base64-encoded JSON object. The example below shows the decoded contents, not a complete share link you can import directly. Don’t append raw JSON to the scheme or treat this example as a real account configuration.
{
"v": "2",
"ps": "Example VMess",
"add": "server.example.invalid",
"port": "443",
"id": "11111111-1111-4111-8111-111111111111",
"aid": "0",
"scy": "auto",
"net": "ws",
"type": "none",
"host": "edge.example.invalid",
"path": "/example",
"tls": "tls",
"sni": "edge.example.invalid"
}add and port identify the connection endpoint, id is the identity, and net specifies the transport. This example uses WebSocket, so it includes host and path. If TLS is enabled, also check tls and sni. Here, v is a field in the share-link format, not the Shadowrocket app version.
- Import the complete
vmess://string, then check that the address, port, and UUID are present. - Check the transport type. If the server requires WebSocket, don’t change it to plain TCP to “simplify” the configuration.
- Check the WebSocket Host, path, and TLS Server Name separately. They serve different purposes and don’t have to match.
- If fields are missing after import, check the original parameters with your provider. Don’t guess by changing the port or disabling verification.
Share formats and parameter names can vary, and a link being recognized does not mean every extension field was mapped correctly. Check the transport, TLS, and identity parameters individually before saving. Line breaks in Base64 text, missing trailing characters, or punctuation altered by a messaging app can prevent the JSON from being decoded correctly.
vless:// and trojan://: Similar URLs, Different Credentials
VLESS and Trojan share links usually look more like regular URLs: user info comes before @, the server follows it, connection options come after a question mark, and a label follows a hash. The formats look similar, but their authentication fields are not interchangeable. VLESS typically uses a UUID, while Trojan uses a password.
vless://[email protected]:443?encryption=none&security=tls&type=ws&host=edge.example.invalid&path=%2Fexample&sni=edge.example.invalid#Example%20VLESS
trojan://[email protected]:443?security=tls&type=tcp&sni=edge.example.invalid#Example%20Trojan| Field | Meaning and what to check |
|---|---|
encryption=none | A VLESS protocol parameter; it does not mean that outer TLS is disabled. |
security=tls | Indicates that the example uses TLS. Also check the Server Name and certificate verification. |
type=ws / type=tcp | Specifies the transport type, which must match the server configuration. |
host and path | WebSocket Host and path. %2Fexample decodes to /example. |
sni | TLS Server Name. Don’t automatically replace it with the connection address just because that address is the target. |
Text after # | Usually a display name; it does not determine authentication or transport. |
If a password or label contains reserved characters such as @, #, or &, percent-encode them as required by their position. For example, a literal @ in user info can be written as %40. Don’t repeatedly encode or decode the entire link: characters that belong to the password could be mistaken for delimiters.
In short: Check the parameters; don’t infer the entire configuration from the scheme
Even if a link starts with vless:// or trojan://, check the transport type, TLS Server Name, and server port. Don’t change your configuration to port 443 just because the example uses it.
Importing into Shadowrocket: Handle Individual Configurations and Subscribe Separately
These steps follow the iPhone / iPad workflow. Copy the complete link from a provider you already use, making sure not to include instructions, quotation marks, or a trailing period. Import ss://, vmess://, vless://, and trojan:// as individual configurations. Save an HTTPS subscription URL as Subscribe instead of manually choosing a proxy protocol.
- Import an individual link: Copy the complete share link and open Shadowrocket. Confirm the clipboard import prompt if it appears. If the system asks for paste permission, allow access for this paste so the app can read the link.
- No prompt? Tap the
+in the top-right corner of Home to open Add Server, then use the URL import option on that screen. To enter the details manually, choose the matching protocol under Type and fill in each field using the original configuration. - Import a subscription: Go to Home →
+→ Type, select Subscribe, enter the subscription URL, and add a recognizable label. Save the entry, then refresh the subscription. - Check after saving: Return to Home and confirm that the individual configuration or subscription group appears. Open it and check the address, port, authentication details, and transport parameters. A display name alone does not confirm that the configuration is correct.
- Know what you’re updating: Refreshing Subscribe requests the remote list again. An individually saved configuration does not automatically receive a new password or server address when a subscription is updated.
A QR code is only a way to carry text; it doesn’t determine whether that text represents an individual link or a subscription. Check the decoded scheme before and after scanning. If the QR code contains an account webpage URL, it is not a server configuration. When the system first asks for permission to add a VPN configuration, make sure you’re working in Shadowrocket before approving it.
Can’t Connect After Importing? Use Global Routing to Separate Rule and Connection Issues
Seeing a configuration on Home only confirms that it was saved; it doesn’t prove that authentication, TLS, or access to the destination is working. Select the server you want to check and run Connectivity Test, then examine the results of an actual webpage request. A response in one test does not prove that every app, domain, or transport will work.
Global Routing → Config
RecommendedRouting follows the rules in the current Config. Traffic that doesn’t match a rule is handled by fallback rules such as FINAL; it doesn’t automatically bypass the proxy. Check the rules and selected server first, then return to this mode for everyday use.
Best for: Everyday configurations with verified rules and traffic routed by destination
Global Routing → Proxy
Routes traffic handled by the client through the proxy. Use this temporarily to check whether Config rules are causing the problem. If it still fails, check the credentials, server, transport, and TLS parameters.
Best for: Briefly checking whether rules are affecting traffic; restore the previous setting afterward
Global Routing → Direct
Routes traffic handled by the client directly. If a webpage opens in this mode, that does not prove the newly imported server can connect. Don’t treat a direct-connection result as a proxy test when checking a share link.
Best for: Comparing against the basic network connection, not testing server authentication
Change one setting at a time and note what happens before and after each test. For example, if a domain fails in Config but works in Proxy, check the rule that matches that domain. If it fails in both modes, investigate the connection parameters, basic network, and destination service separately. For TLS verification errors, check the Server Name, certificate validity, and system time. Don’t routinely disable verification as a workaround.
Common Issues: Truncated Links, Duplicate Imports, and Subscription Updates
I get a format error when I paste the link. Does that mean the protocol isn’t supported?
First check that the prefix is complete—for example, that vmess:// hasn’t been dropped—and make sure the end doesn’t include a Chinese full stop or a line break. Copy the entire link again from its original source instead of selecting only the visible line in a chat bubble. A format error should prompt you to check whether the text is complete; it doesn’t necessarily mean the protocol is unsupported.
My subscription updated. Why does the manually added configuration still have the old password?
A subscription group and an individual entry are separate items. First check which group you’re viewing on Home, then check the subscription update results. Update a manually added entry using the new parameters from your existing provider, or import a new individual link.
The server name and address are there. Why can’t it connect?
Open the entry for editing and check the port, password or UUID, transport type, TLS Server Name, WebSocket Host, and path in turn. The name is only a label. Even with the correct address, a mismatched path can cause the handshake to fail. After checking the parameters, run Connectivity Test and test actual access.
Can I post the complete link in a public forum for someone to check?
Don’t post a complete link, QR code, or subscription token publicly. When asking for help, include the scheme, transport type, redacted error details, and steps to reproduce the problem. If credentials have been exposed, reset or revoke them using the account management options provided by your existing provider, then update the local entry.
When tidying up configurations, keep entries that currently work, test newly imported ones, and only remove duplicates after confirming the new entries. Entries with the same name may differ, and the same server address can have different ports, accounts, or transport parameters. Compare the complete configurations to identify duplicates, not just their labels.