At a glance

Installing Shadowrocket on Android involves three steps: downloading the APK, allowing the app that opens the file to install apps, and confirming the installation in Android. This guide is for first-time installs, downloads that fail in WeChat, and the “Install unknown apps blocked” message. After installation, check VPN permission and your existing configuration separately—a successful install does not mean the connection is ready to use.

1. Check the download source and permission target

On your Android device, open this site's Download page and choose the Android option. The Android installer is available from the site's Download page, with the file served from /dl/shadowrocket/. There is no need to search for a file with the same name elsewhere or save the webpage and try to install it.

“Allow installation of unknown apps” is Android's permission for an app to install files; it is not Shadowrocket's network permission. Android usually manages this permission per app: if you open the APK in a browser, check that browser's permission; if you open the download with a file manager, Android may require you to allow installs from that file manager separately. Allowing the browser does not automatically grant the same permission to the file manager.

Two ways to get Shadowrocket
iPhone and iPad: $2.99 one-time purchase on the App Store; Mac, Windows, Android, and Linux versions are free
.apk
Android app installation file covered in this guide
Two permissions
Check install-source permission and VPN permission separately

Shadowrocket is a closed-source commercial app. The App Store listing for iPhone and iPad names Shadow Launch Technology Limited as the developer; check the App Store page for system requirements. Mac versions are available for Apple silicon and Intel. This guide covers Android installation; for other devices, choose the corresponding platform on the Download page.

2. Download and install the APK

Open the Download page in your system browser and make sure your device has enough free storage. Menu names vary slightly between Android manufacturers. The steps below show common Android paths; if you can't find a matching option, search Android settings for “Install unknown apps.” Don't change unrelated developer settings.

  1. Open the Download page

    Use your system browser to open this site's Download page, find the Android section, and tap Download. If the browser asks whether to keep the APK, confirm that the page and download source are this site before proceeding.

  2. Wait for the download to finish

    Open the browser menu and go to Downloads. Wait until the file is marked complete, then tap it to open. Don't repeatedly tap the file while the download is still in progress, paused, or failed.

  3. Allow installs from this source

    If Android blocks the installation, tap the Settings option in the prompt. A common path is Settings → Apps → Special app access → Install unknown apps → your current browser → Allow from this source. Check that the app name shown on the permission screen matches the app you're using.

  4. Return and confirm the installation

    Return to the installer, check that the app name is Shadowrocket, and tap Install. If the installer closed, reopen the same completed APK from your browser's download history.

  5. Open the app and revoke permission

    When installation finishes, open the app and confirm that the main screen appears. You can then return to the same system permissions page and turn off Allow from this source for the browser. This won't uninstall Shadowrocket; you can allow installs again when you need to update it.

3. Downloads don't work in WeChat

WeChat's built-in browser may handle file downloads and opening Android's installer differently from your system browser. If tapping Download leaves you on the same page and no download appears, first open the page in a different browser instead of changing Shadowrocket settings or network rules. The app isn't installed yet, so Config and Global Routing aren't relevant to troubleshooting at this stage.

When checking permissions, use the source app name shown in the system prompt. If the browser downloaded the file but the file manager opens it, the file manager may be the app that needs permission. Don't keep changing the browser's permission just because the file came from a browser, and don't enable install permission for every app.

4. Troubleshoot installation errors

Note the exact system message, then determine whether the issue is with the download, source permission, or Android's installation process. The cases below are possible troubleshooting paths; not every device shows the same messages. Keep your existing configuration before retrying. If Shadowrocket is already installed, don't start by uninstalling it.

Why can't I install the APK after allowing my browser?

Check which source app the installation prompt names. If you opened the APK from Files, go to Settings → Apps → Special app access → Install unknown apps and find that file manager. If the switch is unavailable or marked as restricted by an administrator, contact your device administrator.

What should I do if Android says “There was a problem parsing the package”?

Delete the incomplete or failed download, get the file again from this site's Download page, and open it after the download finishes. If the same message appears, check whether your Android version meets the package requirements listed on the Download page. Repeatedly changing install-source permissions won't repair an incomplete file or resolve system incompatibility.

The update says “App not installed.” Should I uninstall first?

First check your available storage and the detailed reason shown by Android, and confirm that the APK came from this site's Download page. Apps signed differently can't be installed over one another. Don't uninstall the existing app until you understand the cause and have backed up your configuration. This message alone doesn't prove that the issue is a signing mismatch.

Where can I find the APK after downloading it?

First check the browser menu → Downloads, then look in the system file manager's Downloads folder. Don't guess the download location based only on the filename. If the download history shows a failure, download the file again instead of opening an older file with the same name.

When reporting an installation issue, include your device model, Android version, which app you used to open the file, and the exact system message. Before sharing screenshots that show configuration details, hide passwords, subscription URLs, and tokens. Don't expose your connection credentials when describing an installation problem.

5. First launch: install permission is not VPN permission

Reaching Shadowrocket's main screen confirms that installation and launch succeeded. To connect, you also need an existing configuration from your service provider and permission from Android to establish a VPN connection. This site does not provide, sell, or recommend nodes or subscriptions. Buying the app does not include a network service, and installing it does not create a usable service configuration.

  1. Check for an existing configuration on Home. If you haven't imported one, use details from your own service provider and enter the server, port, and authentication parameters for the relevant protocol. Don't enter only the server address and leave out the port or password.
  2. To use an existing subscription, add your own link through the import option for Subscribe. After updating, check that entries appear. A subscription import failure and an APK installation failure are issues at different stages.
  3. Select the entry you want to use, then turn on the connection switch. When Android first asks to establish a VPN connection, confirm that the requesting app is Shadowrocket, review the prompt, and decide whether to allow it.
  4. If another VPN connection is active on the device, check for a conflict and stop that connection before trying again. If you denied VPN permission, reinstalling the APK is usually unnecessary; trigger the connection request again.

Install-source permission controls which apps can start an installation; VPN permission lets an app create a system network tunnel. They are separate permissions. A VPN icon in the status bar only indicates that a tunnel is established; it doesn't prove that the remote server is reachable or that the rules are behaving as expected. Verify the result with a specific destination. If it fails, note the error and avoid changing multiple settings at once.

6. Use Global Routing to distinguish rule issues from connection issues

Only troubleshoot network settings after installation is complete and a configuration has been imported. If you can connect but pages won't load, start by checking Global Routing on Home. The options below describe how connections are handled within Shadowrocket; their scope is limited to traffic routed through Shadowrocket and doesn't mean every kind of traffic on the device is intercepted.

Config

Recommended

Handle connections according to the active Config rules; this doesn't guarantee that every destination uses a proxy. If your rules include DOMAIN-SUFFIX, IP-CIDR, or GEOIP, check their order and which policy matches. FINAL handles connections that didn't match an earlier rule; the policy specified after it determines where they go.

Best for: Everyday use with an existing split-routing configuration.

Proxy

Route connections handled by Shadowrocket through the proxy path to help determine whether the issue is related to split-routing rules in Config. If it still fails, check the selected entry and protocol parameters. This doesn't mean you need to reinstall the app.

Best for: Comparing the proxy path with the rule-based path using a known configuration.

Direct

Route connections handled by Shadowrocket directly. This does not test whether a remote proxy server is working. If you forget that Direct is selected and see only that the connection switch is on, you may assume the proxy is active when it isn't.

Best for: Checking whether the current network can reach destinations directly and isolating basic network issues.

Change one setting at a time and record the results before and after. For example, if the same destination works with Proxy but fails with Config, check the active configuration and matching rules first. If both fail, check your local network, selected entry, and parameters. Restore your intended settings after testing; don't leave temporary troubleshooting changes in place.