A single-server share link usually contains connection details, while a subscription URL typically points to content fetched online. This guide is for users who already have configuration details from their provider: identify the input by its prefix, check the address, authentication, transport and TLS settings, then choose the matching import option in Shadowrocket. Examples are for format reference only and cannot be used to connect.
1. Tell single-server links, subscription URLs and configuration files apart
ss://, vmess://, vless:// and trojan:// are share-link schemes—the type markers before the colon. They tell the client how to interpret the following text; they are not web addresses and do not define every transport detail. When importing a link, Shadowrocket parses it into editable connection fields.
Subscription URLs usually start with https://, for example https://example.com/sub?token=xxxx. The URL itself is generally an address for fetching content, not a set of server parameters. The server may return multiple share links or content encoded as a whole in Base64. The URL suffix alone does not tell you what format the response uses.
| Input type | What it contains | How it’s updated |
|---|---|---|
| Single-server share link | One set of address, authentication and connection parameters | Import a new link or edit the relevant fields manually |
| Subscription URL | A URL for retrieving a list maintained by the service | Request the original URL again to refresh the list |
| Configuration file | May include General, Rule, DNS and policy settings | Reload a local file or update a remote configuration |
An HTTPS URL may point to a webpage or remote configuration rather than a subscription. First check the provider’s description of the URL. Updating a node subscription does not create traffic-routing rules for you, and importing a remote configuration is not the same as adding a single connection.
How to decide: identify what the content is for, then choose the right import option
For an HTTPS URL, first check whether it returns a server list or a full configuration. For one of the four share-link schemes, treat it as a single-server link. A URL opening in a browser does not necessarily mean it can be used as a subscription.
2. ss://: Shadowsocks authentication and server address
A common SIP002-style link separates the authentication data from the server location. The authentication section is usually a Base64 or URL-safe Base64 encoding of method:password, followed by @host:port. In the example below, decoding the encoded section gives aes-128-gcm:test; the password is for demonstration only.
ss://[email protected]:8388#Demoaes-128-gcm: the encryption method, which must match the server settings. It is not a server name.test: a sample password. Special characters in a real password must be encoded correctly in the share link.example.comand8388: the server address and port. 8388 is an example, not a requirement.#Demo: a remark, typically shown in the server list. It is not used for authentication.
You may also encounter older share links that encode method:password@host:port as a whole. The @ may or may not be visible, but that alone does not make either format invalid. Some links also include a plugin query parameter; it is meaningful only when the corresponding extension is supported and configured correctly.
3. vmess://: Decode the JSON, then check the field types
A common VMess share link consists of vmess:// followed by a Base64-encoded JSON object. The address, port, UUID, transport and TLS details are all in that object, so you can’t parse it by looking for an @ separator as you would in a regular URL. The structure below is decoded for reference; it is not a complete share link to paste into the app.
{
"v": "2",
"ps": "Demo",
"add": "example.com",
"port": "443",
"id": "00000000-0000-4000-8000-000000000000",
"aid": "0",
"scy": "auto",
"net": "ws",
"type": "none",
"host": "example.com",
"path": "/demo",
"tls": "tls",
"sni": "example.com"
}add,portandidspecify the server address, port and UUID, respectively;psis a remark.- When
netisws,pathandhostusually correspond to the WebSocket path and HTTP Host. They must match the server configuration. tlsandsnidescribe the TLS settings. Using port 443 does not, by itself, mean TLS is enabled.vis a format field in the share-link JSON, not the Shadowrocket app version.aidshould not be treated as a performance tuning option.
Different generators may omit optional fields or store the port as a string. If decoding does not produce valid JSON, first check that you copied the entire link, especially that a messaging app did not truncate the end. Don’t enter the full JSON as the server address.
4. vless:// and trojan://: Similar URL formats, different authentication
These share links often use a URL structure with authentication details, an address, query parameters and a remark. They look similar, but the content before @ is not interchangeable: VLESS usually uses a UUID, while Trojan usually uses a password. The addresses, credentials and paths below are examples.
vless://[email protected]:443?encryption=none&security=tls&type=ws&host=example.com&path=%2Fdemo&sni=example.com#Demo
trojan://[email protected]:443?security=tls&type=tcp&sni=example.com#Demo| Field | VLESS example | Trojan example |
|---|---|---|
Content before @ | UUID for user authentication | Password for user authentication |
security=tls | Specifies the TLS security layer | Describes the TLS settings used in this example |
type | Example uses ws | Example uses tcp |
sni | Server name used for the TLS handshake | Server name used for the TLS handshake |
host / path | Used for WebSocket in this example | Not needed for this TCP example |
In VLESS, encryption=none refers to this protocol-level setting; it does not automatically disable TLS in the URL. Check the security parameters and the imported settings to confirm whether TLS is enabled. Trojan commonly uses TLS. When troubleshooting, check the Password, SNI and certificate domain together; an open port alone is not enough.
Query parameters use percent encoding; for example, %2Fdemo decodes to /demo. If a password contains @, # or ?, the link generator must encode it according to its position, or the parser may end the authentication section too early. IPv6 addresses in the URL host field usually need square brackets, for example [2001:db8::1]:443.
- Address is the actual connection destination and may differ from SNI.
- HTTP Host is application-layer request information; it is not the same as TLS SNI.
- Parameter names and extension formats can vary between share-link specifications. Recognizing the prefix does not guarantee that every extension field was preserved.
5. Import and update each type in Shadowrocket
The steps below assume you already have parameters or a subscription from your provider. Shadowrocket is a closed-source commercial app available as a one-time purchase on the App Store; buying the app does not include a service plan. This site does not provide, sell or recommend servers or subscriptions.
Single-server share link
- Copy the entire link without any explanatory text, quotation marks or code fences. A QR code is just another way to carry the string, so identify what it contains first.
- Open Home and use the available clipboard import prompt or QR-code scanner. If no prompt appears, tap
+in the top-right corner to open Add Server, choose the correct Type and enter the parameters you already have. - Before saving, check Address, Port, authentication, TLS, SNI and transport settings. A remark from a single-server link should not be entered as the Password or Address.
- Return to Home to confirm that the new entry appears, then select it to test the connection. A successful save only means the client accepted the fields; it does not confirm that server authentication succeeded.
Subscription URLs and remote configurations
- To add a server subscription, go to Home →
+→ Add Server, set Type to Subscribe, then enter the full URL and save. Available options may vary with the app’s current interface. - After importing, check that the expected entries appear in the relevant subscription group. To retrieve an updated list, refresh the original group rather than creating another subscription with the same URL.
- For a remote configuration URL that includes rules, go to Config and add and load it according to its purpose. Don’t enter a full configuration URL as a single-server Address.
A subscription fetches the list from the server again, so edits to entries in the subscription may be replaced during an update. To keep changes, note the fields you need and decide whether to create a separate entry; don’t assume local edits sync back to the server. Treat the token in a subscription URL as a credential.
6. Troubleshoot import issues by parsing, connection and routing
Troubleshoot in stages: first check whether the link was parsed into an entry, then whether a connection can be established, and finally which policy handles the request. This helps avoid mistaking a Base64 character issue for a network failure or repeatedly changing a password when the routing rule isn’t selecting a proxy.
I copied a vmess:// link. Why wasn’t a new entry added?
Check that the prefix and end of the link are intact, and remove any line breaks or punctuation copied along with it. If you need to inspect the contents, check locally in a trusted environment that the Base64 decodes to complete JSON, especially the add, port and id fields. Don’t submit a real link to a public decoding site.
I imported a vless:// link, but Path looks wrong. What should I do?
Open the new entry’s edit screen. Check that the transport is ws, then verify Path and Host. In the parsed fields, %2F should become a slash. If a field is still missing or incorrect, update it using the provider’s parameters and check that TLS and SNI are present.
Why did the name and parameters I changed revert after a subscription update?
A subscription update reloads the list from the server, so local edits may not be retained. First confirm you updated the original subscription group, then compare the entries with the server’s current parameters. Save any local changes you need to keep as a separate entry instead of editing an entry that will be refreshed.
Why isn’t traffic going through the selected server?
Check Global Routing on Home. Direct does not forward traffic through the selected proxy; Config follows the active configuration rules; Proxy routes traffic through the proxy; and Scene applies the settings for the selected scene. Confirm the current mode, then check that the connection is enabled and the relevant rules apply.
When Global Routing is set to Config, rule order also affects the result. For example, DOMAIN-SUFFIX,example.com,DIRECT sends matching domains through DIRECT; FINAL,PROXY handles only requests that didn’t match an earlier rule. Importing a new share link does not automatically replace existing DOMAIN-SUFFIX, GEOIP or IP-CIDR rules.
- No entry appears: Check that the string is complete, and verify its scheme, encoding and import type.
- An entry appears, but it won’t connect: Check Address, Port, Password or UUID, transport, TLS and SNI, and confirm that the service is active.
- It connects, but routing isn’t as expected: Check Global Routing and the rules currently enabled in Config. Don’t start by changing authentication details.
- Reporting an issue: Note the symptoms and field names, but redact passwords, UUIDs and subscription tokens. Share only the details needed to diagnose the problem.