In Shadowrocket, enter Trojan parameters exactly as provided by your service provider: Address specifies where to connect, Port identifies the server port, Password is used for authentication, and SNI indicates the server name during the TLS handshake. This guide is for users with a valid configuration who need to enter the details manually or check an imported profile. Verify each parameter first, then distinguish TLS, authentication, and routing issues. Don’t cycle through port numbers or disable certificate verification as a workaround.
1. What TLS and Password Do in a Trojan Connection
A typical Trojan connection starts with a TCP connection to the server, followed by a TLS handshake. The client then sends a Trojan request containing authentication information through the encrypted connection. TLS encrypts traffic and verifies the server’s identity; Password lets the server check whether the client is authorized. A correct password does not guarantee a valid certificate, and a valid certificate does not guarantee a correct password.
Troubleshoot in order: address resolution → port reachability → TLS handshake → Trojan authentication → actual requests. Opening a regular webpage only confirms that the device has basic network connectivity. A latency result alone does not prove that Trojan authentication succeeded or that the destination is reachable.
Guideline: Keep the values provided by your service provider
Compare each parameter with the original configuration. Change one value only when you know it is wrong, then test again. Changing Port to 443 or setting SNI to match Address is not a universal fix.
2. Add Server: How to Enter the Four Parameters
Tap “+” in the top-right corner of Home to open Add Server. Set Type to Trojan, then enter the remaining details. Depending on the interface language or form layout, SNI may appear as a TLS-related server name field. Match the value to the field’s meaning; don’t enter it as a remark or Password. The address and password below are format examples only and cannot be used to connect.
| Field | Example | How to enter it and common mistakes |
|---|---|---|
Type | Trojan | Match the original configuration. Don’t choose a different protocol just because it also uses TLS. |
Address | edge.example.com | Enter the server’s domain name or IP address without https://, a path, query parameters, or a port suffix. |
Port | 443 | Enter the number only. If the original configuration specifies 8443, keep 8443 rather than replacing it with a commonly used value. |
Password | demo-password-not-valid | Copy the value exactly, including capitalization. Check for leading or trailing spaces and line breaks. This is not your App Store account password. |
SNI | tls.example.com | Enter the TLS server name specified in your configuration. It is usually a domain name; don’t include a scheme, path, or port. |
Address and SNI may be the same or different. For example, Address may be the IP used to reach the server, while SNI is the domain name on the server’s certificate. In that case, don’t replace SNI with the IP address. The TLS SNI extension indicates the server name; the certificate chain must still be trusted and the certificate name must still match.
3. Add a Server Manually and Test the First Connection
Have the complete Trojan parameters ready before adding a server. If your service provider gave you a subscription URL, import it using the subscription feature first, then check the resulting entry. Enter the details manually only when you have the individual parameters. A subscription URL cannot be used as Address.
-
Open the form
Go to Home → tap “+” in the top-right corner → Add Server, then select Trojan under Type. Add a recognizable remark to distinguish the entry from similar ones you’ve already saved.
-
Enter the address
Enter Address and Port separately. If your details are in the format “domain:port,” split them into two fields. Don’t paste a complete share link into Address.
-
Check authentication
Enter Password and SNI, keeping the original TLS settings. If the configuration also includes transport parameters such as WebSocket, set the corresponding options as specified. These four fields alone may not be enough.
-
Save and select
Save the entry, return to Home, and select it. Check the current Global Routing option, then connect. The first time you connect, follow the system prompt to allow adding a VPN configuration.
-
Test a request
Run Connectivity Test from Home, then open a known working HTTPS page. Check the connection log to see whether the request followed the selected policy. Restore your usual routing settings after testing.
If Settings → On Demand is enabled, note its current conditions. On Demand may trigger a connection automatically, so during troubleshooting distinguish an automatically triggered connection from whether the selected Trojan entry can actually handle requests. If you temporarily disable it, restore the original conditions after testing instead of deleting all configurations.
4. Connected but Browsing Fails? Check Global Routing
Selecting an entry on Home does not mean every request will use it. Global Routing determines how requests are handled. If the current setting is Direct, browsing results cannot tell you whether the selected Trojan entry is working. The following compares Shadowrocket’s routing settings only; it does not cover choosing a service provider.
Config
RecommendedRoutes requests according to the rules in the active configuration. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP ranges, GEOIP matches based on IP geolocation, and FINAL handles requests that did not match earlier rules. The result depends on rule order and the selected policy.
Best for: everyday use with verified rules. Don’t assume unmatched requests will always connect directly.
Proxy
Sends requests handled by the client to the proxy policy, which can help isolate the effect of rules during a temporary test. It cannot fix an incorrect Password or TLS configuration, and it does not necessarily cover all traffic on the device.
Best for: briefly checking whether the selected Trojan entry can handle actual requests.
Direct
Connects requests directly to their destinations without forwarding them through the selected proxy entry. If a page opens after switching to Direct, that only confirms the direct connection path works.
Best for: checking basic network connectivity. This does not verify Trojan parameters.
Scene in Global Routing applies settings for a particular scenario. During troubleshooting, check which policy the active scene actually uses. Don’t rely only on the selected-entry indicator on Home; the scene and rules determine the final result.
Guideline: Keep temporary tests separate from everyday settings
If a request works under Proxy but fails under Config, check which rule matched and which policy it uses. If it fails under both settings, troubleshoot the connection path step by step: Address, Port, TLS, and Password.
5. Common Setup Problems: Diagnose by Symptom
An error message can help narrow down the cause, but it cannot replace checking the parameters. The symptoms below are diagnostic clues, not results from tests on a specific device. After each change, retry the same destination and note your network, selected entry, routing settings, and exact error. Avoid changing several variables at once.
It keeps timing out. Is Password wrong?
Not necessarily. Go to Home → select the entry → Edit, then check Address and Port. Confirm that the domain resolves and that the current network can reach the port. A timeout may occur during TCP connection or the handshake; it alone is not a reason to reset the password.
The certificate name doesn’t match. What should I enter for SNI?
Enter the server name specified by your service provider, without https:// or :443. If Address is an IP and the original configuration specifies a separate domain, keep that domain as SNI. If the error persists, check the server certificate instead of masking the problem by bypassing verification.
I copied Password, but authentication still fails. Why?
Copy it again from the original configuration and check capitalization, trailing line breaks, and whether you used an account login password by mistake. Enter the actual password in the form; don’t copy percent-encoded characters from a link. If your service provider has rotated the credentials, update the existing subscription or replace the affected parameters.
The latency test shows a result. Why won’t webpages load?
First check that Global Routing isn’t set to Direct, then verify the policy applied to the current request. If only domain-based requests fail, check DNS resolution. If all requests fail, review TLS, authentication, and any additional transport parameters. A latency result is not a substitute for testing a complete application-level request.
6. Share Links, Subscription Updates, and Parameter Security
trojan:// usually represents a single share link. Its common structure includes authentication details, a server address, a port, and query parameters. It is not a regular webpage URL or a subscription that updates automatically. After importing it through Shadowrocket’s QR code or clipboard option, open the entry and check Type, Address, Port, Password, and TLS-related options.
For example, https://example.com/sub?token=xxxx is only an illustrative, unusable subscription format. A real subscription URL may contain access credentials. Save it through the subscription feature so the client can retrieve its entries; don’t paste the entire URL into Trojan’s Address field. Subscription-generated entries may be overwritten during updates, so check how the configuration is managed before making long-term changes.
- After updating an existing subscription, check whether the server’s Port, Password, or SNI has changed. Don’t rely on the remark being the same.
- Keep a recoverable copy of the original configuration. For comparison tests, create a separate manual entry rather than modifying the only working subscription entry.
- When asking for troubleshooting help, hide Password, subscription tokens, and complete share links. Provide only the necessary field types and error messages.
- If you can’t confirm additional transport parameters, ask your existing service provider for the complete configuration. Don’t guess settings such as a WebSocket path from a generic Trojan example.