Shadowrocket is the client; it is not a proxy subscription. The App Store purchase gives you the iPhone and iPad app, while a third-party provider may sell access to servers, a subscription URL, or a configuration file. These are separate purchases, separate support channels, and separate risks. Shadowrocket does not include nodes, bandwidth, or a route package after installation. You must prepare a valid configuration yourself if you want to connect.

A low price does not automatically mean poor service, and a high price does not guarantee better coverage. Before paying, compare what is actually included: traffic allowance, server locations, supported protocols, renewal terms, update format, device limits, and the provider’s ability to explain failures. The checklist below is designed for Shadowrocket users who want to make a measured choice in 2026 rather than buy from a slogan, a screenshot, or a copied recommendation.

Start with the service, not the app

First separate the three products that are often described as one package:

  • Shadowrocket: an iOS and iPadOS client distributed through the App Store. It is a one-time app purchase, not a monthly proxy plan.
  • A node subscription: a provider-managed URL or QR code that may contain multiple servers and sometimes rules. The provider controls its availability and update behavior.
  • A manually added server: one protocol, address, port, and authentication set. It does not update like a subscription and usually requires more maintenance.

This distinction matters when you read a sales page. “Works with Shadowrocket” means the provider claims to offer a format the client can import. It does not mean the provider is affiliated with Shadowrocket, that the route is included with the App Store purchase, or that the provider can repair a VPN permission problem on your device. It also does not mean every item in the feed is compatible with every Shadowrocket version.

Before buying the app, use the official App Store product page. Confirm the name is Shadowrocket, the developer is Shadow Launch Technology Limited, and the application ID is 932747118. There is no official Android client, and this site does not provide Android packages, IPA files, nodes, subscription URLs, or invitation codes. A third-party service may support several client brands, but that support is the provider’s responsibility, not an official Shadowrocket service.

Once the app is installed, grant the system VPN configuration permission before judging a subscription. A subscription can import correctly while the tunnel still cannot start because permission was denied or another VPN is active. The illustrated tutorial covers the normal import and connection flow, while VPN configuration explains the system permission separately.

Also decide what you need the service to do. Occasional browsing, travel, video calls, software updates, and long-running downloads have different requirements. A plan that looks adequate for short text requests may become expensive or unusable when several devices consume video traffic. Write down your real use case before you compare sales pages.

Compare price bands realistically

Price is useful only when it is tied to measurable limits. Providers use different currencies, billing cycles, traffic units, and promotional periods, so compare the normal renewal price rather than the first-month discount. A plan can appear cheap because the introductory price is shown prominently while the renewal amount is hidden in a small note.

The following bands are not promises about market quality. They are a way to ask better questions about what a plan can realistically provide:

  • Entry plans: usually suit light or occasional use. Expect a smaller traffic allowance, fewer locations, limited simultaneous connections, or less predictable performance during busy periods. They can be reasonable for testing compatibility, but buying a long billing period immediately adds unnecessary risk.
  • Mid-range plans: often balance traffic, location choice, and stability for one person. They may include several protocol types, a larger server pool, and a clearer update process. Check whether the advertised traffic resets monthly and whether unused traffic carries forward.
  • Higher-priced plans: may provide more traffic, more concurrent devices, premium routes, or business-oriented support. The extra cost is worthwhile only if those features match your usage. A larger node list does not automatically make every destination faster.
  • Very cheap lifetime or unlimited offers: require the most caution. “Unlimited” may be subject to fair-use rules, speed shaping, hidden device limits, or a provider that can disappear without notice. “Lifetime” normally means the lifetime of the service, not a legally guaranteed lifetime of your account.

Calculate an approximate monthly cost using the standard renewal price, not the coupon price. Then check the traffic allowance in gigabytes, the number of devices allowed at one time, and whether changing a device requires support. Some providers count active connections rather than registered devices. A phone, tablet, and laptop can consume three slots even when only one person uses them.

Ask whether the traffic quota covers uploads as well as downloads. Video calls, cloud backups, photo synchronization, and large file transfers can use more upload traffic than expected. If the provider does not define the quota, treat that omission as a risk rather than assuming the most generous interpretation.

Review payment and cancellation details before checkout. Confirm the billing period, refund window, automatic renewal behavior, account recovery method, and what happens when payment fails. Avoid sending more personal information than the provider reasonably needs. A provider that demands an unrelated document, asks for your Apple ID password, or requires an unknown configuration profile is not made trustworthy by a low price.

Do not pay for a year merely because the yearly rate is lower. First import a short-term plan, verify that its format is accepted, test several locations at different times, and confirm that updates work. A short trial cannot prove long-term stability, but it can reveal a wrong protocol format, unreachable update host, unusable account, or device-limit problem before the cost becomes large.

Check protocols and subscription formats

Compatibility is more than seeing the word “Shadowrocket” on a sales page. The provider should identify which protocols are included and how they are delivered. Shadowrocket may support several common proxy and VPN-related formats, but support can depend on the imported profile, encryption parameters, server implementation, and the installed app version. A protocol name alone is not a performance guarantee.

Ask the provider for a clear compatibility statement covering the actual format you will receive. Useful information includes whether the link returns a plain configuration, a Base64-encoded list, a dedicated subscription format, or a profile that depends on provider-side conversion. If the page says only “all clients supported” without naming the output format, you cannot confirm that it will import into Shadowrocket.

When comparing protocol choices, focus on behavior rather than fashionable labels:

  • Transport compatibility: the server and client must agree on the protocol, port, encryption, and authentication fields. One missing parameter can produce a timeout even when the address is correct.
  • Network fit: a protocol that performs well on one Wi-Fi network may behave differently on cellular data or a restricted public network. Ask whether the provider documents fallback options.
  • UDP requirements: some applications need UDP behavior, while a basic web test may succeed over TCP. If calls, games, or real-time services matter, confirm whether the offered route and protocol support the required traffic.
  • IPv4 and IPv6 behavior: a server may be reachable over one address family but not the other. If only certain networks fail, the cause may be DNS or IPv6 handling rather than the subscription price.
  • Update stability: a node can connect today while the subscription URL fails tomorrow. The update host, authentication, and returned format are part of the service.

A subscription URL is not the same as a node address. Importing a URL tells Shadowrocket where to fetch a list. Updating that entry later downloads new content from the provider. A manually added server has no such update mechanism unless you change its fields yourself. Do not paste a single server link into a subscription field and conclude that the app cannot parse subscriptions.

Before checkout, confirm whether the provider supplies nodes only, nodes plus rules, or separate URLs for each. When Shadowrocket uses Config routing, rules determine whether traffic goes to Proxy or Direct. Updating nodes without updating rules can leave an old policy set in place. Conversely, updating rules does not add a missing server. The subscription update guide explains why an import failure and a connection failure should be investigated separately.

Check how the provider handles expired accounts. Some services return an empty list, some return an error page, and some return a valid-looking response with no usable entries. A parse error means content arrived but was not accepted as the expected format; a timeout means the content did not arrive in time. Those are different problems and require different support requests.

Do not ask a provider to send credentials through an unsafe public channel, and never share your Apple ID password. If a provider insists on installing an unknown certificate, enterprise application, or device-management profile to “activate” a subscription, stop. A normal subscription should not require a modified Shadowrocket package or a bypass of App Store security.

Reduce provider and payment risk

No third-party subscription can be treated as permanent infrastructure. Domains expire, servers are retired, accounts are suspended, and providers can change policies. The goal is not to find a service with no risk; it is to limit how much money, data, and dependency you expose to an unverified operator.

Look for operational information that can be checked before payment:

  • A support channel that explains compatibility, renewal, and account recovery without promising impossible uptime.
  • A clear description of traffic limits, simultaneous connections, locations, protocol formats, and refund conditions.
  • A status or announcement method for planned maintenance and retired nodes.
  • A checkout flow using a payment method you understand, with a receipt and an identifiable transaction record.
  • Instructions that do not ask for your Apple ID, device passcode, Contacts access, Photos access, or an unrelated system profile.

Be cautious with countdown timers, guaranteed speed claims, anonymous “best provider” rankings, and screenshots showing only one exceptionally low latency number. A screenshot cannot prove that the account will be delivered, that the route is available from your network, or that the same node will exist after renewal. Claims such as “works everywhere,” “never blocked,” or “unlimited at full speed” should be treated as advertising until the terms define them.

Do not confuse privacy language with a complete privacy policy. Read what the provider says about connection logs, account data, payment records, abuse handling, and support tickets. A provider may need limited account information to manage a plan, but you should understand what is collected and how long it is retained. Do not send browsing histories or unrelated identity documents to solve a basic import question.

Keep a local record of the purchase receipt, renewal date, plan name, traffic limit, and the original subscription address. Store the URL securely because it may contain an account token. Do not publish it in a screenshot, paste it into a public issue, or send it to a group chat. If you need support, redact tokens and use a temporary test account where possible.

Maintain a fallback that does not depend on the same provider. This can mean a second network, a different legitimate service, or simply the ability to use Direct for ordinary local tasks. It should not mean collecting random configuration files. A backup is useful only when its source and format are understood.

If the service disappears, do not attempt to repair it by installing an IPA, accepting an enterprise certificate, or importing an unknown profile. Such a package can be altered, revoked, or granted permissions unrelated to proxy operation. Shadowrocket updates and purchase recovery should come from the App Store and the Apple ID used for the purchase.

Test imported nodes after import

After the subscription imports, do not select the first entry and immediately buy a longer plan. First confirm that the node count is plausible, the names and locations match the provider’s description, and the list remains after restarting Shadowrocket. An empty or unexpectedly tiny list may indicate an expired account, a wrong format, or a provider-side change.

Use the app’s latency test as a comparison tool, not as a complete health check. It measures a probe target with the method configured in Settings. It does not prove that the websites or applications you use will work, and it does not confirm that the subscription will remain valid. Compare several nodes on the same network, at roughly the same time, with the same probe address and method. If you change Wi-Fi to cellular, change the test target, or change DNS, record that the comparison conditions changed.

A practical first test looks like this:

  1. Confirm the VPN permission is granted and no other VPN client is active.
  2. Choose a provider-listed node that is not marked as maintenance or restricted.
  3. Test it once or twice rather than running repeated probes in a tight loop.
  4. Open one ordinary address that you actually need, then compare the same address with another node.
  5. Repeat at a different time of day if stability matters. A quiet result at noon does not describe evening congestion.
  6. Record timeouts, connection drops, slow DNS resolution, and application-specific failures instead of keeping only the lowest millisecond value.

Latency is only one dimension. A route with a slightly higher number may load pages more consistently, while a very low probe result may fail because the destination uses a different path. Test coverage by checking the destinations relevant to you, not by opening dozens of unrelated websites. For video or calls, observe startup time, buffering, reconnection, and audio stability. For ordinary browsing, notice DNS delays, incomplete pages, and whether images or downloads fail.

Use Global Routing carefully while comparing. Proxy sends most traffic through the selected node and is useful for asking whether a destination works through that route. Direct provides a baseline for the local network and destination. Config follows the current rules and policy groups, so the selected home-screen node may not be the final exit. If Proxy works but Config fails, inspect rules and policy groups before replacing the subscription. See Global Routing for the distinction.

Change one variable at a time. Keep the same destination while changing nodes. Keep the same node while comparing Proxy and Config. If every node fails but Direct also fails, changing providers will not add useful information; check the current Wi-Fi or cellular network, system clock, DNS, and whether another VPN is connected. If only one node fails, save the evidence and ask the provider whether that entry is retired or restricted.

Finally, test an update after the initial import. A service is not operationally useful if it works only once. Update the same entry, confirm that the list is refreshed rather than duplicated, and check whether the rules source is separate. Keep a small note of the date, node behavior, and errors. This makes renewal decisions based on repeated observations instead of a single promotional test.

The safest buying decision is usually the reversible one: verify the official Shadowrocket app through the App Store, choose a short plan with clearly stated limits, import it using the documented format, test real destinations, and renew only when the observed service matches your needs. The client, subscription, and network are separate layers. Keeping them separate makes both troubleshooting and spending decisions much clearer.