A Shadowrocket server share link carries connection parameters directly; a subscription URL points to configuration content that must be retrieved. This guide is for users who already have their own connection configuration. It explains how to identify links by their prefixes, encoding, and fields, and where to import them. You’ll learn when to use link import, Type → Subscribe, or Add Server for manual entry—and why a successful import does not guarantee a successful connection. All addresses, passwords, UUIDs, and port combinations below are dummy values for illustration and cannot be used to connect.
Check the prefix, then confirm what the URL is for
The scheme at the start of a link determines how it is parsed. ss:// indicates Shadowsocks parameters, vmess:// indicates VMess parameters, vless:// indicates VLESS parameters, and trojan:// indicates Trojan parameters. Each link usually describes one server entry. Putting several links on separate lines does not turn them into a subscription URL that can be updated over time.
A URL beginning with https:// only tells you that HTTPS is used to retrieve content; the prefix alone does not mean it is a subscription. Websites, account management pages, and subscription endpoints can all use HTTPS. Enter a URL in Subscribe only when the configuration provider explicitly identifies it as a subscription and the client can recognize its response.
| Format | What it typically contains | What to check first |
|---|---|---|
ss://… | Shadowsocks encryption method, password, address, and port | Whether the encoded section is complete and includes any plugin parameters |
vmess://… | Often Base64-encoded JSON parameters | Whether the address, UUID, transport, and TLS settings are present |
vless://… | UUID, address, port, and query parameters | Fields such as type, security, and flow |
trojan://… | Password, address, port, and TLS and transport parameters | Password encoding, SNI, and certificate verification settings |
https://example.com/sub?token=xxxx | Example subscription endpoint; the actual content must be retrieved | Whether it is a subscription, rather than a login or error page |
ss://: distinguish the Base64 section from the server address
A common Shadowsocks share link has this structure: ss://user-info@host:port#name. The user information may be a Base64 representation of method:password. In the example below, decoding the user information gives aes-128-gcm:demo-pass; example.com is a demo host, 8388 is a demo port, and Demo-SS is the name.
ss://[email protected]:8388#Demo-SSSome older formats encode the entire string, including the host and port. So you should not expect every ss:// link to show an @ character. Standard Base64 and URL-safe Base64 may look different, and the trailing = padding may be omitted. These differences in appearance alone do not mean the parameters are invalid.
- method: It must match the server configuration. Changing the display name does not affect authentication, but changing the encryption method arbitrarily may cause the connection to fail.
- password: This is not an app purchase credential. It is an authentication parameter for this server configuration and must not be shared with the link.
- plugin: Some links include additional transport settings as query parameters. After importing, check that these were recognized correctly; checking only the address and port is not enough.
- Name: The text after
#is usually a label. Spaces and non-ASCII characters may be percent-encoded, and the label is not used to authenticate the server.
vmess://: check the JSON fields after decoding
A common VMess share format is a Base64-encoded JSON string after vmess://. The example below shows the decoded demo content, not a link you can paste into a subscription field. To import a real link, keep the original text intact; there is no need to decode and re-encode it manually.
{
"v": "2",
"ps": "Demo-VMess",
"add": "example.com",
"port": "443",
"id": "11111111-1111-4111-8111-111111111111",
"aid": "0",
"scy": "auto",
"net": "ws",
"type": "none",
"host": "example.com",
"path": "/demo",
"tls": "tls",
"sni": "example.com"
}add and port identify the connection destination, id is the UUID, and aid corresponds to alterId. net specifies the transport; when its value is ws, interpret host and path as WebSocket parameters. Check tls and sni against the TLS settings. These fields depend on one another, so entering only the UUID is not enough.
aid: "0"is a common way to represent a VMess AEAD configuration. Use the existing configuration as your reference; do not enter a nonzero value just to try to improve compatibility.scyrelates to VMess data encryption and is separate from the outer TLS layer.v: "2"identifies the format of this share JSON; it is not a Shadowrocket version number.- In this type of JSON,
typedoes not have the same meaning as the VLESS URI query parameter. Interpret it in the context of the share format andnet.
If the decoded content is not the expected JSON, do not immediately rewrite the original text. The share format may have variants, or the text may have been truncated. Get the original link again and check the fields shown after importing it into the client; this is usually more useful than repeatedly editing encoded content.
vless:// and trojan://: focus on the query parameters
VLESS and Trojan are often shared as readable URIs. The UUID or password goes before @, followed by the host and port. Query parameters come after ? and are separated by &. The two examples below illustrate the structure only; they do not point to connectable servers.
vless://[email protected]:443?encryption=none&security=tls&type=ws&host=example.com&path=%2Fdemo&sni=example.com#Demo-VLESS
trojan://[email protected]:443?security=tls&type=tcp&sni=example.com#Demo-Trojan| Field | How to read it | Common misinterpretation |
|---|---|---|
encryption=none | VLESS itself does not provide data encryption at this layer | This does not mean TLS is absent |
security=tls | TLS is requested; check the related parameters as well | Port 443 does not mean TLS is configured correctly |
type=ws | Uses WebSocket transport; check host and path | Do not change ws to tcp while keeping only the original password |
sni | Server name used for the TLS handshake | Not necessarily the same as the connection address or the WebSocket Host |
flow | A flow control parameter used by some VLESS configurations | This field should not be added to every VLESS link |
%2F | Percent-encoded; decodes to a slash | When entering path manually, do not encode it twice as %252F |
If a Trojan password contains reserved characters such as @, #, or &, they must be URI-encoded correctly. “Cleaning up” these characters after copying can change how the URI is parsed. When entering the details manually, enter the value required by the field rather than pasting the entire URI into Password.
Bottom line: check the fields; don’t guess the protocol from the port
If the address and port are the same but the connection result differs, compare the UUID or password, type, SNI, path, and flow. Port 443 can be used with different protocols; it is not a reason to change VLESS to Trojan.
Subscription URLs retrieve content, not one fixed server entry
A subscription URL is an endpoint that can be requested repeatedly. The client retrieves its response and then parses the server entries in it. The response may contain multiple share links as plain text, their Base64 representation, or another format supported by the client. Whether it can be recognized depends on the returned content, not the length of the URL.
For example, token in https://example.com/sub?token=xxxx is only a demo parameter name. A real URL may include credentials in its path or use other query parameters. Removing parameters that seem irrelevant, changing capitalization, or omitting content after & can make the request return an error page instead of a server list.
Type → Subscribe
RecommendedSave a subscription URL you already have and use its update function to retrieve entries again. This recommendation applies only if you already have a confirmed subscription URL; it is not a recommendation for any connection service.
Best for: a clearly identified subscription endpoint whose entries need to be synced over time
Type → Select the matching protocol
In Add Server, select the matching type, such as Shadowsocks, VMess, VLESS, or Trojan, and save the connection parameters field by field. A manually added entry will not automatically receive new parameters just because the original subscription changes.
Best for: a complete set of parameters that you need to check field by field for one server
Sharing one entry from a subscription usually gives you only a snapshot of that server’s parameters at that time; it does not recover the full subscription URL. Conversely, having a subscription URL does not mean you have only one server entry; updates may add, remove, or change entries. Before editing entries generated by a subscription, record the differences, since a later update may overwrite your changes.
Identify and import links in Shadowrocket
Keep a copy of your original text before choosing an import method. Home is primarily for managing servers and connection status; Config manages rule configurations, so do not treat an arbitrary rule file URL as a server subscription. Scanning a QR code and reading from the clipboard are just ways to get the text—the content itself determines what kind of entry is created.
-
Check the original text
Check whether it begins with ss://, vmess://, vless://, or trojan://, or is an HTTPS subscription URL whose purpose has been clearly identified. Remove quotation marks and explanatory text added by a messaging app, but do not remove parameters within the link.
-
Add a subscription
For a subscription URL, go to Home → “+” in the top-right corner → Add Server → Type → Subscribe. Enter your complete URL in URL, save it, then update the subscription. Do not enter the full HTTPS URL in the Address field for a regular server.
-
Import a single link
Copy the complete single-server link, return to Shadowrocket, and follow the import prompt. Allow clipboard access if prompted by the system. To use a QR code, scan it from the entry at the top of Home and check the result before saving. Do not overwrite an entry you have not checked.
-
Check the parameters
Open the imported entry for editing. Check Type, Address, Port, and the corresponding UUID or Password, then verify the TLS and transport settings. If automatic recognition fails, go to Home → “+” → Add Server, choose the matching Type, and enter the existing parameters manually.
-
Test the connection
Return to Home, select the intended server, and connect. If prompted to add a VPN configuration for the first time, follow the system instructions to authorize it. Use Connectivity Test as a diagnostic, and confirm that the current Global Routing selection suits the test.
If you have copied the complete link but no import prompt appears, first check whether the system allows clipboard access and whether line breaks, spaces, or rich-text punctuation have truncated the text. Do not keep adding the same content to Subscribe: a parseable single-server URI does not become an updatable subscription endpoint.
Troubleshoot import errors, empty updates, and connection failures separately
These three issues occur at different stages. An import error means the text was not parsed correctly. An empty update means retrieving or parsing the subscription content did not produce the expected entries. A connection failure occurs after the server entry has been created. Troubleshooting by stage avoids repeatedly changing settings in the wrong place.
- Link not recognized: Check that the scheme is complete and that the link has no Chinese colon, surrounding quotes, or message text. Do not add line breaks to Base64 content, and do not mistake a plus sign in a URI for a space.
- Subscription update returns no entries: Check the URL path and all parameters, and make sure you did not paste an account page URL. If you see HTTP 401 or 403, check the subscription credentials or access permissions; this does not mean the password field is wrong.
- Entry exists but times out: Check Address, Port, network reachability, and service status. Example ports 443 and 8388 are not universal fixes that can be substituted at will.
- TLS error: Check the device time, SNI, certificate, and server settings. Disabling certificate verification should not be a routine workaround.
- Test and access results differ: Connectivity Test results reflect only their test conditions and do not guarantee access to every destination. Also check the routing and policy actually used for the destination request.
- Connection starts again after disconnecting: Check existing settings under Settings → On Demand. On-demand connection can affect what triggers a connection, but it cannot fix an incorrect share format, password, or subscription token.
Global Routing options—Proxy, Direct, Config, and Scene—determine how traffic is routed; they do not turn an invalid link into correct parameters. In particular, successful access to a destination under Direct does not prove that the imported server works. Under Config, a request may match a DIRECT rule. To test a server, check both the selected entry and the current routing mode instead of relying only on whether a page opens in the browser.
Bottom line: keep the original text and change one thing at a time
Troubleshoot in this order: identify the text → retrieve the content → check the fields → test the connection. Record the exact error and each change. First restore the original parameters from the existing configuration, then investigate one issue at a time. Do not change the protocol, port, and TLS settings all at once, or you will not know which change affected the result.