Shadowrocket Android APK Installation Guide: Download, Allow Unknown Apps & Fix WeChat Downloads

At a glance

This guide is for anyone installing Shadowrocket on an Android phone. It walks through downloading the APK, authorizing the app that opens it, installing the app, importing an existing subscription, and checking the connection. If a download won’t start in WeChat, open the page in your system browser. If Android blocks the installation, allow installs only for the app that actually opens the file. Install-source access, VPN connection permission, and subscription service are separate matters and must be handled separately.

1. Check where to get Shadowrocket for Android and what you need before installing

Shadowrocket for Android is free. Get the APK from the Android option on this site’s download page. The Mac (Apple silicon and Intel), Windows, and Linux versions are also free. The iPhone / iPad version costs $2.99 as a one-time purchase on the App Store. The developer is Shadow Launch Technology Limited; check the App Store listing for system requirements. You don’t need to buy the iPhone / iPad version to install the Android app.

Buying the app does not include a server plan. Installing it does not provide a working server or subscription. This guide assumes you already have a service provider and subscription; get your subscription URL from your provider. This site does not provide, sell, or recommend servers or subscriptions. Before installing, make sure you can access this site, have enough free storage, and know where the downloaded file is saved.

Where to get it: Open this site’s download page and choose the Android option. Don’t give an installer package for another platform to the Android installer.
Device architecture: Check the architecture and system requirements listed on the download page. An ARM64 package is for compatible 64-bit ARM systems; your phone’s processor name alone doesn’t guarantee compatibility.
Download status: Wait until the browser shows the download is complete before opening the file. If it’s paused, failed, or still downloading, resolve the download issue first.
Device management: Work profiles, school devices, and managed devices may restrict installations. Ask the administrator about any such restrictions.

2. Download in a browser and allow installs from unknown apps

On Android, “Allow from this source” is usually granted separately to each source app; enabling it once does not apply to every app. If you download and open the file in a browser, that browser is usually the source. If you open it from a file manager instead, Android may ask you to authorize the file manager. Settings names and menu paths vary by manufacturer. Use the “Settings” button in the installation prompt to find the relevant option.

Open the download page

Use your system browser to visit this site’s download page, choose the Android option, and start the download. Wait for the download list to show that it’s complete; don’t keep tapping the file while it’s still being written.
Open the file

Tap the APK in the browser’s download history, or find it in the Downloads folder in your system file manager. Verify the file using the download history and timestamp, not just a similar-looking name.
Authorize the source app

If Android blocks the installation, tap “Settings” in the prompt. A common path is Settings → Apps → Special app access → Install unknown apps. Select the app that actually opened the file, then enable Allow from this source.
Finish installing

Return to the installer, check that the app name is Shadowrocket, and confirm the installation. If the installer doesn’t resume when you return from Settings, open the file again from the original download history.
Revoke permission

After installation, you can return to the same source-app settings and turn off Allow from this source. This restricts future installations; it won’t uninstall the app or turn off VPN connection permission.

3. Download won’t open in WeChat? Switch to a browser first

WeChat’s built-in web view handles downloads differently from a system browser. If the page loads but tapping the Android option doesn’t create a download, that doesn’t mean the APK is damaged. The installer hasn’t been involved yet, so changing “Allow from this source” usually won’t start the download. First open the page in your system browser, then check whether a download has started.

Open the menu in the top-right corner of the WeChat page and choose “Open in Browser.” The option may have a slightly different name on some devices.
If you don’t see that option, copy the current page address, open your system browser, paste the address into the address bar, and visit the page.
Go to this site’s download page and choose the Android option again. Check the browser’s download list instead of waiting only for an on-page message.
When the download is complete, open the file and follow the previous section to authorize the source app. You don’t need to return to WeChat to finish installing.

If the system browser also fails to download the file, check your network, available storage, and whether the download task is paused. After switching networks, you can try downloading again. Cancel any incomplete task first to avoid accidentally opening a partial file later. Don’t paste a subscription URL into the browser’s address bar as a substitute for downloading the APK; subscription data and app installation files serve different purposes.

4. Identify the cause when installation fails

“There was a problem parsing the package,” “App not installed,” and “Installation blocked” are different errors. Note the exact message, then check whether the download is complete, the device is compatible, or the correct source app has permission. To protect existing settings, don’t uninstall the app as soon as an error appears. Before updating, save your subscription details and configuration files.

Why does Android still say I don’t have permission after I allowed installation?

Check which source app the prompt names. If you authorized your browser but then opened the file in a file manager, you’ll need to authorize the file manager separately. Follow the system prompt to that app’s Install unknown apps page. Don’t keep changing unrelated permissions.

What should I do if package parsing fails?

Cancel any incomplete download and delete the failed file, then download it again from this site’s download page. If the file still fails after downloading completely, check your device architecture and the system requirements on the download page. Older Android versions or different architectures may not support the selected package.

An update says “App not installed.” Should I uninstall the existing app first?

First check your available storage and restart the installation process. If Android reports a conflict with the existing app, check whether the original installation source matches the current package. Don’t delete the existing app right away. Back up your configuration and note the error before deciding what to do next.

The Install button is disabled. Should I turn off all security protections?

No. Close any floating windows or screen overlays, then check whether a system prompt is waiting for confirmation. If the device is managed by an organization and its policy blocks installation, contact the administrator. Repeatedly granting permissions or changing other security settings won’t resolve the policy restriction.

5. First launch: import your subscription and check the settings

A successful installation only means the client is installed. When you first open Shadowrocket, have the subscription URL from your provider ready and check that it contains no extra spaces, line breaks, or text added by a chat app. Home, Type, and Subscribe below are interface labels. If your layout differs, look for the same functions; don’t confuse Settings in Android with Settings inside the app.

On Home, open the add menu—usually the “+” in the top-right corner—and set Type to Subscribe.
Paste your full subscription URL into the URL field, give the subscription a recognizable name, and save it.
Update the subscription and check that server entries appear on Home. If the update fails, check that the URL is valid and your network is working; don’t create the same subscription repeatedly.
Select your server, then enable the connection. The first time Android asks for VPN connection permission, read the prompt and confirm authorization.

A subscription URL may contain an access token. Hide it before sharing screenshots, feedback, or copied logs. The configuration card below is for checking fields, not ready-to-use connection details. Use the server port provided by your service provider; 443 is not the default for every protocol.

Check the Subscribe fields

Field: Home → + → Type → Subscribe
URL example: https://example.com/sub?token=xxxx — format example only; it won’t work
Value: Keep all query parameters; remove leading and trailing spaces and line breaks
Update result: Check whether server entries were created, not just whether the subscription name appears

Get your subscription URL from your service provider. Don’t share access tokens publicly.

Check the connection settings

Type: Match the protocol specified in your details, such as Shadowsocks, VMess, VLESS, or Trojan
Port: If your details specify port 443, enter 443. Don’t change it to 80.
TLS / SNI: Use the details provided by your service provider; don’t automatically copy the server address into SNI
Authentication: Check the Password or UUID for the selected protocol, including the first and last characters

Importing a subscription usually includes its settings. When troubleshooting, compare fields one by one and don’t change certificate verification settings without a reason.

6. Tell routing issues apart from network issues

A VPN icon means the connection service has started. It doesn’t guarantee that every remote server is available or that every app request is routed as expected. Global Routing controls how traffic is handled, while rules in Config determine matches in rule-based mode. When troubleshooting for the first time, change just one setting at a time so server failures, rule errors, and system permissions don’t get mixed together.

Config: use configuration rules

Recommended

Connections are handled according to the rules and policies in the currently enabled configuration. The result depends on its contents; don’t assume that unmatched requests will go direct. Before using this mode, make sure your own valid configuration is selected.

Best for: everyday use with a clearly defined rule configuration

Proxy: proxy mode

Send connections handled by the client through the selected proxy route. Use this to check temporarily whether the selected server can reach a destination; it doesn’t replace checking protocol settings individually.

Best for: temporarily checking whether rule-based routing causes access differences

Direct: direct mode

Use a direct route for connections handled by the client. If the connection switch is on but Global Routing is set to Direct, requests aren’t going through the selected remote server.

Best for: checking whether the same destination is accessible directly on your local network

If Global Routing shows Scene, check how the current Scene is configured; it isn’t another name for Proxy. Settings → On Demand in the app controls automatic connection behavior, not installation permissions. For your first check, connect manually and confirm that it works. Set up automatic connections later if needed, so they don’t complicate troubleshooting.

Connection switch won’t start: First check whether you approved the system’s VPN permission, and whether another VPN service is already active. Android typically allows only one active VPN service per user at a time.
Server test times out: Check your current network, selected server, port, and authentication settings. Latency tests work in different ways; one timeout doesn’t mean every real connection will fail.
Proxy works but Config doesn’t: Check the active configuration, rule order, and final policy. For example, DOMAIN-SUFFIX,example.com,DIRECT routes matching domains to DIRECT; FINAL,DIRECT sends connections that didn’t match earlier rules directly.
Connection drops in the background: After confirming that it works in the foreground, check Android’s battery optimization and background activity restrictions for Shadowrocket. Change settings for this app only; there’s no need to disable battery management for every app.

7. Checklist after installation

Verify these separately: the app opens, the subscription updates, the VPN starts, and the destination is reachable. This makes it easier to describe exactly where a problem occurs. Get Android app updates from this site’s download page; update subscriptions inside the app. One doesn’t replace the other.

Shadowrocket opens from the app list, and the installer no longer reports an installation failure.
Revoke install-source permission if you no longer need it; keep the VPN permission required for your actual use.
Your subscription has updated and created entries. You haven’t shared its sensitive URL in public chats or screenshots.
You can select your server, start the connection manually, and verify the result by visiting a destination—not just by checking the VPN icon.
Note the current Global Routing mode. When troubleshooting is complete, restore the configuration that suits you before considering automatic connection and background settings.