Shadowrocket Supported Protocols: A Quick Guide to Shadowsocks, VMess, VLESS, Trojan, and Hysteria2

In this guide

Shadowrocket supports several connection protocols, but support for a protocol does not mean you can change an existing server to use it. This guide is for users who already have connection details from a service provider. Use the table to identify the protocol, check its authentication, transport, and TLS settings in Add Server, then distinguish protocol errors from Global Routing issues. Get subscription details from your service provider.

Protocol quick reference: transports and authentication fields

A protocol defines how the client and server exchange data and verify identity. The server address, port, authentication details, and transport settings must match as a set; an address alone is not enough to establish a connection. This table covers common types. Field names and available options depend on the app’s actual interface, and this is not a complete feature list.

Protocol	Transport features	Details to check
Shadowsocks	Uses an agreed encryption method to protect proxy traffic and can carry TCP and UDP. UDP availability also depends on the server and network.	Address, Port, encryption method, and Password. If plugin parameters are provided, they must also match the server.
VMess	Authenticates with parameters such as a UUID and can use transports such as TCP or WebSocket. Check TLS separately.	Address, Port, UUID, encryption settings, and the transport, Host, Path, and TLS parameters specified by your service provider.
VLESS	Identifies the user with a UUID; the protocol itself does not encrypt data. Connection protection depends on the accompanying security layer.	Address, Port, UUID, and transport. Check TLS, security settings, and Flow against the supplied details; don’t reuse settings from another connection.
Trojan	A typical deployment uses TLS to protect the connection and Password for authentication. Certificates and server names are key troubleshooting points.	Address, Port, Password, TLS, and Server Name. Enter any additional transport parameters as specified by your service provider.
HTTP / SOCKS5	General-purpose proxy protocols. Standard HTTP proxies and SOCKS5 are not encrypted tunnels by themselves; SOCKS5 UDP support requires both ends to support it.	Address and Port, plus Username and Password if required by the server. Set HTTP’s TLS option according to the service details.
WireGuard	An encrypted tunnel over UDP that uses key-based authentication. In addition to the remote address, it requires tunnel addresses and peer parameters.	Remote address and port, client Private Key, peer Public Key, and tunnel address. Check the Preshared Key too, if one is provided.
Hysteria2	Built on QUIC over UDP, with TLS and authentication. Whether the network allows UDP directly affects connectivity.	Address, Port, authentication details, and Server Name. Use the service provider’s values for obfuscation and bandwidth settings.

Bottom line: Choose Type to match your connection details

First confirm the protocol name provided by your service provider, then choose the matching Type. Don’t change Type to try a different transport while keeping the original password, port, and other settings.

“Supported” in the table does not mean every combination of extensions will work. For example, two VLESS connections may use different security layers and transport settings. After importing, check the detected type. If a parameter isn’t recognized, confirm the required settings with your service provider instead of guessing from the protocol name.

Add Server: From connection details to your first test

Manual setup works best when all fields are available and you need to check them individually. If your service provider offers a subscription, import it using their instructions, then check that the entries are complete. A subscription is a way to retrieve and update connection details in bulk, not a connection protocol that replaces Shadowsocks or Trojan.

Gather the connection details

Get the protocol, address, port, and authentication details from your service provider. Keep any additional parameters, such as TLS, Server Name, Host, and Path, with them. Don’t copy fields that weren’t provided from another server entry.
Choose the type

Go to Home → tap “+” in the upper-right corner → Add Server, then select the protocol listed in your connection details under Type. Enter Address and Port. For example, if the supplied port is 443, enter 443; don’t assume every protocol uses that port.
Enter authentication details

Enter the Password, UUID, or key information required by the selected Type. A VMess or VLESS UUID cannot be used as a Trojan Password; WireGuard’s Private Key and Public Key are not interchangeable either.
Check transport settings

Set TLS and transport parameters according to your service provider’s details. For WebSocket, check Host and Path too. Preserve the path’s leading slash, capitalization, and query parameters exactly.
Save and test

After saving, return to Home, select the dot beside the entry in the SERVER list, then turn on the connection switch at the top. Allow the VPN configuration if prompted, run Connectivity Test, and try accessing the service you need.

TLS, Host, and Path: Why the same protocol may still fail to connect

Address is the connection destination, Server Name is the name used during the TLS handshake, and Host may be the host field in an HTTP or WebSocket request. They may sometimes be the same, but they serve different purposes and shouldn’t be treated as interchangeable. Even when connecting to an IP address, you may still need the domain specified by your service provider as the Server Name.

TLS: Enable it only if it matches the server configuration. Port 443 is just a port number: it doesn’t prove TLS is configured correctly, nor does it mean you should turn a standard HTTP proxy into an HTTPS proxy.
Server Name: Check the spelling and that it matches the certificate. If certificate validation fails, first check the device’s time, destination address, and server name. Disabling certificate validation is not a standard fix.
Host: With transports such as WebSocket, the server may route requests based on Host. Reaching the address does not mean the request reached the right service.
Path: /ws and / are different paths. These examples illustrate the syntax; they are not settings that work for every server.
UDP: Hysteria2 and WireGuard rely on UDP. If the network you’re on restricts UDP, changing the password or repeatedly adjusting the TLS name won’t fix an underlying reachability problem.

When diagnosing a failure, distinguish between symptoms. A connection timeout can be caused by the address, port, network, or server status; authentication failures point to the password, UUID, or key; TLS errors call for checking the certificate and server name first. Different problems can produce the same failed test, so a single latency reading cannot identify the cause.

Bottom line: Change one set of settings at a time

Keep the original connection details, then check the address and port, authentication details, TLS, and transport settings in order. Repeat the same test after each change so you can tell what made a difference.

Global Routing: Protocol and traffic routing are separate settings

Type determines how to connect to the server; Global Routing determines how requests are handled. Even with correct server settings, requests may go Direct instead of through the selected server. Conversely, changing Global Routing to Proxy won’t fix an incorrect Password. The options below describe Shadowrocket’s routing settings, not a ranking of protocol performance.

Config

Recommended

Match requests against the rules in the active configuration. Results may be DIRECT, a proxy policy, or another policy defined in the configuration. Requests that don’t match an earlier rule are usually handled by the policy specified by FINAL; they don’t necessarily go direct.

Best for: Everyday use when you’ve checked the configuration rules and need different handling for different destinations.

Proxy

Route requests handled by Shadowrocket through a proxy policy. This can help temporarily isolate the effect of rule matching. Before testing, make sure the correct server or policy is selected; turning on the connection switch does not prove the server is working.

Best for: Checking whether rules or policy selection in Config are affecting traffic after verifying the connection settings.

Direct

Connect directly without routing through the selected proxy server. If a webpage opens this way, that does not prove authentication succeeded on the selected Shadowsocks, Trojan, or other server.

Best for: Comparing direct connectivity to distinguish local network issues from problems with the proxy route.

Scene in Global Routing applies the behavior configured for the selected scene. Check its actual conditions and policy; the scene name alone doesn’t tell you whether traffic uses a proxy. In rules, DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches address ranges, GEOIP uses an IP geolocation database, and FINAL handles requests that did not match earlier rules. None of these keywords changes the server’s authentication protocol.

FAQ: Protocol selection and connection issues

Can I change VMess directly to VLESS?

Not by changing Type alone. First confirm that your service provider offers connection details for VLESS, then create a new entry and enter its UUID, port, security layer, and transport parameters. Keep the original entry for comparison so you don’t lose a configuration that worked.

Is Hysteria2 always faster than other protocols?

You can’t determine speed from the protocol alone. Compare connection success, real-world transfer, and stability on the same network, around the same time, and to the same destination. If Hysteria2 keeps timing out, first confirm the UDP port and authentication settings with your service provider, then test again on another trusted network. Don’t start by setting the bandwidth value extremely high.

Why do I see several Types after updating a subscription?

A single subscription can contain server entries that use different protocols. Open Home, check each entry, and open its edit screen to verify Type. Select and test entries individually. A subscription is not a single protocol, and one server’s password should not be copied to other entries.

Why won’t a webpage open even though Connectivity Test returned a result?

The result reflects only that test; it doesn’t guarantee that every destination is reachable. First confirm the selected entry under SERVER, then check Global Routing and the policy matched in Config. If only a specific domain fails, check DNS, rules, and the destination service’s status rather than rebuilding every server.

Can I send someone my full configuration when troubleshooting?

First remove tokens from subscription URLs, along with Password, UUID, Private Key, and any other authentication details. Share the Type, network conditions, error, and fields you’ve checked. If you need help from your service provider, submit only the necessary details through its official support channel; don’t share complete connection information publicly.

Final checks: Distinguish the client from the connection service

Shadowrocket is a paid client for Apple platforms, primarily used on iPhone and iPad. Compatibility with Mac, Apple TV, and Apple Vision, system requirements, and general purchase terms are as listed on the App Store page. The app is sold as a one-time purchase and is available from the App Store. Buying the app does not include a connection plan; get connection details and subscription information from your service provider.

Know the protocol name: In Add Server, check Type rather than relying on the display name.
Already imported a server: Check that the address, port, authentication, TLS, and transport settings match as a set.
Already turned on the connection: Continue with Connectivity Test and a real destination, and confirm which policy Global Routing actually applies.
About to change settings: Record the original configuration, change one set of parameters at a time, and keep a working version for comparison.