Shadowrocket Share Link Formats: ss://, vmess://, vless:// and trojan:// vs. Subscription Links

First, distinguish share links, subscription URLs, and Config

ss://, vmess://, vless://, and trojan:// are schemes that identify connection data formats. A typical single-server share link contains the server address, authentication details, and transport parameters. Importing it creates a server record. The prefix tells the app how to interpret the contents; it does not indicate that the server is currently available or that routing rules are configured.

A subscription URL is usually an HTTPS address. Shadowrocket retrieves the subscription contents, such as a server list, when it requests that URL. A subscription may return multiple share links or a Base64-encoded list; whether Shadowrocket can parse it depends on the format provided by the service. An address starting with https:// is not necessarily a subscription URL.

For example, https://example.com/sub?token=xxxx is a placeholder subscription URL. Its query parameters may serve as access credentials, so protect them like a password. A single server link generally does not include rules such as DOMAIN-SUFFIX, GEOIP, or FINAL; those belong to a separate layer of configuration in Config.

ss://: How Shadowsocks authentication data is encoded

Shadowsocks share links commonly use one of two formats. In the older format, the encryption method, password, address, and port are Base64-encoded together. The SIP002 format typically encodes only the user information—method:password—using URL-safe Base64, leaving the server address and port readable. The two formats cannot be parsed by splitting at the same fixed position.

ss://BASE64URL(method:password)@server.example.com:8388#Office
ss://BASE64(method:[email protected]:8388)#Office

BASE64URL(...) and BASE64(...) above are notation for encoding steps, not strings you can import directly. 8388 is an example port, not a required default. The encryption method must match the server; do not substitute another method just because its name looks similar.

• The server address usually follows @. IPv6 literal addresses must be enclosed in square brackets before the port.
• #Office is a remark and is generally not used for authentication. Remarks containing non-ASCII characters may be percent-encoded.
• ?plugin= may specify plugin parameters; whether they work depends on the plugin and client support.
• Colons, slashes, and other special characters in a password must be interpreted in the context of the original encoding format. Do not split the string at every colon.

Base64 is an encoding, not encryption. Anyone with the complete share link can usually recover its authentication details. Using an unfamiliar online decoder to check the format sends credentials that may have existed only on your clipboard to another party. Check them locally when possible, and redact the password and full link before contacting your provider.

vmess://: Decode the JSON, then check its fields

A common VMess share link consists of vmess:// followed by a Base64-encoded JSON object. Details such as the address, port, UUID, and transport are stored in JSON fields rather than displayed as a regular URL host and query string. The example below shows decoded data for illustration; it is not a share link you can paste and import directly.

{
  "v": "2",
  "ps": "Example VMess",
  "add": "server.example.com",
  "port": "443",
  "id": "00000000-0000-4000-8000-000000000001",
  "aid": "0",
  "net": "ws",
  "type": "none",
  "host": "edge.example.com",
  "path": "/connect",
  "tls": "tls",
  "sni": "edge.example.com"
}

• add and port specify the connection endpoint; id is the authentication UUID. The UUID shown is fictitious.
• When net is set to ws, check the WebSocket host and path as well.
• tls and sni describe TLS settings. Port 443 alone does not mean TLS is enabled.
• aid is the AlterId field in legacy formats, not a port or connection count. Do not replace the value provided by your service with a guess.

In the example, "v": "2" is a field in the share link format, not the Shadowrocket app version. Different sources may omit fields or use different export conventions. If a link imports with a recognizable name but fails to connect, compare the imported fields—especially transport, TLS, and path—instead of checking only the UUID.

vless:// and trojan://: Similar URL formats, different authentication

Common VLESS share links use a UUID as the user information, while common Trojan links use a password. Both may carry transport and TLS settings in query parameters. Similar-looking links are not interchangeable: do not swap their prefixes, and remember that parameter names may vary between export formats.

vless://[email protected]:443?encryption=none&security=tls&type=ws&host=edge.example.com&path=%2Fconnect&sni=edge.example.com#Example
trojan://[email protected]:443?security=tls&sni=edge.example.com#Example

path=%2Fconnect decodes to /connect. If a password contains @, #, or ?, those characters must be percent-encoded correctly; otherwise, the parser may mistake part of the password for an address, remark, or query parameter. Use the complete link generated by your provider rather than reassembling it manually in a messaging app.

In VLESS, encryption=none describes a protocol-level field; it does not mean the entire connection is necessarily unencrypted. Check the transport security settings separately to see whether TLS is enabled. Trojan typically relies on TLS. If certificate validation fails, first check the device time, SNI, and certificate settings; disabling validation should not be a routine import step.

Importing into Shadowrocket: Choose the option that matches your details

First determine whether you have a complete share link, a QR code, or a Subscribe URL from your provider. A share link is suitable for importing one specific server; to keep a server list in sync, preserve the subscription. The options below describe ways to import data into Shadowrocket, not the quality of any connection.

Steps for importing a single share link

1. Get the complete link from your provider. When copying it, do not include quotation marks, bullets, or explanatory text.
2. Open Shadowrocket and tap the clipboard detection prompt in Home to add the link. If iOS asks for paste permission, confirm that this is the information you just copied yourself.
3. If no detection prompt appears, scan a QR code from your provider, or go to Home → + and enter the original parameters manually by Type.
4. Open the imported record and check Type, address, port, authentication fields, TLS, SNI, and transport settings. Then save and select the record.

Steps for adding a subscription URL

1. Go to Home → + and choose Subscribe under Type.
2. Enter the complete subscription URL in URL, add a remark if needed, and save. Do not enter it as the address of a regular server.
3. Wait for the subscription to finish fetching, then check its server records in Home. To sync changes, update the relevant subscription.
4. After the update, check the currently selected record again. If your provider removed or replaced a record, you may need to change your selection.

After importing, check parsing, connectivity, and rules separately

“Import successful” means the app converted the text into a record. It does not mean the server is reachable, authentication succeeded, or every site will be routed as expected. Troubleshoot each layer separately so you do not mistake routing behavior for a bad share link or change several fields after a single connection failure.

1. Check the parsed result: Make sure Type matches the link prefix, the address has no trailing spaces, the port is present, and the remark was not entered as an authentication field.
2. Check connection settings: Compare the password or UUID, TLS, SNI, Host, and path with the details from your provider. A timeout, authentication failure, and certificate error are different issues; changing the port is not a universal fix.
3. Check Global Routing: Direct connects directly; Proxy uses proxy routing; Config follows the active configuration rules; and Scene follows the current scene settings. Identify which mode is active before troubleshooting.
4. Check Config: For example, DOMAIN-SUFFIX,example.com,DIRECT routes requests matching that rule through DIRECT. Selecting a server in Home does not change what that rule means.

Updating a subscription and connecting to a server are separate operations. A subscription can update successfully while one server is temporarily unavailable; a server can connect normally while an expired credential prevents the subscription URL from updating. First determine whether the failure occurred while fetching the list or using a record from it.

Common questions about share links and subscription imports