Shadowrocket for Mac and Windows: Choose the Right Version and Open It for the First Time

At a glance

This guide is for users installing Shadowrocket on a Mac or Windows PC. First, check your device architecture and get the installer from this site. Then distinguish system reputation notices from explicit security warnings and network permission requests. After installation, use an existing configuration to check Global Routing and connection status. Seeing “Installed” doesn’t mean a connection is ready to use, and you shouldn’t disable system security features just to open the app for the first time.

1. Check the platform, chip, and download source

The Mac version of Shadowrocket is available for Apple silicon and Intel Macs. Your chip determines which installer to download; don’t rely on your Mac’s appearance, purchase year, or screen size. Windows users should check their system type and follow the compatibility information shown on the download page. Don’t use a Mac DMG on Windows.

Mac: Open the Apple menu → “About This Mac.” If it lists “Chip” and names an Apple chip, choose the Apple silicon version. If it lists “Processor” and says Intel, choose the Intel version.
Windows: Go to “Settings” → “System” → “About” and check “System type.” If your device is ARM-based, don’t assume every desktop installer is compatible; check the download page first.
Get the installer: Visit the downloads page for all platforms and select your platform. The two Mac chip options link to different installers. Keep the original filename after downloading so you can tell them apart.
Check the source: Desktop installers are provided on this site under /dl/shadowrocket/. If a file came from a chat attachment, an unfamiliar site after a redirect, or an old backup with an unknown source, don’t open it. Return to the downloads page and get a fresh copy.

2. Install on Mac: Copy to Applications, then open the app

A DMG is a disk image. Double-clicking it mounts a volume in Finder. Mounting the image lets you view its files; it doesn’t install the app on your computer. If you keep launching the app from the image, you may lose track of it after ejecting the volume.

In Finder, open Downloads, locate the DMG you just downloaded, double-click it to mount the image, then open it.
Drag Shadowrocket into Applications. If the disk image includes an Applications shortcut, drag the app there. Otherwise, drag it to Applications in the Finder sidebar.
Wait for the copy to finish. If macOS asks whether to replace an app with the same name, make sure you’ve backed up your existing configuration and quit Shadowrocket before deciding whether to replace it.
Open Shadowrocket from Applications. Once you’ve confirmed the copy is complete, eject the disk image in Finder. Launch the app from Applications from now on.

If you see a warning the first time you launch the app saying the developer can’t be verified or the app can’t be checked for malware, read the full message first. macOS wording varies by version. A message that the developer’s identity can’t be verified is not the same as an explicit warning that the app will harm your computer.

Opening Shadowrocket on Mac for the first time: Two types of warnings

Developer identity or reputation not confirmed

Make sure the file came from this site and that you chose the correct version for your chip.
Try opening the app once, then go to “System Settings” → “Privacy & Security.”
If the page offers “Open Anyway” for the app, verify its name, click the option, then follow the prompts to authenticate and confirm that you want to open it.
On some systems, you can Control-click the app in Finder and choose “Open.” If that option isn’t available, follow the actions your system provides.

Explicit risk warning or problem with the file

If macOS says the app “will damage your computer” or gives a similar risk warning, stop. Don’t try to force it to launch.
If the app appears damaged, the disk image won’t mount, or copying was interrupted, delete the faulty download and get a fresh copy from this site.
If the warning appears again after downloading a fresh copy, keep the exact warning text and check this site’s information page for ways to report the issue.
If your organization manages your Mac and blocks the app from opening, ask your administrator to review it. Don’t change the management policy.

Only take these steps for an individual app whose source you’ve verified. Don’t disable Gatekeeper or run commands to remove quarantine attributes in bulk.

3. Install on Windows: Tell SmartScreen notices apart from malware alerts

Windows SmartScreen uses download reputation information to show warnings. “Windows protected your PC” doesn’t mean the app has been identified as malware, but that message alone isn’t enough reason to proceed. First confirm where you downloaded the file, then check the app name and publisher shown in the warning.

Get the Windows installer that matches your system from this site’s downloads page. Wait for the browser to finish downloading the file before opening it.
Run the installer. If User Account Control appears, check the program name and publisher. Allow changes only after confirming it’s the installer you just opened intentionally.
If SmartScreen says “Windows protected your PC,” select “More info” and review the details. Use “Run anyway” only if the source and file match and there’s no explicit malware alert.
Complete the setup wizard, then launch the app from the Start menu or the shortcut it created. Don’t keep rerunning the installer instead of opening the app.

If “Run anyway” isn’t available, an organization policy or a different kind of block may be involved. Record the full message and ask your administrator to review it. If Windows Security explicitly reports a threat, don’t disable real-time protection, exclude the entire Downloads folder, or repeatedly restore quarantined files.

SmartScreen reputation notice: Check “More info” first to decide whether it’s safe to proceed with this individual file.
Windows Security threat alert: Stop. Keep the detection name and information about where the file came from.
“This app can’t run on your PC”: Check your system type in “About” and compare it with the compatibility information on the downloads page. Don’t keep looking for a way to bypass the warning.

4. After the first launch: Check your configuration before choosing Global Routing

A successful launch confirms only that installation and startup worked. To connect, you’ll need your own service provider and subscription, or server details you manage yourself. This site doesn’t provide, sell, or recommend nodes or subscriptions. Back up existing configurations before importing anything, and never include subscription-link tokens in screenshots or public reports.

First, confirm your regular internet connection works. Then open Home and add your existing connection details. If you already have a subscription, import it using the option in the app and check the server address, port, and protocol fields.
In Config, check that the selected configuration is the one you intend to use, and that any policies referenced by its rules exist. Protocol, authentication, TLS, and transport settings should match your existing server configuration.
Check the current Global Routing option. When troubleshooting, change one variable at a time; don’t change the subscription, protocol, DNS, and routing mode all at once.
The first time you connect, the system may ask to add a VPN configuration or grant another network permission. Confirm the request comes from the app you’re using before authorizing it. This is separate from allowing the app to open during installation.

Config: Follow the current rules

Recommended

Uses the rules and policies in your current configuration to determine where connections go. A matching rule applies its associated action; if no rule matches, a later rule or FINAL determines what happens. It doesn’t simply mean that everything else goes direct.

Best for: Routing by domain or destination address with a verified configuration you already have.

Proxy: Temporarily check the proxy path

Routes connections handled by the app through the proxy mode, so you can compare the result with Config. It doesn’t guarantee that every type of traffic from every program on your computer will be routed through the app.

Best for: Checking whether a routing rule is causing an issue, using a proxy you already know works.

Direct: Check the direct connection

Routes connections handled by the app directly. If a destination works after switching to Direct, that only shows it was reachable directly on your network at that time; it doesn’t prove your proxy settings are correct.

Best for: Comparing direct access with the proxy path to distinguish a local network issue from a proxy issue.

In short: If the app opens but won’t connect, don’t reinstall it

If the app opens normally and isn’t blocked by the system, keep the installation and check the address, port, authentication details, and Global Routing for your existing connection. If Proxy works but Config doesn’t, check rule matches and policy references next instead of trying to allow the installer again.

5. Common warnings and post-install checks

When reporting an issue, include at least the platform, chip or system type, whether the failure happened during installation or connection, and the complete warning text. “It won’t open” doesn’t distinguish between a mismatched file architecture, a system block, missing permission, or a connection timeout. Follow the steps below to avoid unnecessary changes.

The download finished on my Mac, so why isn’t “Open Anyway” showing up?

First try launching the app from Applications, then check “System Settings” → “Privacy & Security.” If the option still isn’t there, determine whether the warning says the app is damaged or identifies an explicit risk. On managed devices, also check for organization restrictions. Don’t disable system security checks just to make the button appear.

Windows says the app is incompatible after I open it. Should I try again as an administrator?

First go to “Settings” → “System” → “About” and check your system type. Then compare it with the compatibility information on the downloads page. Administrator privileges can’t make an app built for a different architecture compatible. Follow the prompt only when the installer or system explicitly requests the required permission.

Home is visible. Why can’t I connect?

Check the selected connection and its address, port, authentication, and protocol settings, then review Global Routing. If the app offers a connection test, use its results and logs to identify where the failure occurs. A successful latency test doesn’t mean the destination website, DNS, or every type of protocol traffic is working.

I turned off the connection, but it reconnected automatically. Is installation incomplete?

This is more likely related to automatic connection settings than an incomplete installation. If your platform has Settings → On Demand, check the relevant trigger rules and temporarily disable them before testing again. If that option isn’t shown on desktop, check the automatic connection settings and system VPN policies available in your current interface. Don’t follow menu paths for another platform.

6. Installation completion checklist

Record app launch and network connectivity as separate checks. For launch, confirm the system loads the app normally. For connectivity, check that your existing configuration works as expected. Before reinstalling, make sure the problem really occurs during startup so you don’t overwrite an existing configuration and leave the connection issue unresolved.

App location: On Mac, launch from Applications rather than from a mounted DMG. On Windows, use the installed app entry instead of repeatedly running the installer from Downloads.
System status: No unresolved explicit risk warnings, and system-wide security protection hasn’t been disabled to run the app.
Configuration status: The correct existing connection is selected, Config uses the intended configuration, and subscription updates haven’t overwritten unbacked-up manual changes.
Connection status: Test a known destination first, then restore your usual Global Routing setting. Note the differences between Direct, Proxy, and Config to help troubleshoot later.
Ready to recover: Keep a backup of necessary configurations. When reporting an issue, redact passwords, private keys, and subscription tokens, and share only the details needed to diagnose it.