Shadowrocket Android APK Install Guide: Download, Allow Unknown Apps, and Fix WeChat Download Issues

At a glance

This guide is for anyone installing Shadowrocket on an Android phone or tablet. The process: open our download page in your system browser, download the Android APK, temporarily allow the app that will open the file to install unknown apps, then approve the VPN permission when you connect for the first time. WeChat download failures, file parsing errors, and connection problems occur at different stages and should be troubleshot separately.

1. Find the Android download and check your device

Start from the Shadowrocket download page. Go to the Android section and use its download button. Don’t use a file intended for another platform, and don’t rely on the filename alone to verify where it came from. Downloads from this site use the /dl/shadowrocket/ path. This guide doesn’t link directly to the APK; check the download page for currently available packages.

There are two ways to get Shadowrocket: the iPhone / iPad version is available from the App Store for a one-time payment of $2.99, published by Shadow Launch Technology Limited. Check the App Store listing for system requirements. Versions for Mac (Apple silicon / Intel), Windows, Android, and Linux are free. Android users don’t need to follow the iPhone / iPad purchase process.

Check your device: Open “About phone” or “About tablet” in system settings and compare your device with the requirements on the download page. Don’t infer the package architecture from the processor brand alone.
Check available storage: Installation requires space to save and unpack the APK, not just enough room for the download. If you see a storage warning, free up space before trying again.
Check your connection: First, open our download page in your system browser. A page that won’t load and an installer error are different problems; there’s no need to change app settings before the download finishes.
Know what you’ll need: To connect, you’ll need your own service provider and subscription. Installing the client doesn’t configure a connection. This site does not provide, sell, or recommend servers or subscriptions.

2. Download and install the APK in five steps

These steps describe a typical Android installation. Menu names and locations vary by device, so follow the authorization prompt shown by your system. These are system settings, not Shadowrocket’s Settings; you don’t need to look for an in-app switch before installing.

Open the download page

Visit our download page in your system browser and find the Android section. If you’re using WeChat’s built-in browser, switch to your system browser first as described below, then tap the download button.
Wait for the download to finish

After starting the download, check its progress in the browser’s downloads list. Open the APK only when the download is complete. Don’t rename a partial download to .apk and try to install it.
Allow this source

If you open the APK and the system says this source isn’t allowed to install apps, tap “Settings” in the prompt. Go to “Install unknown apps” and enable “Allow from this source” for the browser or file manager listed there.
Return to the installer

Return to the installer and tap “Install.” Wait for the process to finish. If the installer has closed, reopen the file from the browser’s download history or the system Downloads folder.
Turn off source permission

Once the app is installed, return to the source permission screen and turn off the permission you enabled temporarily. This won’t affect the installed app. You can enable it again when needed for a future update.

“Allow unknown apps” is a permission granted to a specific source app, not a permanent pass for an APK file. For example, opening the file directly in a browser may prompt you to authorize that browser; opening it from a file manager may instead require authorization for the file manager. Check the app named in the prompt rather than enabling the permission for every source.

3. Handle install permission and VPN permission separately

The source permission used during installation determines whether an app can start an installation. The VPN permission requested when you connect for the first time allows Shadowrocket to create a system VPN interface. These permissions serve different purposes: granting the first doesn’t grant the second, and denying the second doesn’t mean the APK failed to install.

Install source permission

Common location: System settings → Apps → Special app access → Install unknown apps
App to authorize: The browser or file manager used to open the APK
When to grant it: After opening the APK, if the system installer blocks it
After installation: Turn off the source permission you enabled temporarily

Menu names vary by system. You can also search system settings for “Install unknown apps.”

System VPN permission

When it appears: The first time you turn on the connection from Home after configuring it
App to authorize: The system VPN connection request initiated by Shadowrocket
What to check: Verify the app name in the request, then confirm the system dialog
Check for conflicts: Stop any other connection currently using the system VPN first

The VPN icon indicates that a system interface has been established; it doesn’t guarantee that a server in your subscription is available.

If your device is managed by an employer or school, device policies may restrict installation permissions, and you might not be able to change them in personal settings. Contact your device administrator instead of disabling device management or security features to force an installation. If the system explicitly reports a risk or blocks installation, stop and check the download source and the warning.

4. Switch to your system browser if WeChat blocks the download

WeChat’s built-in browser and your system browser use different download environments. If tapping the button does nothing, leaves you on the page, or blocks the download, the problem may occur before the file request reaches the system download manager. You don’t need to change Shadowrocket’s configuration or repeatedly tap the button and create multiple download tasks.

With our page open in WeChat, tap the menu in the upper-right corner and look for “Open in browser” or a similar option. The wording may vary by device and WeChat version.
If that option isn’t available, choose “Copy link” from the menu. Open your system browser, paste the URL into the address bar, and visit it. Don’t paste it into a search box and open an arbitrary search result.
Check that the address bar shows shadowrockethub.com, then go to the Android section of the download page and tap the download button.
Check the system browser’s downloads list for the download task. Once it’s complete, open the APK from that list and continue with the source permission steps.

When copying the link, copy the page URL—not the title shown in a chat or a forwarded description. If the system browser opens the page but the download fails, check whether the network requires you to sign in and whether the device is out of storage, then start a new download from the download page. Don’t keep opening an older failed file.

5. After installation, check Home and Global Routing

Open Shadowrocket and add your own connection details from Home. To use a subscription, tap “+” in the upper-right corner of Home to open Add Server, select Subscribe under Type, enter your full subscription URL, and save. Check that the entries load in the list. Controls may appear in different places on different platforms; follow the fields shown on your screen. If you already have a working configuration, don’t delete it just to test the installation.

Next, check Global Routing on Home. A successful installation and suitable routing settings are separate matters: if the app opens, installation is complete. If a website won’t load, check the current routing mode, configuration rules, and server status. The comparisons below cover Shadowrocket’s own settings; switching modes isn’t a universal fix for network problems.

Config

Recommended

Matches traffic against the rules in the selected configuration. Matching traffic uses the policy specified by the rule; traffic that doesn’t match earlier rules is handled by fallback settings such as FINAL. Traffic that doesn’t match isn’t necessarily sent DIRECT.

Best for: everyday routing after verifying the configuration

Proxy

Routes traffic handled by the client through the current proxy policy, rather than selecting DIRECT according to the usual rules in Config. It won’t restore a broken subscription or fix incorrect server settings.

Best for: briefly checking whether routing rules are involved

Direct

Connects traffic handled by the client directly to its destination without forwarding it through a proxy server. If a resource won’t load in Direct mode, that doesn’t indicate an APK installation problem.

Best for: checking the device’s direct network connection

First confirm that Home lists your own server entry, then select the one you want to use. An empty list isn’t caused by the install source permission.
Turn on the connection and approve the system VPN request. Check for any explicit error message.
Compare the same webpage before and after switching modes. Change one setting at a time, note its original value, and restore the original configuration after testing.
To check rules, open Config. Don’t enter DOMAIN-SUFFIX, GEOIP, IP-CIDR, or FINAL in Add Server as if they were server addresses.

6. Common questions about Android installs and updates

Keep the exact error message and note whether the problem occurs during download, installation, or connection. Here are common symptoms and what to do. Don’t clear data, uninstall the app, and change network settings all at once before identifying the cause.

The file downloaded, but why does tapping it open a webpage?

Check the file type in your browser’s download history. If the saved file is a webpage or an error page, it isn’t an installable APK. Delete that failed download and get the file again from the Android section of our download page. Don’t just change the file extension.

The system says the package couldn’t be parsed. Should I just try installing again?

First confirm that the download is complete, then check the device requirements and package architecture on the download page. Delete any incomplete file and download it again once. If it still fails, keep the system message and check for compatibility restrictions. Don’t repeatedly try to install the same problematic file.

I allowed the browser to install apps, but the file manager still blocks it. Why?

Permissions are managed separately for each source app. If you open the APK from a file manager, check the source named in the system prompt and temporarily allow that file manager to install apps. Alternatively, open the file from the download history of the browser you already authorized. Turn off the temporary permission when you’re done.

An update says the app wasn’t installed. Should I uninstall it first?

First check available storage, package compatibility, and where the existing app came from. A signature mismatch or a system restriction against downgrading can also prevent an update. Don’t uninstall right away; keep your working configuration and make sure you can restore its backup before resolving the installation conflict.

It won’t connect after installation. Should I reinstall the APK?

First check the Home list, the selected server, Global Routing, and system VPN permission, then verify that your own subscription is active. If the app launches normally but won’t connect, troubleshoot the connection settings and network first. Reinstalling won’t add server details.

For future updates, return to the Android section of our download page. Use the system’s update installation process where possible, and keep your configuration safe before updating; don’t assume you can recover it after uninstalling. Before sharing an error screenshot, hide subscription URL tokens, account details, and server credentials. Leave the error message and the relevant step visible.