Shadowrocket Link Formats: ss://, vmess://, vless://, trojan:// and Subscription URLs

1. Single-server share links vs. subscription URLs

A single-server share link describes one connection entry, usually including the protocol, server address, port, and authentication details. A subscription URL is an endpoint for retrieving configuration data: Shadowrocket requests the URL and parses the response into one or more entries. So copying an ss:// link and saving a subscription URL are different actions, with different import targets and update behavior.

An https:// prefix alone does not identify a subscription. Ordinary webpages, account pages, and subscription endpoints can all use HTTPS. Only use a subscription URL explicitly provided by your service provider, with a response format the client can parse, for importing via Subscribe. A subscription response does not have to contain multiple entries; even a single-entry response can retain remote update support.

2. Understand the common link structure

Most URI-style share links can be broken into a scheme, authentication details, host and port, query parameters, and a remark. These components mean different things across protocols, so a username field in one protocol is not necessarily a password field in another. The Trojan example below illustrates the structure; both the password and address are fictitious.

trojan://[email protected]:443?security=tls&sni=example.com#Demo-Trojan

• trojan://: the scheme, which identifies the link format.
• demo-password: the authentication password. Special characters must be percent-encoded according to URI rules.
• example.com:443: the server address and port. Port 443 is used for this example only; it is not required for every protocol.
• ?security=tls&sni=example.com: query parameters. Whether specific fields are recognized depends on the import format and client support.
• #Demo-Trojan: a remark, usually shown as the display name. It is not part of the server address.

Percent encoding and Base64 are different things. For example, a space in a remark can be written as %20; Base64 converts a sequence of bytes into transferable text. Neither encrypts credentials. Share links, QR codes, and subscription URLs may expose access credentials. Avoid posting them in public comments or pasting them into online decoding tools from unknown sources.

3. ss://: Identify the cipher and what is encoded

A common Shadowsocks SIP002 share-link format is ss://userinfo@host:port#remark. For common AEAD configurations, userinfo is usually a URL-safe Base64 encoding of method:password. Decoding the encoded section below gives aes-128-gcm:demo-password.

ss://[email protected]:8388#Demo-SS

Decoded authentication fields:
aes-128-gcm:demo-password

Server: example.com
Port: 8388
Cipher: aes-128-gcm
Password: demo-password

You may also encounter older links that encode the entire method:password@host:port string. These formats cannot be parsed by simply taking a fixed number of characters from the start. Base64 padding at the end, =, may be omitted, and URL-safe Base64 may use - and _. Missing padding alone does not mean a link is broken.

• After importing, verify both the cipher and password. The connection may not work as expected if the cipher is wrong, even when the password is correct.
• If a link includes a plugin parameter, check whether the required plugin and its parameters are supported. Do not simply remove them and assume the resulting configuration is equivalent.
• Do not apply Shadowsocks cipher settings to VLESS or Trojan; the protocol fields mean different things.

4. vmess://: Base64 outside, JSON inside

A common VMess share-link format puts Base64-encoded JSON after vmess://. Not seeing @host:port in the link does not mean the address is missing; the address and port are in JSON fields. The example below shows decoded content in one common format, not a complete URI ready to paste for import.

{
  "v": "2",
  "ps": "Demo-VMess",
  "add": "example.com",
  "port": "443",
  "id": "00000000-0000-4000-8000-000000000000",
  "aid": "0",
  "scy": "auto",
  "net": "ws",
  "type": "none",
  "host": "example.com",
  "path": "/demo",
  "tls": "tls",
  "sni": "example.com"
}

In this example, add is the server address, id is an obviously fictitious UUID, net indicates WebSocket transport, and path is the WebSocket path. host and sni may be used for HTTP Host and TLS SNI respectively; neither is necessarily the server address. The v field describes this share-link structure, not the Shadowrocket app version.

• First make sure the Base64 data is complete, then check that it decodes to valid JSON. Decodability alone is not enough.
• Matching addresses and ports do not mean two configurations are identical. UUID, transport type, path, TLS, and SNI can all affect the connection.
• Do not casually add or remove JSON quotes or commas, or let line breaks or non-ASCII punctuation from a messaging app get mixed into the original link.

5. vless:// and trojan://: Similar structure, different credentials

These two share links often use a readable URI structure. VLESS usually puts a UUID before @, while Trojan puts a password there. Both can include transport and TLS parameters, but changing the prefix alone does not convert one protocol into the other.

vless://[email protected]:443?encryption=none&security=tls&type=ws&host=example.com&path=%2Fdemo&sni=example.com#Demo-VLESS

trojan://[email protected]:443?security=tls&sni=example.com#Demo-Trojan

VLESS encryption=none does not mean the entire connection has no TLS. It is a different layer from security=tls. A port of 443 also does not guarantee a valid certificate: the certificate, SNI, and actual server configuration must match. If validation fails, check the existing configuration; disabling certificate verification should not be a routine fix.

The four prefixes in this article are not a complete list of protocols. Hysteria2, WireGuard, and others have their own parameter models and import requirements; do not mechanically apply the field tables here. Share formats may also have extensions, even within the same protocol. A successfully parsed entry only confirms that import completed, not that every parameter matches the server.

6. Import and update on iPad and iPhone

In Shadowrocket, Home shows connection status and server entries, Config manages configuration files, and Settings contains app settings. Do not enter a subscription URL as a server domain or identify a Config file by its extension alone. First determine whether you have a single link, a subscription endpoint, or a complete configuration, then choose the appropriate import method.

1. Check the app

   Get Shadowrocket from the App Store and verify the developer is Shadow Launch Technology Limited. The app is a closed-source commercial product sold as a one-time purchase; buying the client does not include a connection plan. For iPhone and iPad system requirements, refer to the App Store listing.

2. Import a single link

   Copy the complete share link you already have, then return to Home. If a clipboard import prompt appears, review the details and add the entry. If no prompt appears, tap “+” in the upper-right corner of Home, choose the appropriate Type, and enter the original settings field by field. Do not paste the entire URI into the server address field.

3. Add a subscription

   On Home, tap “+” in the upper-right corner → Type → Subscribe. Paste your subscription URL into URL and save. The example https://example.com/sub?token=xxxx is for illustrating the structure only.

4. Check for updates

   Return to Home and pull down to refresh the subscription, then check whether its group has entries. An update may add, remove, or change entries. Make a separate record of any manually configured entries you need to keep before updating.

5. Test the connection

   Select an existing entry. When connecting, allow the VPN configuration if prompted by the system, then use Home → Connectivity Test. Also check Home → Global Routing; Direct does not automatically become Proxy or Config just because a node was imported.

Subscriptions primarily handle retrieving and syncing entries; they do not create a complete rule-based routing setup. When using Global Routing → Config, also check which configuration is active in Config and which policies it targets. DOMAIN-SUFFIX, GEOIP, IP-CIDR, and FINAL are rule keywords, not node-sharing protocols. A successful subscription update does not prove that rules are matching as expected.

7. What to check when importing, updating, or connecting fails

Troubleshoot by stage: if a format error appears before saving, check the link text first; if a subscription request fails, check the endpoint and network path; if an entry appears but cannot connect, check authentication, transport, and routing. Treating these as one problem can lead to repeated changes to settings that were already correct.