Shadowrocket Supported Protocols: Shadowsocks, VMess, VLESS, Trojan & Hysteria2

At a glance

Already have connection details from your provider? Find out which Type to select. This guide explains authentication, transport and TLS, then walks through Home → Add Server and troubleshooting. Shadowrocket supports multiple protocols, but changing Type alone won’t make a server use a different protocol. Check the details you already have rather than guessing based on protocol names or speed claims.

Which protocols are supported, and how do they differ?

Can you swap one protocol for another? No. Shadowsocks, VMess, VLESS, Trojan, HTTP, SOCKS5, WireGuard and Hysteria2 each use their own handshake and authentication methods. Check the protocol name provided by your service, then tap “+” in the top-right corner of Home, open Add Server and select the matching Type. Changing the client setting won’t work if the server doesn’t support that protocol.

Protocol	Key details to check	Common point of confusion
Shadowsocks	Address, Port, encryption method, Password	The encryption method must match the server
VMess	Address, Port, UUID, encryption options, transport settings	A correct UUID doesn’t guarantee the transport settings are right
VLESS	Address, Port, UUID, transport and security settings	Don’t copy all VMess settings across
Trojan	Address, Port, Password, TLS settings	Check Password and certificate validation separately
HTTP	Address, Port, optional account credentials	Proxy authentication doesn’t encrypt the connection
SOCKS5	Address, Port, optional account credentials	The protocol itself doesn’t encrypt the connection
WireGuard	Keys, interface address, peer endpoint, routing scope	Check the key pair and tunnel addresses together
Hysteria2	Address, Port, authentication details, TLS settings	Requires reachable UDP; don’t mix up its settings with Hysteria

Why doesn’t Add Server always show the same fields? Fields change based on Type and the options you enable. For example, enabling a transport may add Path or Host fields, while TLS-related options may require a server name. The table highlights what to check; it doesn’t mean every protocol uses the same form. Available options depend on what the app displays.

8 protocols

Protocols covered in this article; HTTP and SOCKS5 are counted separately

443

Examples of ports commonly used by TLS services, not defaults for every server

4 items

Global Routing：Proxy / Direct / Config / Scene

Bottom line: select the Type, then check its fields

Once you have the connection details, confirm the protocol name and server port, then enter the authentication, transport and TLS settings one by one. Don’t select Trojan just because the port is 443; a port number alone doesn’t identify the protocol.

What do you enter for Shadowsocks, VMess and VLESS?

Is a password enough for Shadowsocks? No. At a minimum, check Address, Port and the encryption method. The connection won’t work if the Password matches but the encryption method doesn’t. If your details include extra transport or obfuscation settings, enter those too; don’t use only the address and password.

Shadowsocks: Match the encryption method exactly; similarly named methods aren’t interchangeable. Enter only the hostname or IP in Address and the relevant number in Port. Don’t paste a full share link into Address.
VMess: UUID is the main authentication detail. Also check the encryption option and transport. If the original configuration includes compatibility settings such as AlterID, keep the supplied values rather than changing them to match a generic tutorial.
VLESS: It also uses a UUID, but it isn’t just VMess with a different name. VLESS doesn’t encrypt payloads by itself, so configure the security layer required by the server. Don’t copy VMess encryption settings over.

Why won’t a page load even though the UUID matches? Authentication is only one part of the connection. If the server uses WebSocket but the client is set to a different transport, the handshake won’t complete as expected. Check the selected transport, then verify Path and Host. Don’t remove slashes or change the Path, and remember that Host doesn’t have to match Address.

How do you check TLS settings for Trojan and Hysteria2?

Does Trojan only need a Password? No. Check the server address, port and TLS settings too. Trojan usually carries the connection over TLS, and a correct authentication password doesn’t replace certificate validation. If Address is an IP but the certificate is for a domain, enter the server name provided with your configuration. Disabling certificate validation isn’t a routine fix.

How does Hysteria2 differ from Trojan? Hysteria2 is based on QUIC and relies on UDP. Common Trojan connections use TCP and TLS. Both may involve certificates and authentication, but their settings aren’t interchangeable. If UDP is restricted, the port is closed or the server can’t be reached, Hysteria2 may time out; that doesn’t necessarily mean the authentication password is wrong.

First check that Type is Hysteria2, not the similarly named Hysteria. They’re not interchangeable protocol versions.
Check Port against the port the server actually listens on. Even if it’s 443, make sure UDP traffic can reach it.
Check the authentication details, TLS server name and certificate requirements. If the server uses obfuscation, verify its type and password too.
Enter bandwidth limits and other optional settings according to your service configuration. Don’t substitute an arbitrary high value for a network test.

Will switching to Hysteria2 make the connection faster? You can’t tell from the protocol name alone. Server load, network latency, packet loss and UDP restrictions all affect performance. For a fair comparison, use the same website, device and network conditions. Confirm the connection works, then compare how long the page takes to load; a single latency reading doesn’t measure throughput.

How do HTTP, SOCKS5 and WireGuard differ?

Do HTTP and SOCKS5 also require a UUID? Usually not. Common fields include Address, Port and, if required by the server, a username and password. Don’t add credentials if account authentication isn’t enabled. If the server requires a proxy connection protected by TLS, choose the matching Type or security settings.

Item	HTTP / SOCKS5	WireGuard
Authentication details	May include Username and Password	Local private key and peer public key; a preshared key may also be required
Connection endpoint	Proxy address and port	Peer address and UDP port
Address details	A tunnel interface address usually isn’t required	Check the assigned interface address and prefix
Also check	Authentication requirements, TLS support, UDP support	Settings such as Allowed IPs, DNS and MTU

Why can’t you configure WireGuard with just an address and password? It uses key-based authentication and requires tunnel addresses and routes. Your Private Key must correspond to the client public key registered with the server; the peer’s Public Key identifies the server. Don’t swap them. The interface address, Allowed IPs and endpoint each serve different purposes. The server’s public IP isn’t your tunnel address.

What’s the right order, from Add Server to testing the connection?

Should you enter details manually or import a subscription? If you already have a complete subscription, keep its protocol, transport and security settings intact. Use Add Server to enter details manually only when your provider has given you specific connection details for one server, or when you need to check a field. These steps assume you already have your own service details and don’t recommend any services.

Check your connection details

Start with the protocol, address, port and authentication details you already have. Don’t paste sensitive information into public forums. If you only have a subscription link, don’t enter it as a single server address.
Select Type

Go to Home → tap “+” in the top-right corner → Add Server → Type, then select the protocol that matches the server. Enter Address, Port and the required authentication details.
Complete the settings

Use your existing details to fill in transport, Host, Path, TLS and other relevant options. Only enter settings required by the selected protocol. Save the server, return to Home and select it.
Test the connection

Run Connectivity Test from Home, turn on the connection, then visit a website you know is reachable. The first time you connect, follow the system prompt to add a VPN configuration. Also check Global Routing so it isn’t set to Direct when you’re trying to test the proxy.

Where do you enter a subscription? From Home, tap “+” in the top-right corner to open Add Server, set Type to Subscribe, enter your subscription link and save. Return to Home and update that subscription. After updating, check which server is selected. A successful import doesn’t mean every connection in the list has passed a real-world access test.

Will updating a subscription fix every problem? No. An update refreshes entries with the data returned by the subscription; it can’t fix network restrictions or an unavailable server. If you edited a subscription entry manually, check its fields again after updating. Also check traffic rules in Config separately: refreshing the server list doesn’t necessarily sync the rules.

Why can Global Routing affect the result even when the protocol is correct?

Does selecting a server route all traffic through it? Not necessarily. The protocol determines how the client communicates with the server; Global Routing determines how connections are routed. When troubleshooting a protocol, first make sure the test request is assigned to a proxy policy. A page loading under Direct doesn’t prove the server settings are correct.

Config

Recommended

Choose a policy based on the active configuration and rules. First confirm that Config has the intended configuration enabled, then check whether the destination matches DIRECT or a proxy policy. Requests that don’t match aren’t necessarily sent direct.

Best for: Everyday use with rules you can check and traffic routed by destination

Proxy

Routes affected requests through the proxy path. You can use it temporarily to reduce interference from traffic-splitting rules while testing. If the connection still fails, check the server, authentication, transport and DNS. Don’t treat this as a reason to disable certificate validation.

Best for: Briefly testing the server connection and separating rule issues from connection issues

Direct

Uses a direct connection path, so it can’t show whether a proxy protocol works. After comparing results, restore the previous routing mode so the conditions for your next test don’t change.

Best for: Checking whether direct access works on the current network

Are Scene and On Demand protocols? No. Scene in Global Routing applies routing choices according to the configured scene. Settings → On Demand controls when connections are triggered automatically; neither setting can supply missing authentication or TLS details. Keep track of these settings while troubleshooting so automatic connections or scene changes don’t alter your test conditions.

Bottom line: change one variable at a time

Keep the server and network unchanged. Confirm the connection under Proxy, then restore Config and check the rules. Rules are evaluated in order: DOMAIN-SUFFIX matches domain suffixes, GEOIP and IP-CIDR match IP conditions, and FINAL handles requests not matched by earlier rules. Don’t rewrite the entire ruleset just to test one UUID.

Common issues: missing fields, timeouts and pages that won’t load

What should you change first when an error occurs? Start by identifying where it happens. If the form won’t save, check the required fields. A test timeout may involve the address, port, network or server. If some pages fail after connecting, check DNS and rules as well. This order is more likely to pinpoint the cause than switching protocols repeatedly.

Can you connect with only a UUID and no other details?

No. Go back to your service details and get the Address, Port, protocol, transport and required security settings, then check them in Home → Add Server. A UUID doesn’t include the full endpoint details or tell you whether to choose VMess or VLESS.

Does a Connectivity Test timeout mean the password is wrong?

Not necessarily. First check the selected server’s Address and Port on Home, then confirm the network allows the required TCP or UDP traffic. A test result reflects only that test path; it doesn’t replace checks for authentication, DNS or website access.

Why won’t a webpage load when the switch shows connected?

A VPN connection status in the system doesn’t guarantee that the remote service is working. First check that Home → Global Routing matches your test goal, then verify server authentication, transport and TLS. If only some domains fail, check DNS settings and the relevant rules in Config.

Hysteria2 works on Wi-Fi but times out on cellular. What should you do?

Keep the same server entry and test it on both networks to see whether the problem occurs only on one. Then check whether the UDP port is reachable and whether the server is available. Don’t change Type to Trojan unless your server is actually configured for Trojan too.

Why do you still need connection details after buying Shadowrocket?

Buying the app doesn’t include a network service subscription. Shadowrocket is a closed-source commercial app, and a connection requires service details you already have. Check the App Store product page for the developer, Shadow Launch Technology Limited, and app ID 932747118. Device compatibility and system requirements are as listed on the App Store page.