Shadowrocket for Mac and Windows: Installation, Apple Silicon vs. Intel, and First-Launch Security Prompts

At a glance

Before installing Shadowrocket on a computer, check the processor and choose the matching installer from this site’s download page. If a system warning appears, distinguish a reputation or developer-verification prompt from an explicit malware alert. This guide covers how to check Mac and Windows hardware, approve an app once when appropriate, import existing details, and review Global Routing after installation. It’s for first-time installs and reinstalling after choosing the wrong build.

1. Check your platform and processor before downloading

Shadowrocket for Mac comes in Apple Silicon and Intel versions. Don’t identify the right one by the computer’s appearance or purchase year alone. Open the Apple menu → About This Mac. If you see Chip and an Apple chip name, choose the Apple Silicon version. If you see Processor and Intel, choose the Intel version.

On Windows, open Settings → System → About and check System type. Processor architecture and Windows system type are not the same thing. If your device has an ARM-based processor, don’t assume an x64 package is a native ARM installer. Check the download page’s current compatibility notes, and stop if you can’t confirm the right package.

Check your Mac’s processor

Where to look: Apple menu → About This Mac
Chip shows Apple: Choose Mac Apple Silicon
Processor shows Intel: Choose Mac Intel
Where to download: Mac section on this site’s all-platform download page

Choose the installer that matches your processor. Don’t use translation software as a substitute for checking the architecture.

Check your Windows setup

Where to look: Settings → System → About
What to check: System type
Match the architecture: Choose a package based on the current compatibility notes on the download page
Managed devices: Ask your administrator to confirm installation permissions and organization policies

If you see “This app can’t run on your PC,” check compatibility first. That is not a SmartScreen prompt.

This is the official Shadowrocket website, and this page is part of the official handbook. Shadowrocket for iPhone and iPad costs $2.99 as a one-time App Store purchase. The developer is Shadow Launch Technology Limited; check the App Store page for system requirements. The Mac (Apple Silicon and Intel), Windows, Android, and Linux versions are free. Get the app from the download page for all platforms; desktop installers are available through this site’s download links.

2. Install on Mac: Copy the app before handling the first-launch prompt

Quit Shadowrocket if it’s running, then choose the build for your Mac’s processor on the download page. Once the download is complete, follow the instructions on the page and in the installer. If you open a disk image with an Applications shortcut, drag the app to Applications, then launch it from there. Don’t keep running the app from a temporary download location or disk image.

Check the processor

Open Apple menu → About This Mac, check Chip or Processor, and note whether you need the Apple Silicon or Intel version.
Download and install

Go to the Mac section of this site’s all-platform download page and choose the matching button. Wait for the download to finish, then follow the package instructions to install.
First launch

Open Shadowrocket from Applications. If macOS only says the app was downloaded from the internet, check the app name and download source before deciding whether to open it.
Check Security settings

If macOS says it can’t verify the developer and blocks the app, go to System Settings → Privacy & Security → Security and look for the blocked app entry.
Approve once

After confirming the source, click Open Anyway if macOS offers it, authenticate if prompted, and confirm. This applies only to the app in question; there’s no need to disable system-wide security checks.

Button locations and labels vary slightly between macOS versions. On older systems, look in System Preferences → Security & Privacy → General for the blocked app entry. It’s easier to find just after the app was blocked. If there’s no entry, try launching the app again and make sure you’re opening the copy in Applications.

3. Install on Windows: Identify the SmartScreen prompt before deciding whether to proceed

After downloading on Windows, confirm the file came from this site’s download page, not another download link in your browser. If opening it displays Microsoft Defender SmartScreen’s “Windows protected your PC” message, this may be a reputation check; it doesn’t mean the installer has passed a security review.

For a file whose source you’ve confirmed and that hasn’t triggered an explicit malware alert, select More info in the prompt and review the app details. If Run anyway appears, decide whether to continue. If organization policy hides the button or your device is managed by work or school, contact your administrator instead of changing Group Policy to bypass the restriction.

Prompt	What to check first	Next step
Windows protected your PC	Source, file name, and details under More info	Use Run anyway only after confirming the details; don’t disable SmartScreen
User Account Control	Whether the prompt followed the installation you just started and whether the app details match	Grant only the permissions needed for the expected installation; choose No if the details don’t match
This app can't run on your PC	System type under Settings → System → About	Check the package architecture and system requirements, then choose a compatible package
Windows Security reports a threat	Detection details in Protection history	Stop the installation. Don’t add an exclusion or restore the quarantined file.

SmartScreen and User Account Control are separate mechanisms. SmartScreen mainly checks app reputation and risk; User Account Control asks whether a program can make changes to your system. Passing the first prompt doesn’t mean you have to approve the second. Each confirmation during installation should match the action you’re taking. Don’t click through every approval prompt just to “get it installed.”

Don’t run a temporary file while your browser is still downloading it. If the download is interrupted, download it again from the original link.
Keep the installer’s suggested installation location unless you have a reason to change it. Avoid temporary folders that are routinely cleared.
If Windows is in S mode or subject to organization restrictions, check whether the system policy allows installation. Don’t try to bypass it.

4. First launch: Import existing details and check Global Routing

A successful installation means the app can launch; it doesn’t mean you have a working proxy connection. Buying the client does not include a service plan. This site does not provide, sell, or recommend proxy servers or subscriptions. The steps below assume you already have details from your own service provider, a subscription link, or a configuration file.

Open Home and check the server list. To import an existing subscription, go to Config → Subscribe, paste the link as prompted, and update. When it’s done, return to Home and check that the expected entries appear. To add a single server, use Add Server and choose the protocol that matches your existing details, such as Shadowsocks, VMess, VLESS, Trojan, Hysteria2, or WireGuard. Don’t change Type just to make the entry save.

Check that the subscription update succeeded, then review the server count and entry names. Don’t paste a subscription URL into the Address field for an individual server.
Select your own server and check its address, port, and authentication fields. Fill in fields such as TLS Server Name from your original details; don’t guess based on how a domain name looks.
If you already have a rules configuration, check the active configuration file under Config, then review Global Routing on Home.
When you turn on the connection, check that any system request to add a network or VPN configuration comes from the Shadowrocket you just installed, then approve it.
After connecting, run Connectivity Test and visit a destination you know should use a direct or proxy connection to check the routing result.

Proxy, Direct, Config, and Scene under Global Routing are routing modes, not four installation options. For your first test, keep the server and configuration fixed and change one setting at a time. Otherwise, you won’t know whether a change came from the server, rules, or an automatic switching condition.

Config: Route according to your configuration

Recommended

Connection handling follows the rules in the active configuration. Rules are typically matched from top to bottom; when a rule matches, its corresponding policy is applied. The final FINAL rule handles connections that didn’t match any earlier rule.

Best for: Everyday use after importing and checking your rules configuration.

Proxy: Proxy mode

Use the proxy policy for connections handled by the proxy. This can help isolate differences caused by rules, but it doesn’t mean every process on your computer is being routed through the proxy.

Best for: Briefly checking whether rules affect access after confirming the server works.

Direct: Direct mode

Use the direct policy for connections within the app’s handling scope. Even with the connection switched on, this doesn’t mean traffic is going through a proxy server.

Best for: Comparing with direct access on your local network to isolate proxy connection issues.

Scene switches policies based on configured scenes. Don’t use it as your first test baseline until you’ve checked the scene conditions. Settings → On Demand controls automatic connection conditions; it doesn’t replace server settings or routing rules. Complete a manual connection first, then configure automatic connection behavior one setting at a time.

5. Common post-install issues and what to check first

When troubleshooting, distinguish among three stages: the app won’t launch, the app launches but won’t connect, and it connects but the destination doesn’t work as expected. Only the first stage usually calls for revisiting installation and system approval steps. For the other two, check your existing subscription, connection settings, and routing. Reinstalling repeatedly usually won’t fix them.

Installed the Intel version on an Apple Silicon Mac?

Quit the app first and keep your existing subscription and configuration details. Then return to this site’s download page and choose the Apple Silicon version. Replace the app by following the installation instructions. Don’t launch two copies at once from Downloads and Applications. After reopening it, check that your existing configuration is still there.

No Open Anyway button on your Mac?

Try launching the app again from Applications, and confirm that the prompt is specifically about developer verification. Then go to System Settings → Privacy & Security and check for the blocked app entry. If your device is managed, the warning mentions malware, or the file is reported as damaged, stop the one-time approval process and check your organization’s policy or download the app again.

Can’t find Run anyway in SmartScreen?

First check whether More info is available, then confirm whether this is a Windows Security threat block rather than a reputation prompt. Organization policy may prevent you from continuing. If so, contact your administrator. Don’t turn off real-time protection or exclude your entire Downloads folder.

Installation succeeded, but why is the Home list empty?

An empty list doesn’t mean the installation failed. Import details you already have. If you’re using Subscribe, check that the link is complete and review the update result. When sharing an error, hide tokens, passwords, and subscription URLs. Don’t post screenshots that show credentials.

Connection is on, but webpages still won’t load?

Run Connectivity Test on Home, then check Global Routing and the active configuration. If Direct works but Proxy doesn’t, check server connectivity, port, and authentication first. If Proxy works but Config doesn’t, review the matched rule and FINAL policy. Don’t start by deleting all your configurations.

6. Post-install checklist

After confirming that the app launches and a connection works, you can consider automatic connections and more complex rules. This checklist helps distinguish an installed app from a verified configuration and makes it easier to repeat the checks when moving to another computer.

Download source: Get the installer from this site’s all-platform download page. Choose the correct Apple Silicon or Intel build for Mac, and make sure the Windows package matches your device.
System prompts: Approve an app once only after confirming its source. Don’t disable system-wide security protection.
App location: Launch the Mac version from Applications. On Windows, use the installed app’s shortcut rather than an old temporary copy.
Existing details: Confirm that your servers appear in the list and check the subscription update result. Don’t share sensitive fields publicly.
Routing mode: Confirm whether you’re using Config, Proxy, Direct, or Scene, and check that the test result matches what you expect.
Automatic connections: Set up Settings → On Demand only after a manual connection works, then check how it behaves when the network changes.