Shadowrocket Share Links Explained: ss://, vmess://, vless://, trojan:// and Subscription URLs

At a glance

This guide is for users who already have their own provider configuration or subscription. Learn to identify link types, check protocol fields, and choose the right import method. Shadowrocket reads configuration data; a QR code is simply another way to encode text. First distinguish a single configuration from a remote subscription, then check the address, port, and authentication fields to avoid entering a subscription URL in a server address field.

1. Single-server URIs vs. subscription URLs

ss://, vmess://, vless://, and trojan:// are the four share-link prefixes covered here. They indicate how to interpret connection parameters and usually correspond to a single server configuration. A subscription URL points to remote content; Shadowrocket retrieves that content before parsing its entries. A subscription may contain configurations using different protocols, or just one.

4 types

Share-link prefixes covered: ss / vmess / vless / trojan

2 steps

Subscription flow: retrieve remote content, then parse its connection entries

443

The TLS example port below is not a fixed port for all configurations

Subscriptions commonly use HTTPS, for example https://example.com/sub?token=xxxx. This is an illustrative placeholder, not a working configuration. The https:// prefix alone does not identify a subscription: websites, account pages, and configuration file URLs can use it too. Check the provider's instructions and the content returned.

Check what the link returns first

Treat a protocol-prefixed link as a single configuration. For an HTTPS URL, first confirm that it is a subscription endpoint rather than a login page, then use Subscribe. Don't simplify a subscription URL by removing query parameters.

2. ss:// vs. vmess://: different encoding formats

ss://: Shadowsocks credentials and server address

A common Shadowsocks share-link format encodes the cipher and password together, while leaving the server domain and port outside the encoded section. Older formats may encode more fields as a single block. The example below illustrates the structure and does not represent a usable service.

ss://[email protected]:8388#Demo-SS

Authentication section after Base64 decoding:
aes-128-gcm:pass

aes-128-gcm is the cipher; pass is a placeholder password. Check each field after importing rather than pasting the entire encoded string into the password field.
example.com is a placeholder server address, and 8388 is the port in this example. Use the port specified in your existing service configuration.
#Demo-SS is a display name, not part of server authentication. Names containing non-ASCII characters or spaces may be percent-encoded.
If the link includes plugin parameters, keep the full parameter set and make sure the app can parse those settings. Don't keep only the domain, port, and password.

vmess://: commonly a Base64-encoded JSON payload

A common VMess share link appends an encoded JSON payload after vmess://. The example below shows decoded sample content, not a complete share URI that can be pasted as-is. VMess share formats vary, so no single JSON field layout should be treated as a universal standard.

{
  "v": "2",
  "ps": "Demo-VMess",
  "add": "example.com",
  "port": "443",
  "id": "00000000-0000-0000-0000-000000000000",
  "aid": "0",
  "net": "ws",
  "type": "none",
  "host": "example.com",
  "path": "/demo",
  "tls": "tls"
}

In this common format, add and port specify the connection address and port, id is the authentication UUID, and net specifies the transport. Here, host and path are WebSocket-related parameters; don't omit them just because they look like web addresses. The connection address, HTTP Host, and TLS server name are distinct settings. Check each value against your existing configuration.

3. vless:// vs. trojan://: similar-looking authentication fields, different meanings

Both link types commonly follow the same pattern: authentication information, server address, port, query parameters, and a remark. Similar formatting does not make the protocols interchangeable. All domains, UUIDs, and passwords below are examples.

vless://[email protected]:443?encryption=none&security=tls&type=ws&host=example.com&path=%2Fdemo&sni=example.com#Demo-VLESS

trojan://[email protected]:443?security=tls&type=tcp&sni=example.com#Demo-Trojan

Field location	VLESS example	Trojan example	What to check
Before `@`	UUID	Password	Different authentication types; don't use one in place of the other
Address and port	`example.com:443`	`example.com:443`	443 is an example value; use the values in your existing configuration
`type`	`ws`	`tcp`	Specifies the transport, not the protocol
`sni`	`example.com`	`example.com`	Used for TLS server name settings
After `#`	Demo-VLESS	Demo-Trojan	Display name, not an authentication field

encryption=none is a protocol parameter in this VLESS example; it does not mean TLS is disabled. Here, security=tls specifies TLS settings. A port of 443 alone does not imply that TLS is enabled; the port number does not declare the encryption method.

In query parameters, %2F represents a slash, and & separates parameters. Copy the complete original text and avoid encoding an already escaped path a second time. Support for parameters varies between share formats. After importing, check that TLS, transport, Host, Path, and other fields appear in the corresponding settings.

4. Choose an import method: scan, paste, or Subscribe

A QR code can contain either a single URI or a subscription URL. Scanning it does not change its format. This comparison covers import methods in Shadowrocket only. “Recommended” means the suitable option when you already have an updateable subscription; it does not mean one protocol or service is better than another.

Recommended

Save the remote subscription URL and retrieve its configuration list. Use the same URL for future updates instead of pasting each share URI again.

Best for: an existing subscription URL that needs to stay linked for remote updates

Paste a share URI

Copy the complete protocol link and use the app's clipboard import option. This imports the parameters in that text; it does not create a subscription.

Best for: a single ss://, vmess://, vless://, or trojan:// link

Scan a QR code

Use the scanner on Home to read the QR code, then check the result. If it returns an HTTPS URL, confirm that the URL is a subscription endpoint.

Best for: configurations shared as QR codes, when you want to avoid typing a long string

Import a subscription

Copy the complete subscription URL from the management page for your existing service, including its path and query parameters. Don't copy the page title or login URL.
Go to Home → + → Type → Subscribe, enter the subscription address in URL, add a recognizable remark, and save.
Wait for the fetch to complete and check that the expected configuration entries appear. An HTTP error or parsing failure is not a successful import, even if the list is empty.
To sync remote changes, use the update action for the relevant subscription on Home. After updating, check the entry count, addresses, and selected entry for changes.

To import a single URI, copy the entire text from its protocol prefix through the trailing remark, then switch back to Shadowrocket and import it from the clipboard. If prompted to allow paste access, grant permission for this action. If no result is recognized, check whether chat formatting inserted spaces, line breaks, or non-ASCII punctuation. Don't paste the entire URI into a single server address field.

5. After importing, check the connection and routing separately

An entry appearing on Home only means the configuration was saved. It does not confirm that authentication, the TLS handshake, or access to a target website works. Open the entry's edit screen and compare its protocol, address, port, and authentication fields with the original configuration, then check the transport and TLS settings.

Select the entry you want to use on Home and make sure it isn't an older configuration left over from before a subscription update.
Run Connectivity Test and note whether it succeeds, times out, or returns an error. A test result does not replace checking access to the target website.
Check Home → Global Routing. Config routes traffic according to the current configuration rules, Proxy uses the proxy, Direct connects directly, and Scene applies the selected scene.
If you use Config, open Config and check the active configuration and rules. Share URIs generally don't include rules such as DOMAIN-SUFFIX, GEOIP, IP-CIDR, or FINAL.

Updating a subscription syncs remote entries; it does not automatically fix local routing rules. Settings → On Demand controls when connections are triggered and is not the subscription import screen. Check importing, connection triggers, and routing separately to identify which step failed.

6. Common questions about share links and subscription updates

Why isn't my ss:// link recognized after I copy it?

Check that the prefix is still there, the text wasn't truncated, and no quotation marks or explanatory text were included. Copy the complete link from its original source and try clipboard import again. If it still fails, check whether the link uses plugin parameters or a different encoding format, and ask your existing service provider for a configuration format supported by the app.

Why does Subscribe return an error when the subscription URL opens in a browser?

Opening in a browser only confirms that a response was received. Check whether the URL redirects to a login page or returns account information instead of configuration data. Make sure the token in the URL is complete. For 401 or 403 errors, check authorization first; for timeouts, check whether your current network can reach the subscription host.

Why did an entry I edited manually change after updating the subscription?

Subscription entries come from remote content and may be regenerated or replaced during an update. To preserve manual changes, save the required parameters as a separate configuration and record them before updating. Afterward, verify your selection again; the same remark does not guarantee the entry's contents are unchanged.

Can I send someone the full link to help troubleshoot?

A share URI may contain a password or UUID, and a subscription URL token may grant access to an entire set of configurations. Redact authentication values and tokens first; share only the protocol, port, error message, and necessary transport settings. If valid credentials have been exposed, reset them through the management page for your existing service, then update your local configuration.

Shadowrocket is a closed-source commercial app primarily for iPhone and iPad, available exclusively on the App Store. The one-time app purchase does not include a connection service. This guide assumes you already have your own configuration and subscription. This website does not provide, sell, or recommend nodes, subscriptions, or connection services.