Shadowrocket Link Formats: ss://, vmess://, vless:// and trojan:// — Single-Server Links vs. Subscription URLs

1. Single-server links vs. subscription URLs

A single-server share link contains the parameters needed for one connection in a URI. The ss://, vmess://, vless:// and trojan:// prefixes tell the importer which format to parse. Importing one creates a server entry; it does not create an address that continually fetches new content.

A subscription URL is usually an HTTPS address. Shadowrocket requests that address, reads the response and parses the server entries it contains. Updating a subscription means requesting and processing its remote content again; an imported single-server link does not change on its own. Get subscription URLs from your provider. An https:// prefix alone does not tell you whether the response is a server subscription, a configuration file or a regular webpage.

2. ss://: authentication, server address and remark

A common Shadowsocks sharing format, SIP002, uses Base64URL-encoded authentication details, a server address, a port and an optional remark. In the example below, the decoded authentication details are aes-256-gcm:password, the address is example.com and the port is 8388. These example values cannot be used to connect.

ss://[email protected]:8388#Example-SS

Another, older format encodes the “method, password, address and port” together, so you may not see an @. If a link will not import, first identify its format instead of adding separators by hand. Some links also include plugin parameters. Leaving them out can prevent a connection, even when the address and password are correct.

3. vmess://: JSON parameters encoded in Base64

A common VMess share format puts Base64 text after vmess://. The decoded result is usually JSON, not a plain “username@server” string. The example below shows demo JSON before encoding, not a complete link you can paste to import.

{
  "v": "2",
  "ps": "Example-VMess",
  "add": "example.com",
  "port": "443",
  "id": "11111111-2222-4333-8444-555555555555",
  "aid": "0",
  "scy": "auto",
  "net": "ws",
  "type": "none",
  "host": "example.com",
  "path": "/connect",
  "tls": "tls",
  "sni": "example.com"
}

• add and port specify the connection target; id is the UUID used for authentication and cannot be replaced with a remark.
• When net is ws, check both the WebSocket host and path. Preserve the path’s capitalization and leading slash.
• tls and sni affect the TLS connection. WebSocket Host and TLS SNI serve different purposes; even if their example values match, they are not the same field.
• v is a field in this share format, not the Shadowrocket app version. Interpret fields such as aid according to the actual service parameters; do not modify them based on the example.

If the link came from a formatted message, line breaks, smart quotes or truncated Base64 can cause parsing to fail. Copy the complete original text again, then check the imported entry. Do not paste VMess JSON as configuration content in Config, and do not mistake the JSON port value for a subscription URL’s port.

4. vless:// and trojan://: check each readable parameter

VLESS and Trojan share links commonly use a straightforward URI structure: authentication details come before @, followed by the address, port and query parameters. The & shown on this page separates link parameters; when copying, keep the complete original link intact.

vless://[email protected]:443?encryption=none&security=tls&type=ws&host=example.com&path=%2Fconnect&sni=example.com#Example-VLESS

trojan://[email protected]:443?security=tls&type=tcp&sni=example.com#Example-Trojan

In path=%2Fconnect, %2F is the percent-encoded form of a slash. If a password contains URI-reserved characters such as @ or #, they must also be encoded correctly; otherwise, the parser may treat part of the password as an address or remark. Do not decode the entire link by hand before importing unless you understand how its fields are separated.

In the VLESS example, encryption=none describes a protocol parameter; it does not mean the example has no TLS. Parameter names can vary between sharing formats, so changing only the prefix will not convert a VLESS link into a Trojan link.

5. Shadowrocket import options: server subscriptions vs. Config

Home manages server entries and connection selection, Config manages rule configurations, and Settings manages app preferences. A server subscription is for maintaining server entries in bulk; a remote configuration may also contain sections such as [General] and [Rule]. Either type of content may be fetched over HTTPS, but similar-looking URLs do not mean they belong in the same place.

The system manages clipboard and camera permissions. Copy the complete link, return to Home and follow the import prompt; to scan a code, use the scanner in Home to read the original text. If no import prompt appears, check the prefix, spaces and line breaks. Do not enter a subscription URL in the Address field for an individual server.

6. How subscription updates work, sensitive data and troubleshooting

The URL below is clearly for demonstration. token=xxxx marks where an authentication parameter would go; it is not a real credential. A server may return an encoded server list or other content the client can recognize. An HTTPS URL by itself does not identify the response format.

https://example.com/sub?token=xxxx

1. First, identify the resource type. Ask your provider whether the URL points to a server subscription or a remote configuration. A login page, error message or empty response is not a valid server list.
2. Next, check whether the request succeeded. For a timeout, first check whether your current network can reach the subscription domain. HTTP 401 or 403 responses usually call for checking authorization and the link’s status. A webpage loading in a browser does not, by itself, mean the subscription is valid.
3. Then check the parsing result. If the request succeeds but no entries appear, the response may not be supported by that import option, or it may contain no usable entries. Check the format documentation instead of repeatedly adding duplicate subscriptions.
4. Finally, check the connection and rules. A successful update does not mean every entry can connect. First check the selected entry in Home, then check Global Routing. Config applies configuration rules; Proxy sends traffic selected for proxying to a proxy policy; Direct connects directly; and Scene applies the settings for the selected scene. A server share link does not create a complete set of routing rules for you.

7. Common questions about importing links and updating subscriptions