The Shadowrocket app is a paid, rule-based proxy utility for iPhone and iPad from Shadow Launch Technology Limited. It doesn’t come with servers of its own: you add a proxy, and it sends traffic from every app on the device through it, following rules you choose. This guide covers what Shadowrocket is, what it costs, and how to add an HTTP or SOCKS5 proxy from ProxyEmpire, including the host, port and login. It also explains Config and proxy routing, how to test the connection, and rotating vs sticky sessions on rotating mobile proxies and residential IPs. Troubleshooting and a comparison with a VPN app and the iPhone’s own Wi-Fi proxy setting come last.
The short version
Shadowrocket costs $2.99 on the US App Store, and it is a proxy client, not a VPN service: to use a ProxyEmpire proxy, tap Add Server, set Type to HTTP or Socks5, enter host v2.proxyempire.io, port 5000 and your proxy username and password, then turn the connection on. Leave Global Routing on Config to follow rules, or switch to the proxy mode to send everything through the proxy. Add a session ID to the username to keep the same IP.
What is the Shadowrocket app?
A rule-based proxy client for Apple devicesShadowrocket is a network utility for iPhone and iPad. Its App Store subtitle is “Rule based proxy utility”, and the listing describes it as a client that captures HTTP, HTTPS and TCP traffic from any app on the device and redirects it to a proxy server. The seller is Shadow Launch Technology Limited, and the developer links only to the App Store listing. The developer’s website, shadowlaunch.com, is a one-page landing page with an App Store link, a privacy policy and feedback, Twitter and Telegram links. There is no official manual, so the menu names in this guide are the ones shown in the app’s own App Store screenshots.
The most important thing to understand is what it is not. Shadowrocket is not a VPN service and doesn’t sell access to servers. As Wikipedia’s summary puts it, the authors don’t provide any proxy servers; you add your own. Buying the app gives you the client. The IP address websites see comes from whatever proxy you put into it, such as a residential or mobile proxy from ProxyEmpire.
What you get for the price, according to the listing:
- System-wide capture. Traffic from every app, on Wi-Fi and on cellular data, not only Safari.
- Rules. Match traffic by domain, domain suffix, domain keyword, CIDR IP range or GeoIP lookup, and decide what goes through the proxy and what connects directly.
- Visibility. A record of HTTP, HTTPS and DNS requests, plus traffic and speed figures for Wi-Fi, cellular, direct and proxy connections.
- Extras. Rule files imported from a URL or iCloud Drive, ad blocking by domain and user-agent rules, local DNS mapping, DNS over HTTPS, TLS and QUIC, URL rewriting, HTTPS decryption, full IPv6 support and multi-level forward proxies.
Beyond HTTP and SOCKS5, Shadowrocket also supports a long list of other proxy protocols; this guide only needs the two that ProxyEmpire uses.
Key takeaways
- Shadowrocket is a $2.99 (US) one-time purchase from Shadow Launch Technology Limited, with no in-app purchases listed.
- It includes no servers. The IP you get depends on the proxy you add.
- For ProxyEmpire: Type HTTP or Socks5, host v2.proxyempire.io, port 5000, username and password.
- Config mode follows rules; the proxy mode sends everything through the proxy.
- ProxyEmpire carries UDP on Rotating Residential and Rotating Mobile only (ports 443 and 53), and target TCP ports 80 and 443 are open by default.
Shadowrocket price, devices and requirements
From the App Store listing, 1 October 2026| Item | What the listing says |
|---|---|
| Price | $2.99 on the US App Store, paid once. Prices differ by country. No in-app purchases or subscription are listed. |
| Developer / seller | Shadow Launch Technology Limited |
| iPhone and iPad | iOS 13.0 or later; iPadOS 13.0 or later |
| Other devices | Mac (macOS 10.15 or later), Apple Vision (visionOS 1.0 or later), Apple TV (tvOS 17.0 or later) |
| Family Sharing | Supported: up to six family members can use it |
| Privacy label | “Data Not Collected” |
| Rating | 4.5 out of 5 from about 12,000 ratings; version 2.2.92 released 7 September 2026 |
Because it is a one-time purchase tied to your Apple Account, you can install it on your other Apple devices at no extra cost, and Family Sharing covers the rest of your household. There is no Android version. On Android, ProxyEmpire’s own free app, ProxyEmpire Proxy Manager, does the setup for you, and our Android proxy settings guide covers the built-in options. On a desktop browser, the ProxyEmpire Proxy Manager extension for Chrome does the same job.
How Shadowrocket routes your traffic
A VPN configuration that points at a proxyiOS doesn’t let one app intercept another app’s network traffic directly. Apps that do it use Apple’s Network Extension framework, which runs as a VPN configuration. That is why iOS asks you to allow Shadowrocket to add a VPN configuration the first time you connect, and why the VPN indicator appears while it runs. The tunnel itself stays on your phone, though. Shadowrocket reads each connection, checks it against its rules, and sends it either to your proxy or straight to the internet.
app on your iPhone (Safari, a shopping app, a social app...)
|
v
Shadowrocket (runs as the iOS VPN configuration)
| checks the rule: domain, suffix, keyword, IP range or GeoIP
|
+--> PROXY --> v2.proxyempire.io:5000 --> residential or mobile exit IP --> website
|
+--> DIRECT --> your own connection --> website sees your real IPWith an HTTP proxy, Shadowrocket asks the proxy to open a tunnel to the website with the HTTP CONNECT method, then passes your app’s encrypted traffic through it. With SOCKS5, it does the same with a SOCKS5 connect request, and sends your username and password with SOCKS5’s own login step (RFC 1929). Either way, an HTTPS site stays encrypted end to end between your app and the website. The proxy sees which host you connect to, not the pages or data inside.
What you need before you start
The Shadowrocket app and one proxy login- Shadowrocket, bought from the App Store on the iPhone or iPad you want to use.
- A ProxyEmpire account. The $1.97 trial includes 100 MB of residential and 50 MB of mobile traffic, which is enough to test the setup.
- Your proxy details from the dashboard. Open Proxy Manager, go to the Connection Builder and choose the Residential or Mobile tab. Pick the country, and under the advanced settings the region, city, ZIP, ISP (carrier on mobile), ASN or OS fingerprint if you need them. All of these are included at no extra charge. Then choose the rotation: Same IP, Every request or Custom TTL.
The Connection Builder turns your choices into a proxy username. Host and port are the same for every choice: v2.proxyempire.io and 5000, for both HTTP and SOCKS5, with the same username and password. ProxyEmpire uses username and password authentication only, so there is no IP whitelist to set up. That matters on a phone, where your own IP changes every time you move between Wi-Fi and mobile data.
How to add a Shadowrocket proxy (HTTP or SOCKS5)
Five fields and a save- Open Shadowrocket. On the Home tab, tap + at the top right, or tap Add Server under SERVER.
- Tap Type and choose HTTP or Socks5. Don’t choose HTTPS, HTTP2 or Socks5 Over TLS for ProxyEmpire; those expect a TLS connection to the proxy itself, and ProxyEmpire’s gateway is set up for plain HTTP and SOCKS5.
- Host: enter
v2.proxyempire.io. Port: enter5000. - Username and password: paste the proxy username from the Connection Builder into the username field, and your proxy password into Password. Paste rather than type: one wrong character in the username changes the country or session, or fails the login.
- Remark is optional. Give the server a name you’ll recognise, such as “PE resi US sticky”. Tap Done.
- Select it and connect. Back on Home, tap the new server so the dot marks it as the default (“The DOT means the default server”), then turn on the switch next to Not Connected. Allow the VPN configuration when iOS asks the first time.
Type HTTP (or Socks5)
Host v2.proxyempire.io
Port 5000
Username r_username-country-us-sid-123456
Password YOUR_PASSWORD
Remark PE resi US stickyThe username above is the sample format from ProxyEmpire’s rotating residential proxies page: country-us picks the United States and sid-123456 holds a session. Always paste the exact username the Connection Builder gives you, not the sample, because yours includes your account’s own username. The labels above are the ones shown in the App Store screenshots; if your version names the username field slightly differently, it is the field between Port and Password on the HTTP and Socks5 forms.
HTTP or SOCKS5?
For browsing and ordinary apps, both work, and HTTP is the simpler choice. SOCKS5 is protocol-agnostic: it relays any TCP connection, not just web traffic, so it suits apps that speak something other than HTTP. Our SOCKS proxy guide explains the difference in detail. One thing SOCKS5 does in the standard (RFC 1928) is carry UDP: ProxyEmpire supports it on Rotating Residential and Rotating Mobile only, on UDP ports 443 and 53 by default. If your version of Shadowrocket shows a UDP option on the server, leave it off unless you use Rotating Residential or Rotating Mobile with the Socks5 type.
Global Routing: Config vs proxy mode
Rules, or everything through the proxyThe Global Routing row on the Home tab decides how Shadowrocket uses your server. The App Store screenshot shows it set to Config. Wikipedia’s summary of the app lists four routing choices: configuration mode, proxy mode, direct connection mode and scene mode.
| Mode (as Wikipedia names it) | What happens | Use it when |
|---|---|---|
| Configuration (shown as Config) | Each connection is checked against the rules in the active configuration file, which you manage on the Config tab. Matching traffic goes to the proxy, goes direct or is blocked. | You want only some apps or sites on the proxy IP |
| Proxy mode | Everything goes through the selected server, whatever the rules say. | Testing a new server, or when every app should show the proxy IP |
| Direct connection mode | Nothing goes through the proxy. | Checking whether a problem is the proxy or the network |
| Scene mode | Listed by Wikipedia without detail, and not documented by the developer. | Not needed for a single proxy |
Two practical points. First, test every new server in the proxy mode, so a rule can’t hide a problem, and then switch back to Config if you use rules. Second, in Config mode a site that matches a direct rule never touches the proxy, so if the IP check shows your real address, look at the rules before you look at the login. Rules can match by domain, domain suffix, domain keyword, CIDR IP range or GeoIP lookup, and you can import rule files from a URL or iCloud Drive.
Config mode is also how you keep traffic the proxy can’t carry off it. ProxyEmpire blocks financial, government, crypto, bank and payment sites on all proxy types (see the list and how unblocking works). Only target ports 80 and 443 are open by default. A direct rule for your bank or for an email app lets those keep working while the rest of your traffic uses the proxy.
How to test the connection
Check the IP, not just the switch- Use the built-in test. Tap Connectivity Test on the Home tab for a quick check that the connection works. If it fails, check the host, port and type first.
- Check your exit IP. With the connection on and Global Routing in the proxy mode, open Safari and load an IP-check site such as ifconfig.me. You should see an IP in the country you chose, not your own.
- Check the location. If you targeted a city or a carrier, confirm it on an IP-lookup site. The username is the only thing that sets the location, so a wrong country means a wrong username.
- Check a sticky session. Reload the IP page a few times. With a session ID in the username, the IP should stay the same. With Every request rotation, it should change.
- Check the dashboard. The Connection Builder’s Test proxy settings button checks the same username and password from ProxyEmpire’s side, which separates a login problem from a phone problem.
For a closer look, the app records and displays HTTP, HTTPS and DNS requests, and measures traffic on Wi-Fi, cellular, direct and proxy connections; the traffic figures are on the Data tab. If the proxy traffic stays at zero while you browse, your rules are sending everything direct.
Rotating vs sticky sessions in Shadowrocket
The session lives in the usernameShadowrocket has no rotation of its own: it sends connections to the host and port you set, with the username you gave it. Rotation happens at ProxyEmpire’s gateway, and you choose it in the Connection Builder before you copy the username.
- Every request. Each new connection can come from a different IP. That is fine for checking prices or search results, but most apps with a login will see your IP jump in the middle of a session and may ask you to sign in again.
- Same IP (sticky). The username includes a session ID such as
sid-123456. The IP stays with no fixed time limit, until you rotate it or the device behind it goes offline. Use it for anything with a login, a cart or a multi-step form. - Custom TTL. The IP changes on a timer you set, up to 2 hours.
To get a fresh sticky IP, change the session ID, either with Rotate session in the dashboard or by editing the digits after sid- in the server’s username and saving. A handy setup is two or three servers saved side by side, for example “US sticky”, “UK sticky” and “US rotating”, and switching by tapping a different one. Our guide to sticky vs rotating proxies covers which to use for which job.
Residential and mobile both use the same host, port and username format. Rotating residential proxies give you 30M+ IPs in 179 countries and territories; rotating mobile proxies give you 4M+ carrier IPs in 174 countries. Mobile is the natural choice on a phone: the website sees a real carrier connection, the same kind of address that ordinary phone users share.
Shadowrocket proxy troubleshooting
Symptom, likely cause, fix| Symptom | Likely cause | Fix |
|---|---|---|
| Connectivity Test fails | Wrong host, port or type | Host v2.proxyempire.io, port 5000, Type HTTP or Socks5 (not HTTPS or an “over TLS” type). |
| Pages won’t load; login refused | Username or password wrong, or a space pasted at the end | Copy both again from the Connection Builder and check them with Test proxy settings. An HTTP proxy that refuses the login answers 407 Proxy Authentication Required (RFC 9110). |
| IP check shows your own IP | Config mode sent the site direct, or the connection is off | Switch Global Routing to the proxy mode and retest; then fix the rule. |
| Wrong country or city | The username’s targeting | Rebuild the username in the Connection Builder and paste it again. |
| IP keeps changing | A rotating username | Use a Same IP username with a session ID. |
| A bank, payment or crypto site won’t open | Blocked on all ProxyEmpire proxy types | Route it direct with a rule. Unblocking needs KYC and a use-case review. |
| Email, games or calls fail, web works | They use ports other than 80 and 443, or UDP ports other than 443 and 53 | Route those apps direct. UDP is only on Rotating Residential and Rotating Mobile (ports 443 and 53), and other ports need a KYC request. |
| Slow or occasional timeouts | The exit is a real home or mobile device | Retry, pick a new session, or choose a country closer to the target site. |
If nothing works, turn the connection off and on, and test the same username in a desktop tool such as curl to rule out the phone. ProxyEmpire’s 24/7 support team, staffed by real people, can check the account side while you check the app.
Shadowrocket vs a VPN app vs iOS Wi-Fi proxy settings
Three ways to change your IP on an iPhone| Shadowrocket + proxy | VPN app | iOS Wi-Fi proxy setting | |
|---|---|---|---|
| Cost | $2.99 app (US) plus the proxy you choose | Usually a subscription | Free, built in |
| Where the IP comes from | Your proxy: residential, mobile or any other | The VPN provider’s own servers | Your proxy |
| Works on mobile data | Yes | Yes | No: it is set per Wi-Fi network |
| Protocols | HTTP, SOCKS5 and many more | The provider’s VPN protocol | HTTP proxy only |
| Rules per site or app | Yes, by domain, IP range or GeoIP | Sometimes (split tunnelling) | No, all or nothing (or a PAC file) |
| Several IPs to switch between | Yes, one tap per saved server | Server list from the provider | One proxy per network |
The iPhone’s own setting lives under Settings, Wi-Fi, the info button next to the network, and HTTP Proxy. Apple describes it as an HTTP proxy for that network, and it stays behind when you leave that Wi-Fi. For a single proxy on your home network it is enough, and our guide to setting up a proxy on an iPhone walks through it, including the Authentication switch for the username and password. For background on how a proxy sits between devices and the internet on a local network, see proxy servers in a Wi-Fi network.
Shadowrocket is the better tool when you need the proxy on mobile data, need SOCKS5, want only some traffic on the proxy, or switch between several IPs during the day. A VPN app suits a different job: it encrypts your traffic to the VPN provider’s own servers, and you get the IPs of those servers rather than a residential or mobile IP you pick by country, city or carrier.
Is Shadowrocket safe?
What the listing says, and what depends on youThe App Store privacy label, which the developer fills in, says “Data Not Collected”. The app is sold through Apple’s store under a named company, and it was last updated to version 2.2.92 on 7 September 2026. Its safety in use depends mostly on three things you control:
- The servers you add. Every connection you send to a proxy passes through that provider. HTTPS keeps the content encrypted, but the provider sees which sites you connect to. Only add servers from a provider you pay and trust.
- HTTPS decryption. Shadowrocket can decrypt HTTPS traffic, which, like any HTTPS inspection tool, only works once you install and trust a certificate it generates. Leave it off unless you are debugging your own app, and remove the certificate when you’re done.
- Your Apple Account. Buy the app on your own account. Signing in to a shared Apple Account someone posted online, to get a paid app for free, means using an account a stranger controls: its owner can change the password or see anything that syncs to it. Family Sharing is the legitimate way to share it.
A common question is whether Shadowrocket has a kill switch. The App Store listing doesn’t describe one. If some traffic must never leave without the proxy, test what happens when you switch between Wi-Fi and mobile data before relying on it.
A proxy client is only as trustworthy as the proxies you add to it. The app routes the traffic; your provider carries it.
Shadowrocket app FAQ
Short answersWhat is the Shadowrocket app used for?
Routing traffic from an iPhone or iPad through a proxy you choose, with rules that decide which apps and sites use it. It also logs requests and measures traffic.
How much does Shadowrocket cost?
$2.99 on the US App Store as of 1 October 2026, paid once. Prices vary by country, and the listing shows no subscription or in-app purchases.
Is Shadowrocket a VPN?
No. It uses iOS’s VPN framework to capture traffic, but it is a proxy client and includes no servers. You add your own proxy.
Is Shadowrocket available on Android?
No. It is sold only on the App Store, for iPhone, iPad, Mac, Apple Vision and Apple TV. On Android, ProxyEmpire’s free ProxyEmpire Proxy Manager app sets up a proxy.
What proxy settings does ProxyEmpire use in Shadowrocket?
Type HTTP or Socks5, host v2.proxyempire.io, port 5000, and the username and password from the Connection Builder.
How do I keep the same IP in Shadowrocket?
Use a Same IP username with a session ID such as sid-123456. Change the ID to get a new IP.
Why does Shadowrocket show my real IP?
In Config mode a rule may send that site direct. Switch Global Routing to the proxy mode and test again.
Does Shadowrocket work on mobile data?
Yes. The listing says it works on cellular networks, unlike the iPhone’s Wi-Fi proxy setting.
Can I use UDP through ProxyEmpire in Shadowrocket?
Only on Rotating Residential and Rotating Mobile, through a Socks5 server, and only UDP ports 443 and 53 are open by default, so voice calls and games that need UDP should still be routed direct.
References
Primary sources, checked 1 October 2026- Apple App Store — Shadowrocket, Shadow Launch Technology Limited (price, compatibility, description, privacy label, screenshots). apps.apple.com/us/app/shadowrocket
- Shadow Launch Technology Limited — developer website. shadowlaunch.com
- Apple Support — “Manage Wi-Fi settings on iPhone” (HTTP Proxy per network). support.apple.com/guide/iphone
- Apple Developer — Network Extension, NEVPNManager (Personal VPN configuration). developer.apple.com/documentation/networkextension
- Wikipedia — “Shadowrocket” (no bundled servers; routing modes). en.wikipedia.org/wiki/Shadowrocket
- IETF — RFC 1928, “SOCKS Protocol Version 5”. rfc-editor.org/rfc/rfc1928
- IETF — RFC 1929, “Username/Password Authentication for SOCKS V5”. rfc-editor.org/rfc/rfc1929
- IETF — RFC 9110, “HTTP Semantics” (CONNECT, 407). rfc-editor.org/rfc/rfc9110
Residential and mobile IPs for Shadowrocket
One gateway for HTTP and SOCKS5, 30M+ residential IPs in 179 countries and territories and 4M+ mobile IPs in 174 countries, city, ZIP, carrier and ASN targeting at no extra charge, sticky or rotating sessions, 99.9% uptime and 24/7 support from real people. The $1.97 trial includes 100 MB of residential and 50 MB of mobile traffic.
