Shadowrocket Share Link Formats: ss://, vmess://, vless://, trojan:// and Subscription Links

1. The Prefix Determines How a Link Is Parsed—not Connection Quality

When Shadowrocket receives a link, it first needs to determine whether it contains server settings or points to a remote address used to retrieve configuration. Links such as ss://, vmess://, vless://, and trojan:// typically contain a single server entry. A subscription URL beginning with https:// points to remote content; the app must send a request and receive a response before it can parse the entries.

An HTTPS URL may return a web page, login page, or another file, so being able to open it in a browser does not mean it can be imported as a subscription. Likewise, a port of 443 in a share link does not by itself confirm that TLS is enabled. Protocol, port, and transport security are separate fields; check them together.

2. ss://: Decode the Encryption Method and Password First

Shadowsocks share links commonly follow the basic SIP002 format: authentication information comes before @, the server address and port come after it, and an optional name can follow #. The authentication information is usually a URL-safe Base64 encoding of method:password. Older formats may encode a larger portion of the link, so its appearance alone is not enough to determine whether it is valid.

ss://[email protected]:8388#Demo-SS

• Decoding YWVzLTEyOC1nY206dGVzdA gives aes-128-gcm:test. The encryption method is aes-128-gcm, and the example password is test.
• example.com is an example server address, and 8388 is an example port—not a standard port for every Shadowsocks service.
• Demo-SS is the display name. Changing it will not fix an incorrect address, password, or encryption method.
• If the original link includes a plugin query parameter, it may contain plugin settings. Do not remove it just to shorten the link, and check whether the relevant feature is supported.

Base64 is an encoding, not a way to keep credentials secret. Anyone with the complete link can usually recover its password. Do not paste the original link into a public decoding website. To check its contents, review the fields in Shadowrocket after import and compare them with your existing configuration.

3. vmess://: Check the Outer Encoding and Inner JSON Separately

A common VMess share-link format puts Base64-encoded JSON after vmess://. The example below shows decoded data; it is not a complete share link to paste into a URL field. Export tools may use different combinations of fields, so check the actual import result.

{
  "v": "2",
  "ps": "Demo-VMess",
  "add": "example.com",
  "port": "443",
  "id": "00000000-0000-4000-8000-000000000001",
  "aid": "0",
  "scy": "auto",
  "net": "ws",
  "type": "none",
  "host": "example.com",
  "path": "/demo",
  "tls": "tls",
  "sni": "example.com"
}

• add, port, and id specify the server address, port, and UUID, respectively. The UUID shown here is for demonstration only.
• net: ws indicates WebSocket; host and path are part of its transport parameters.
• tls: tls indicates that TLS is enabled in this example. sni specifies the server name used for the handshake; it is a different protocol field from the WebSocket Host.
• aid is the Alter ID field in older formats. Arbitrarily changing its value will not fix authentication failures.

In this example, v is a share-link format field, not the Shadowrocket version. Even if the name and server address are correct after import, check the transport type, TLS, Host, and Path. A missing slash, incorrect path capitalization, or mismatched SNI can cause an entry to be added successfully but fail during the handshake.

4. vless:// and trojan://: Include Every Query Parameter

Common VLESS and Trojan share links use a URI-like format: credentials first, then the address and port, followed by additional parameters after a question mark. Both examples below use TLS, but their authentication methods differ. You cannot use one protocol in place of the other by simply changing the prefix.

vless://[email protected]:443?encryption=none&security=tls&type=tcp&sni=example.com#Demo-VLESS

trojan://[email protected]:443?security=tls&type=tcp&sni=example.com#Demo-Trojan

In a URL, & separates parameters and # introduces a remark. Reserved characters in a password, path, or remark must be percent-encoded according to the part of the URI where they appear. For example, the query parameter path /demo?mode=1 can be written as %2Fdemo%3Fmode%3D1. Do not encode the entire link repeatedly, or copy line breaks, Chinese punctuation, or quotation marks from surrounding text.

5. Single-Link Imports and Subscription Updates Follow Different Workflows

A single share link is a snapshot of server settings at a given point in time. A subscription URL, by contrast, is an endpoint that can be requested again. The address below illustrates the format only; token=xxxx is an obvious placeholder value and does not correspond to a real service. A subscription may return an encoded list of links or another supported format; its URL suffix alone does not tell you what it contains.

https://example.com/sub?token=xxxx

A subscription update may add, replace, or remove entries it manages. Do not treat manual edits within a subscription group as permanent backups; a later update may overwrite them with remote settings. Record any differences before editing. To keep a separate configuration, use an entry that is clearly independent of subscription management and maintain it yourself.

Subscription tokens often act as access credentials. When troubleshooting a failure, record only the response status, error text, and stage where it occurred; do not share the full URL. If a token has been exposed, reset or revoke it in your own service management portal, then save the new URL in Shadowrocket.

6. After Import, Use Global Routing to Identify Where the Problem Occurs

A share link describes how to connect to a server; it is not a complete set of traffic-routing rules. Use Home to select a server and control the connection, and Config to manage rule configurations. When checking Global Routing, distinguish between a request that was not sent to the selected server and one that reached the server but failed to connect. Otherwise, you may keep editing a link that is already correct.

7. Common Issues and How to Fix Them