Shadowrocket Share Links Explained: ss://, vmess://, vless://, and trojan:// vs. Subscription URLs

Start with the prefix: protocol links and subscription URLs serve different purposes

When Shadowrocket receives a link, it first needs to determine whether the link describes a connection or a way to retrieve content remotely. A protocol link typically contains the server address, port, credentials, and transport options in one text string. A subscription URL usually uses HTTPS; the app requests that URL to retrieve a list of entries. Either type can be shared as a QR code or through the clipboard, so the fact that a link came from a QR code does not identify its type.

A subscription URL may look like this. token is the query parameter name and may serve as an access credential; the path and parameters of the actual URL depend on the service the user already has. An HTTPS URL may also lead to a web page. It can be parsed as a subscription only if its response matches a format supported by the app.

https://example.com/sub?token=xxxx

• Protocol prefix: Tells the parser how to interpret the following parameters; it does not guarantee that the server is available.
• QR code: A text carrier that can contain either a single protocol link or a subscription URL.
• Subscription response: May contain multiple links and may be Base64-encoded; not all subscriptions use the same response format.
• Config: Used to manage configuration files. These are different from server entries in Home. A configuration file containing rules is not the same as a server subscription.

ss://: Identify the encryption method, then check the password and address

ss:// is used for Shadowsocks. A common SIP002 format encodes “encryption method:password” before @, followed by the server address and port. In the demo link below, the credentials decode to aes-128-gcm:password; the server is an example domain, and the port is 8388.

ss://[email protected]:8388#SS-demo

Some legacy formats encode more of the link in Base64, so the presence or absence of a plain-text @ is not a reliable way to identify the format. Links with plugins may also include a plugin query parameter. If a parameter is lost when copying, the connection details may still be incomplete even when the server, port, and password are present.

vmess://: The payload is commonly encoded JSON

vmess:// is used for VMess. A common share format places Base64-encoded JSON after the prefix rather than spelling out “user@host.” So, not seeing a plain-text server address does not mean the link is empty. The example below shows a decoded demo payload, not a complete link that can be pasted into the app for import.

{
  "v": "2",
  "ps": "VMess-demo",
  "add": "edge.example.com",
  "port": "443",
  "id": "00000000-0000-4000-8000-000000000000",
  "aid": "0",
  "scy": "auto",
  "net": "ws",
  "type": "none",
  "host": "edge.example.com",
  "path": "/demo",
  "tls": "tls",
  "sni": "edge.example.com"
}

• add, port, and id contain the server, port, and user UUID, respectively. The UUID is not the display name.
• ps is the display name, and v is a format field for this share payload—not the Shadowrocket app version.
• net=ws specifies WebSocket transport. host and path hold the corresponding transport parameters and should not be removed arbitrarily.
• tls and sni are related to TLS. The address, Host, and SNI may be the same in an example, but a real service can specify them separately.
• aid is a legacy compatibility field. When troubleshooting, do not change its value by guesswork; check it against the actual service configuration.

A successful import only means the app recognized the data. It does not confirm network reachability, valid credentials, or matching TLS parameters. If an entry appears in the list but will not connect, open its edit screen and check each field instead of importing the same link repeatedly.

vless:// and trojan://: Similar formats, different authentication fields

Both link types commonly use the format “authentication field@server:port” and add transport settings as query parameters. The VLESS authentication field is typically a UUID; Trojan uses a password. The examples below illustrate the structure only. Their UUIDs, passwords, and domains do not correspond to real services.

vless://[email protected]:443?encryption=none&security=tls&type=ws&host=edge.example.com&path=%2Fdemo&sni=edge.example.com#VLESS-demo

trojan://[email protected]:443?security=tls&sni=edge.example.com#Trojan-demo

encryption=none does not mean the entire connection has no protection. It relates to a VLESS field; check the security parameters separately to see whether TLS is used. Likewise, a port of 443 does not prove that TLS is configured correctly. The port is only one part of the connection destination.

%2F in a query parameter is the percent-encoded form of a slash. Special characters in passwords, display names, and paths may also be encoded. Avoid repeatedly decoding the entire link before copying it; an @, #, or & that belongs to a password could be mistaken for a structural separator. Share formats do not all handle extension parameters the same way, so check the fields the app actually saved after import.

Choose an import method and update workflow in Shadowrocket

Identify the type of data you have before choosing an import method. Home is for managing servers and subscriptions; Config is for configuration files; Settings is for app preferences. Do not assume an HTTPS URL belongs in Config as a rules file, or treat a single protocol link as a subscription that refreshes automatically.

1. Before importing: Confirm that the configuration is one you already have, and keep a recoverable copy of the original. Do not delete an entry that still works.
2. After saving: Check Type, server, port, and display name. Do not judge a successful import by the name alone.
3. Before testing: Check required fields such as TLS, SNI, Host, and Path. Fields vary by protocol; not every connection needs all of them.
4. After updating: Check whether entries in the subscription group have changed. A remote update may replace manually edited entries, so keep a separate record of important changes.

Troubleshooting: Check parsing, updates, and connectivity separately

Break troubleshooting into three stages: whether the text can be parsed, whether a subscription request retrieves content, and whether a saved connection works. Global Routing controls the routing mode; it cannot fix an incomplete share link. Switching Proxy or Config will not fill in a missing password.

After checking the fields, distinguish server connectivity from rule behavior. Connection parameters determine how a connection is established; rules in Config determine which policy applies to each request. A successful subscription update, a passing connection test, and traffic routed as expected are three separate outcomes to verify.