Shadowrocket Share Link Formats: ss://, vmess://, vless:// and trojan:// vs. Subscription Links

1. Share Links vs. Subscription Links: Connection Details or a Remote URL?

ss://, vmess://, vless://, and trojan:// links typically encode one node's connection details in a string. After import, the client gets the server address, port, authentication information, and related options. If the server's port changes later, the saved share link will not update automatically.

A subscription is usually an https:// URL. Shadowrocket requests that URL and reads the node list in the response; updating it fetches the content again. A subscription can manage multiple nodes, but it may also return just one. Whether it can be updated depends on whether the remote subscription source is saved, not on how many entries are currently in the list.

An https:// URL alone does not prove that an address is a subscription. A provider's account page, documentation, or subscription endpoint may all use HTTPS. A valid subscription URL must return content the client can recognize as a subscription, not a login form or a web page.

2. ss://: Shadowsocks Method, Password, and Server

Common Shadowsocks share links use the SIP002 format: the “method:password” user information is Base64-encoded, followed by the server and port. Base64 is an encoding, not a security measure; anyone with the full link can usually recover the credentials.

ss://[email protected]:8388#Demo-SS

• YWVzLTEyOC1nY206ZGVtby1wYXNz decodes to aes-128-gcm:demo-pass. The first part is the method; the second is an example password.
• example.com:8388 is an example server and port. Port 8388 is not required for Shadowsocks; it must match the actual server configuration.
• #Demo-SS is a remark, usually displayed as the node name. It does not determine where the connection goes.
• Some links also include query parameters such as plugin. Whether they work depends on the parameter values and client support, so don't remove them just to shorten the link.

Some older formats encode “method:password@server:port” as a single string. So even when a link starts with ss://, the rest cannot always be split directly at @. If import fails, first check that the link is complete and the method is supported. Don't force one format into another.

3. vmess://: The Base64 Payload Is Usually JSON

A common VMess share format appends Base64-encoded JSON to vmess://. Unlike a typical URL, it does not display the host and port directly. The example below shows the decoded structure for learning purposes; it is not an importable share link.

{
  "v": "2",
  "ps": "Demo-VMess",
  "add": "example.com",
  "port": "443",
  "id": "00000000-0000-4000-8000-000000000001",
  "aid": "0",
  "scy": "auto",
  "net": "ws",
  "type": "none",
  "host": "example.com",
  "path": "/demo",
  "tls": "tls",
  "sni": "example.com"
}

• add, port, and id specify the connection address, port, and user UUID, respectively; ps is a remark.
• net specifies the transport. In this example, ws means WebSocket; path and host must match the server configuration.
• tls and sni describe TLS settings. The TLS name, HTTP Host, and connection address may or may not be the same; don't assume they can be combined based on how they look.
• v is a field in this share format, not the Shadowrocket app version. aid is a VMess parameter; keep the value from the existing configuration.

A missing closing brace, truncated field, or rich-text quotation marks after decoding may mean the data was damaged during copying. Copy the complete link again from the original source instead of guessing at authentication fields. Successfully parsing the JSON only confirms that the format is readable; it does not prove that the server can connect.

4. vless:// and trojan://: Similar Formats, Different Authentication

These links often use a URI structure: authentication details follow the prefix, the server and port come after @, transport or security parameters follow ?, and a remark follows #. Similar-looking links don't make the protocols interchangeable. Changing the prefix cannot convert a service to another protocol.

vless://[email protected]:443?encryption=none&security=tls&type=ws&host=example.com&path=%2Fdemo&sni=example.com#Demo-VLESS

trojan://[email protected]:443?security=tls&type=tcp&sni=example.com#Demo-Trojan

In this example, encryption=none describes a VLESS protocol-layer setting; it does not mean the entire connection has no TLS. Check parameters such as security=tls as well. Other share formats and transport combinations may include fields such as flow. Use the values in the existing configuration; there is no single value to apply to every VLESS link.

URL encoding also affects parsing: %2Fdemo decodes to /demo. Reserved characters in passwords or paths, such as @, #, and &, must be encoded correctly. Don't copy punctuation, line breaks, or quotation marks added by a messaging app, and don't repeatedly decode the entire link or you may change parameter boundaries.

5. Import a Single Link or Subscription into Shadowrocket

The steps below use the common Home screen on iPhone / iPad as a reference. Button layouts may differ on other platforms, but the distinction remains: import a single server or add a Subscribe source. Home manages nodes and connections, Config manages rule configurations, and Settings manages app options. Importing a node link into Config does not add a server to Home.

Import an existing share link

1. Copy the complete link from your own configuration source, from its protocol prefix through the end of the remark.
2. Open Home and use the clipboard import option. If prompted for clipboard access, allow it to continue. If that option isn't available on your platform, use the relevant import menu.
3. If using a QR code, make sure it contains the complete link. Scanning is just an input method; it doesn't change the protocol parameters.
4. After import, open the entry and check its protocol, address, port, authentication, and TLS / transport settings. Then save and select the entry.

Add an existing remote subscription

1. Under Home → +, set Type to Subscribe.
2. Paste the existing subscription URL into URL, enter a recognizable remark, and save. Use the subscription endpoint here, not the provider's homepage.
3. Run the subscription's update action and wait for the request to finish. Then expand the subscription group to check the returned nodes. If the interface uses an icon menu, choose Update.
4. Keep the subscription entry so you can update it later. If you copy just one node and delete the source, the standalone copy won't keep syncing.

6. Verify the Import: Check Parameters Before Rules

A successful import only means the client recognized the data; it doesn't confirm that authentication, transport, or the remote service is working. Select the imported entry, complete any required system connection authorization, and start the connection. Then check the connectivity test and try accessing the intended destination. Test results reflect the method used and are not sustained download speeds.

Scene in Global Routing applies settings for a configured scene; it is not a fifth share protocol. Also check Settings → On Demand when troubleshooting: On Demand may reconnect when its conditions are met, but it won't fix an incorrect UUID, password, or WebSocket path.

7. Common Questions About Share Links and Subscription Imports

Keep the complete source, check fields for the relevant protocol, and update through the subscription entry. Share formats pass connection details; the result still depends on the configuration, network, and remote service.