Shadowrocket Node Link Formats: ss://, vmess://, vless://, trojan:// and Subscription URLs

First, distinguish share links from subscription URLs

ss://, vmess://, vless://, and trojan:// are common prefixes for protocol share links. They describe node parameters, not web pages. A QR code is simply a way to encode this text: scanning one does not necessarily import a subscription. The content of the QR code determines what it contains.

Subscription URLs commonly use https://, for example, https://example.com/sub?token=xxxx. Shadowrocket needs to request this URL and parse the response. An HTTPS prefix alone does not confirm that a URL is a subscription: login pages, error pages, and ordinary websites also use HTTPS. Check the original provider's instructions and the import result.

Node subscriptions and rule configurations in Config are different things. A subscription primarily manages connection entries, while a configuration controls behavior such as rules. Importing nodes does not automatically create DOMAIN-SUFFIX, IP-CIDR, or FINAL rules.

ss://: Decode the authentication data, then check the port

A common SIP002 format for Shadowsocks share links Base64-encodes the encryption method and password together, followed by the server address, port, and optional parameters. In the example below, the decoded authentication data is aes-128-gcm:password. 8388 is an illustrative port, not a required fixed value.

ss://[email protected]:8388#Demo-SS

Decoded authentication data:
aes-128-gcm:password

Corresponding fields:
method = aes-128-gcm
password = password
server = example.com
port = 8388

• The authentication data before @ contains the method and password. Do not enter the entire Base64 string as the password.
• #Demo-SS is a remark. Changing it will not fix a mismatch in the password, port, or encryption method.
• Some older links encode the entire method:password@server:port string. Others use URL-safe Base64 or omit the trailing padding. Preserve the original text when identifying a link; do not add characters based on appearance alone.
• If a plugin parameter is present, check whether the app supports the corresponding plugin and options. Keeping only the address and password may omit settings required for the connection.

Base64 is an encoding, not a security measure. Anyone who can read a link can usually recover its authentication data. For troubleshooting, note the Type, port, and any additional parameters, but do not post a complete share link in a public forum or paste it into an online decoder.

vmess://: Commonly contains Base64-encoded JSON

A common VMess share-link format places Base64-encoded JSON after vmess://. The example below shows the decoded structure; it is not a complete share link that you can paste to import. The JSON field names are common in share formats and may not exactly match the labels shown in the editing screen.

{
  "v": "2",
  "ps": "Demo-VMess",
  "add": "example.com",
  "port": "443",
  "id": "00000000-0000-4000-8000-000000000001",
  "aid": "0",
  "scy": "auto",
  "net": "ws",
  "type": "none",
  "host": "example.com",
  "path": "/demo",
  "tls": "tls",
  "sni": "example.com"
}

Here, v identifies the share-data format, not the Shadowrocket version. add and port specify the connection address and port; id is the UUID; and aid corresponds to alterId, with an example value of 0. Do not change these authentication fields just to make the link “look right.”

Port 443 does not by itself mean TLS is enabled, nor does it mean the transport must be WebSocket. In the example, net, tls, and the port are separate settings. After importing, check each one in the node editor.

vless:// and trojan://: Same authentication position, different meaning

These links often use a URI structure: authentication data comes before @, followed by the server and port; parameters follow the question mark, and a remark follows the hash. VLESS typically uses a UUID for authentication, while Trojan uses a password. Changing only the link prefix cannot convert one protocol into the other.

vless://[email protected]:443?encryption=none&security=tls&type=ws&host=example.com&path=%2Fdemo&sni=example.com#Demo-VLESS

trojan://[email protected]:443?security=tls&type=tcp&sni=example.com#Demo-Trojan

• encryption=none is a VLESS protocol parameter; it does not mean the entire connection necessarily lacks transport-layer protection. The example separately specifies security=tls.
• type=ws and type=tcp specify the transport. Do not ignore them just because the UUID or password is correct.
• path=%2Fdemo uses percent encoding; the decoded path is /demo. Preserve the encoded form when copying to avoid repeatedly decoding it by hand.
• If a Trojan password contains reserved characters such as @ or #, they must be encoded correctly. For example, @ in a password can be encoded as %40; otherwise, it may be mistaken for a URI separator.
• Some links include additional security or transport parameters. Do not remove unfamiliar fields just to shorten a link. First compare them with the original parameters for your existing service and the options available in the app.

Import from Home: Preserve the original text and subscription association

Get the original text from the management page for a service you already use. Avoid copying an entire message with explanatory text. Do not include quotation marks, non-ASCII punctuation, spaces, or line breaks added by a messaging app in a share link. If a QR code contains a subscription URL, handle it as a subscription rather than creating a regular protocol entry.

1. Identify the input type. A protocol prefix identifies a single connection; for an existing subscription, use the complete subscription URL specified by the original provider.
2. Copy the complete content and use the clipboard import prompt on Home. To scan a QR code, use the scanner on Home. Check what Shadowrocket identifies before importing.
3. To add an entry manually, tap + on Home to open Add Server. For a single node, select the matching Type and check its fields. For a subscription, set Type to Subscribe and enter the complete address in URL.
4. After saving, return to Home. For a single node, check the parameters in its editing screen. For a subscription, confirm that the expected group appears and that its entry count and names match the content provided by your existing service.
5. Update a subscription using the update action for its group. After updating, check the currently selected entry again, especially if the original entry was removed, renamed, or replaced.

Successful subscription updates depend on a valid URL, unexpired access credentials, network access to the URL, and a response format that can be parsed. An HTTP request may succeed but return only a login page, so being able to open the URL does not replace checking the import result.

After importing: Check connectivity and Global Routing

If an entry appears on Home but websites will not load, first check the selected entry and connection status, then review Global Routing. A node link provides connection parameters; Global Routing determines how traffic is handled. Repeatedly changing the UUID under the wrong routing mode will not help identify the original problem.

Change only one variable at a time when troubleshooting. If the same destination works temporarily with Proxy but not with Config, check the rule order and policies in the configuration. If both fail, check authentication, TLS, transport, service status, and network reachability one by one. Restore the intended mode when testing is complete.

Common link import issues: Diagnose by symptom

After identifying, importing, and testing the connection, set up usage preferences such as automatic connections. Settings → On Demand controls on-demand connections; it does not fix an invalid share link or update expired authentication information for you.