It can do no more than the slice iOS gives a personal VPN.

After connect, most apps’ outbound TCP / UDP enters the tunnel. Some system processes and some apps detect “VPN is connected” or use their own path. The client cannot force every binary into the virtual interface, and cannot change other apps.

The pattern: Data is rising, one App still fails — when isolating, separate “the record is unavailable” from “this App refuses the tunnel.” The former fails in other apps too when policy is Proxy; the latter is only this app failing, while a browser or another client works under Proxy.

On consumer devices a personal VPN is usually whole-device, not “proxy only this App.” There is no general switch in Shadowrocket that lets the system split by app icon. Splitting by domain is the rule engine; see Rules.

Low Power Mode, turning off Background App Refresh, Airplane Mode, and Wi-Fi / cellular handoff all pause or exit the extension. Afterward you flip the switch again, or wait for the system to bring it up on demand. Reinstalling the app does not fix this; a reinstall cannot restore a session the system already reclaimed.

On managed devices MDM can forbid personal VPN. Screen Time can restrict VPN too. In both cases, no amount of flipping the in-app switch will make the system create the extension. Denying the permission prompt, or later deleting the Shadowrocket VPN configuration in Settings, has the same effect: the switch has nothing to attach to.

Refreshing a container or rules in the background depends on the system still allowing this app to run in the background. After Background App Refresh is off, a fetch happens only when you bring the app to the foreground. Low Power Mode tightens this further. Before you treat “the list did not update” as a dead URL, see whether the system let it run.

Hotels, airports, and campus networks often show a login page first (Captive Portal). Until that page is finished, the device has no real outbound. With the switch on and policy Proxy, the login page may not open, auth never completes, and the tunnel has no network to forward. Use Direct, or turn the switch off, let the system open the login page, then start the tunnel.

When another VPN app is connected, iOS usually will not hand traffic to Shadowrocket. This app’s switch can still be on while bytes never enter this extension, and both Data counters stay still. When isolating a failure, look first at which VPN is active in system Settings — not at swapping records.

Routing, browsing, and calling APIs do not depend on HTTPS decryption. Rules look at hostname and destination address; they do not need to open encrypted content. Rewrite that only touches a URL or a cleartext header does not always need decryption either.

You need decryption only to inspect or rewrite HTTPS content, and it installs a user profile. That weakens the device default of trusting only system roots: the on-device extension can see content that was meant for the far end alone. Remove the profile when you are done. Do not leave a decryption certificate on a daily driver, or on a device that holds banking and passwords.

If the certificate is missing, expired, or untrusted, hosts on the decrypt list fail handshake and look like a dead record. Turn decryption off and isolate: if other visits recover, the problem is the certificate, not the exit.

The app cannot extend a URL’s lifetime, pay a server bill, turn a failed handshake into a working record, or override a carrier or a site’s own access policy. Connection quality is jointly decided by the local network, the remote behind that record, and the far-end service.

There is no official Android, Windows, or macOS client. Software on other systems that can fill the same protocol fields is still not Shadowrocket, and a rule file is not guaranteed to open there. This site does not host those installers.

Configuration lives on the device, optionally synced to your own iCloud. There is no account system; the developer does not hold your list. Export files contain credentials; treat them as secrets. See Config and Store.