Download Shadowrocket for macOS

If you have ever used a VPN and wished you could tell it exactly which traffic goes where, Shadowrocket is that wish granted. It is a proxy client built on rules, not just a single tunnel. You set the conditions, and it directs connections accordingly.

Core tools

• Proxy protocols: Shadowsocks, V2Ray, and SOCKS5
• Plugin support: kcptun, cloak, gost, and v2ray plugins
• DNS control: local DNS mapping plus DNS over HTTPS, TLS, and QUIC
• Traffic inspection: record and display HTTP, HTTPS, and DNS requests from your Mac
• Blocking: ad blocking by domain and user-agent rules, plus script filters
• Multi-level proxy server chaining

For server config hands, not one-click seekers

This is not a one-click privacy app. It expects you to know your way around a server config. Developers, network engineers, and anyone who runs their own proxy will feel at home. The interface lets you decrypt HTTPS traffic for debugging, chain proxies together, and write script filters for fine-grained routing. It is a toolbox for people who like to inspect what their network is doing.

Live speed readouts in the menu bar

A few features sit just off the main screen and make daily use smoother. The menu bar icon shows live upload and download speeds for both your direct Wi‑Fi connection and the active proxy. You can toggle proxies on or off from there without opening the full window.

Long-pressing a server in the table brings up a quick menu to duplicate, measure latency, or switch to that server instantly. The import dialogue accepts rule files from iCloud Drive, so you can push a ruleset from an iPhone or iPad and have it appear on the Mac within seconds.

Another subtle touch: the URL rewriter supports capture groups. You can rewrite a request path like /v1/old-endpoint to /v2/new-endpoint without touching the app that sent it. For local development, local DNS mapping lets you point a domain to a staging server while everything else resolves normally.

A QA engineer's afternoon

Imagine someone testing a mobile banking integration from a Mac. They need traffic from the bank’s sandbox domain to route through a dedicated Shadowsocks node, while all other requests go direct. At the same time, they want to inspect every HTTPS call the staging app makes, including headers that a standard proxy would mangle.

They start by importing a rule file that matches the sandbox domain suffix. They chain a SOCKS5 proxy behind the Shadowsocks node for an extra layer of isolation. HTTPS decryption is switched on for the staging domain only, leaving personal traffic untouched. The traffic recording pane shows each DNS query and HTTP response code in real time. When a 403 appears, they open the request details, spot a missing auth header, and rewrite the URL to the correct endpoint on the fly. Twenty minutes later, the integration passes, and they export the session log for a colleague. No other tool on their Mac would let them do all that without juggling three separate apps.

Rule order determines which proxy catches traffic first

• Skipping rule order. Rules evaluate top to bottom, and the first match wins. A broad domain keyword rule placed above a specific domain match will grab traffic you meant to route elsewhere. Drag rules into the order that reflects your intent.
• Leaving HTTPS decryption on globally. It is tempting to flip the switch and forget it, but decrypting everything floods the recording pane and slows throughput. Enable it per domain or leave it off until you need to inspect a specific service.
• Ignoring DNS settings. If you configure a proxy but leave macOS DNS pointing to a local resolver that blocks or redirects queries, you get confusing failures. Use the app’s DNS over HTTPS or DNS over TLS support to keep lookups consistent with your proxy path.
• Forgetting plugin dependencies. kcptun, cloak, and gost sound powerful, but they require the plugin binary to be present on your Mac. A fresh shadowrocket mac install does not bundle them. Download and place them where the app expects before enabling the plugin in a server config.
• Overloading the proxy chain. Chaining three proxies seems clever until latency triples. Start with one hop, measure response times with the speed test, and add layers only when you have a concrete reason.

Debugging microservices with decrypted request inspection

A shadowrocket dmg download attracts a broad audience, but a few groups genuinely need what it offers. Developers debugging microservices benefit from the HTTPS inspection and URL rewriting. The app shows them the exact request their code is sending, not what they assume it sends.

Security researchers who run isolated testing environments lean on script filters and multi-level chaining. They can route traffic through a chain of proxies in different jurisdictions, log every DNS query, and block analytics domains with a single rule set. The GeoIP rule matcher helps them simulate requests from specific countries without spinning up cloud instances.

People who maintain their own Shadowsocks or V2Ray servers get the most polished macOS front-end for their infrastructure. Many proxy server projects ship solid back-end configs but leave the client side to third parties. Shadowrocket fills that gap with a native Mac interface that handles rule import, latency measurement, and traffic statistics in one place. It is the kind of app you reach for after you have outgrown a basic VPN client and want to control routing yourself.

• Fixed UI bugs affecting server tables, the menu bar, and the Dock icon.

• macOS 10.15 or later
• Apple Silicon and Intel Macs