Shadowsocks Client: How to Choose, Set Up and Use It in 2026

A Shadowsocks client is the app on your device that connects to a Shadowsocks server and passes your traffic through an encrypted tunnel. You need one whenever someone gives you an ss:// link, a QR code or a set of server details, and the choice of app matters more than it seems: half the clients that older guides recommend haven’t been updated in years, and some can’t talk to modern servers at all.

For most people the answer is short. Outline is the easiest free option on every platform, shadowsocks-android gives more control on Android, and sslocal from shadowsocks-rust covers Linux, servers and routers. Below we check which clients are still alive in 2026, take an ss:// link apart, set up each platform and then confirm that your traffic really leaves through the server, because a green “connected” icon on its own doesn’t prove that.

What a Shadowsocks client actually does#

Shadowsocks is an encrypted proxy protocol. It first appeared in 2012 as a way to reach sites that are unavailable in some regions, and it is now one of the most widely deployed protocols for restricted networks. A setup always has two halves: a server on an unrestricted network and a client on your device.

The client does three jobs:

1. It opens a local proxy. The client listens on your own machine, usually as a SOCKS5 proxy on 127.0.0.1:1080. Some clients also open an HTTP proxy or a system-wide VPN interface.
2. It encrypts and forwards. Every connection your apps send to that local proxy is encrypted with the shared key and sent on to the Shadowsocks server.
3. It decides what goes through the tunnel. Depending on the mode, that can be all traffic, only traffic that matches rules, or only the apps you point at it.

On the other end, the server decrypts the traffic and opens the real connection to the website. The website sees the server’s IP address instead of yours, while your internet provider only sees an encrypted stream to a single server with no visible proxy handshake.

Browser / app
   │  plain SOCKS5 or HTTP (only on your device)
   ▼
Shadowsocks client  127.0.0.1:1080
   │  encrypted Shadowsocks stream
   ▼
Shadowsocks server  (your VPS or provider)
   │  normal HTTPS
   ▼
Website

Two common assumptions about Shadowsocks are wrong:

• It isn’t a SOCKS5 proxy. The client speaks SOCKS5 to your apps, but the link to the server uses a different, encrypted protocol. That’s why you can’t point a Shadowsocks client at an ordinary SOCKS5 server, or the other way round.
• It isn’t a full VPN by default. In its basic mode only the apps that use the local proxy are tunneled, and apps that ignore proxy settings go out directly. To cover the whole device, you switch the client to VPN (TUN) mode.

Best Shadowsocks clients in 2026#

Many lists still recommend clients that were abandoned long ago, so we checked the release history of each one in October 2026. The table shows where they stand.

Official and single-protocol clients#

Client	Platforms	Shadowsocks 2022 ciphers	Plugins	Status in 2026
Outline Client	Windows, macOS, Linux, Android, iOS, ChromeOS	No, classic ciphers only	No	Actively developed; run by the nonprofit Outline Foundation since January 2026
shadowsocks-android	Android	Yes	Yes, as separate apps	Maintained on GitHub (v5.3.4); the Google Play listing hasn’t been updated since 2021
ShadowsocksX-NG	macOS	No	Yes	Last release v1.10.3 in October 2024; runs natively on Apple Silicon
shadowsocks-rust (sslocal)	Linux, macOS, Windows, routers	Yes	Yes	The reference implementation, with regular releases (v1.25.0)
Shadowsocks for Windows	Windows	No	Yes	Still works, but the last release (4.4.1.0) dates from February 2022
shadowsocks-libev, now shadowsocks-c	Linux, routers	Not in a release yet	Yes	Revived under a new name; v3.3.6 came out in February 2026
shadowsocks-qt5	Linux, Windows	No	No	Abandoned; use sslocal or a multi-protocol app instead
Python shadowsocks (pip)	Any	No	No	Abandoned years ago, so don’t use it
ShadowsocksR (SSR)	Various	No	No	A dead fork with its own protocol that modern servers don’t accept

Multi-protocol clients that also speak Shadowsocks#

If you might later need VLESS, Trojan or Hysteria, a single app can handle all of them along with Shadowsocks:

• Desktop: Clash Verge Rev, which is built on the mihomo core, and v2rayN.
• Android: NekoBox, Hiddify and the official sing-box app. NekoBox updates slowly and its Google Play listing is run by a third party, so install it from GitHub.
• iOS: the free sing-box MT app, which the sing-box documentation links to, and Potatso, which is still updated in the App Store even though its old open-source repository is abandoned. Paid apps such as Shadowrocket, Stash and Surge add rule-based routing on top.

sing-box and mihomo both support Shadowsocks 2022 ciphers. They also have the common plugins built in, so you don’t install them as separate programs.

Quick picks#

• Easiest on any device: Outline. You paste a key and press Connect.
• Android with full control: shadowsocks-android.
• Mac: ShadowsocksX-NG, or Clash Verge Rev if you want routing rules and newer ciphers.
• Linux, servers and routers: sslocal from shadowsocks-rust.
• iPhone: Outline for free, or a rule-based app if you need per-site routing, which Outline doesn’t offer.

What you need from the server#

Every Shadowsocks client needs the same four values, whether you type them in or import them:

Field	Example	Notes
Server	203.0.113.10	IP address or domain name
Port	8388	Any port the server listens on; 443 is common
Password / key	Secret0	Must match the server exactly
Cipher (method)	chacha20-ietf-poly1305	Must match the server exactly

A wrong cipher or password doesn’t produce a clear error. The client connects and then nothing loads, which makes it the most common setup problem by far.

Reading an ss:// link#

Providers and server panels usually hand you all four values as one link in the SIP002 format, often with a QR code next to it:

ss://Y2hhY2hhMjAtaWV0Zi1wb2x5MTMwNTpTZWNyZXQw@203.0.113.10:8388#Frankfurt

Part	Meaning
ss://	The scheme every Shadowsocks client recognizes
Y2hhY2hh…	The cipher and password, chacha20-ietf-poly1305:Secret0, encoded in URL-safe Base64
@203.0.113.10:8388	Server address and port
#Frankfurt	A label shown in the app that doesn’t affect the connection

You can decode the middle part to check what you were given with echo Y2hhY2hh… | base64 -d. Links for Shadowsocks 2022 ciphers look different, because the specification forbids Base64 there: the cipher and key are written in plain text, with special characters percent-encoded. If the server uses a plugin, the link gets a /?plugin= parameter after the port.

You may also meet two other formats that hand out servers through a URL:

• SIP008 subscription URLs. This is an HTTPS link that returns a JSON list of servers. The client downloads it again from time to time (shadowsocks-rust does it hourly by default), so the provider can change servers without sending you new links.
• Outline ssconf:// keys. These are Outline’s dynamic access keys. The app swaps ssconf:// for https:// and fetches the current server details from that address.

Treat any of these like a password, since anyone who has the link can use your server.

Which cipher to use#

Cipher	Family	Use it?
2022-blake3-aes-128-gcm, 2022-blake3-aes-256-gcm, 2022-blake3-chacha20-poly1305	Shadowsocks 2022	Yes, if both client and server support it. Replay protection is built in.
chacha20-ietf-poly1305	Classic AEAD	Yes. Every compliant client must support it, and it’s the fastest choice on phones and routers.
aes-256-gcm, aes-128-gcm	Classic AEAD	Yes. Fastest on PCs with hardware AES.
aes-256-cfb, aes-128-ctr, rc4-md5, salsa20 and other stream ciphers	Legacy	No. They have no integrity check, and the project itself calls them completely broken.

Stream ciphers aren’t a theoretical risk. A 2020 attack showed that someone who recorded your traffic could get it decrypted by a server that still uses a stream cipher with the same password.

Shadowsocks 2022 also changes how keys work, because it doesn’t accept an arbitrary password. The key must be random bytes in Base64, 16 bytes for 2022-blake3-aes-128-gcm and 32 bytes for the other two, so you generate it with openssl rand -base64 16 or openssl rand -base64 32. The protocol checks timestamps as well and treats any message more than 30 seconds off as a replay. In practice that means a device clock that has drifted by half a minute makes every connection fail.

How to set up a Shadowsocks client#

Copy your ss:// link first. Every client below can import it, which saves you from typing the cipher and key by hand.

Windows#

The simplest option is Outline:

1. Download Outline Client for Windows from the Outline website and install it.
2. Click Add server, paste the ss:// link or access key into the Paste access key here field and confirm.
3. Click Connect and approve the network prompt the first time. From then on, all traffic goes through the tunnel.

The classic option is Shadowsocks for Windows:

1. Download the latest ZIP from the project’s GitHub releases page and unzip it to a folder you’ll keep.
2. Install .NET Framework 4.8 and the Visual C++ 2015 Redistributable (x86) if Windows doesn’t have them, then run Shadowsocks.exe.
3. Right-click the paper-plane icon in the tray, open Servers and choose Import URL from Clipboard…, or add the server by hand in Edit Servers….
4. Under System Proxy, choose PAC to send only listed sites through the tunnel, or Global to send everything.

macOS#

1. Download ShadowsocksX-NG.dmg from the GitHub releases page and drag the app to Applications. If macOS refuses to open it the first time, allow it in System Settings → Privacy & Security.
2. In the menu-bar icon, choose Import Server URLs… or Scan QR Code From Screen. You can also enter the values in Server Preferences….
3. Turn Shadowsocks on and pick a mode: Auto Mode By PAC, Global Mode, or Manual Mode, where only apps you configure yourself use the tunnel.

Linux (and routers, servers, Docker)#

On Linux, use sslocal from shadowsocks-rust. You can install it from your package manager, with snap install shadowsocks-rust or brew install shadowsocks-rust, or download a release binary.

The quickest start takes the link directly:

sslocal -b 127.0.0.1:1080 --server-url "ss://Y2hhY2hh...@203.0.113.10:8388"

For a permanent setup, put the values in a config file:

{
  "server": "203.0.113.10",
  "server_port": 8388,
  "password": "Secret0",
  "method": "chacha20-ietf-poly1305",
  "local_address": "127.0.0.1",
  "local_port": 1080
}

sslocal -c config.json                    # SOCKS5 proxy on 127.0.0.1:1080
sslocal -c config.json --protocol http    # HTTP proxy instead

The snap package also ships an sslocal-daemon service that you can enable with systemd, and there is an official Docker image, ghcr.io/shadowsocks/sslocal-rust.

Android#

1. Install shadowsocks-android from its GitHub releases page. The Google Play version still works but hasn’t been updated since 2021.
2. Tap the add-profile icon at the top and choose Scan QR code, Import from Clipboard or Manual Settings.
3. Select the profile and tap the round connect button, then accept the VPN request.
4. In the profile settings, set Route (for example, Bypass LAN keeps local addresses out of the tunnel). If only some apps should use the tunnel, turn on Apps VPN mode and pick them.

iPhone and iPad#

1. Install Outline from the App Store.
2. Copy the ss:// link. Outline offers to add it when you open the app, or you can tap Add server and paste it.
3. Tap Connect and allow the VPN configuration.

Rule-based apps such as Shadowrocket or Potatso work the same way: you add a server by pasting the link or scanning the QR code, then switch it on. The difference is that they can send only chosen sites through the tunnel, while Outline always tunnels everything.

Routing modes: what actually goes through the tunnel#

The mode decides which traffic uses Shadowsocks, and picking the wrong one is the second most common reason a “working” client seems to do nothing.

Mode	What is tunneled	Good for
Manual	Only apps you point at 127.0.0.1:1080	Scripts, one browser profile, testing
Global (system proxy)	Every app that respects the system proxy setting	Browsing with the whole browser tunneled
PAC / Auto / rules	Only domains on a list, while everything else goes direct	Keeping local sites fast while foreign ones use the tunnel
VPN / TUN	All traffic from the device, including UDP and apps that ignore proxy settings	Games, messengers, phones and anything that “doesn’t see” the proxy

Outline and the mobile apps always work in VPN mode. Classic desktop clients default to the system proxy, while multi-protocol apps such as Clash Verge Rev and v2rayN let you switch on a TUN mode.

Using the local proxy in specific apps#

• Firefox: open Settings, search for “proxy” and click Configure proxy in the Proxy settings section. Choose Manual proxy configuration, enter 127.0.0.1 and port 1080 as the SOCKS Host, select SOCKS v5 and make sure Proxy DNS when using SOCKS v5 is ticked. Recent versions tick it by default, and without it DNS requests bypass the tunnel.
• Chrome and Edge: they follow the system proxy. To tunnel just one browser, start it with --proxy-server="socks5://127.0.0.1:1080". With SOCKS5, Chrome always resolves domain names on the proxy side, so DNS doesn’t leak.
• Browser extensions: a proxy switcher lets you send only chosen sites through 127.0.0.1:1080 and change rules in one click. The original Proxy SwitchyOmega no longer works in current Chrome, and its maintained fork is ZeroOmega. The Chrome Web Store also lists a fake “SwitchyOmega V3”, so check the publisher before you install. In Firefox, check that the extension’s remote DNS option is on.
• Command line: use curl --socks5-hostname 127.0.0.1:1080 …, or set ALL_PROXY=socks5h://127.0.0.1:1080. Many tools only understand HTTP proxies, and for those you can run sslocal with --protocol http.
• Git: git config --global http.proxy socks5h://127.0.0.1:1080.

The h in socks5h matters, because it tells the tool to resolve domain names through the proxy instead of your local DNS.

Check that it really works#

A green icon only means the client started. To see where your traffic goes, run one command:

curl --socks5-hostname 127.0.0.1:1080 https://ifconfig.me

It should print your Shadowsocks server’s IP address rather than your own. In VPN mode, run plain curl https://ifconfig.me without the proxy flag. After that, open a DNS leak test in your browser: the DNS servers it lists should belong to the server’s network or a public resolver, not to your home internet provider.

Plugins, and how detectable Shadowsocks is in 2026#

Plugins#

Shadowsocks can hand its traffic to a plugin, defined by the SIP003 standard, which wraps it in another transport. The plugin runs on both ends, so the client needs the same plugin as the server, with settings that match it (for v2ray-plugin, the same host, path and TLS choice). Only one plugin can run at a time, and plugins carry TCP traffic only.

Plugin	What it does	Notes
v2ray-plugin	Wraps traffic in WebSocket, optionally with TLS	Can run behind a CDN or a normal web server on port 443
kcptun	Sends traffic over a UDP-based protocol tuned for lossy links	Helps on unstable mobile or long-distance connections, at the cost of more bandwidth
simple-obfs	Disguises traffic as plain HTTP or TLS	Deprecated; use v2ray-plugin instead
Cloak	Makes the server look like an ordinary HTTPS site to probes	Needs its own client and server setup

Outline and many iOS apps don’t run plugins. If your server uses one, pick a client that has “Yes” in the plugins column of the table above, or a multi-protocol app with the plugin built in.

Can Shadowsocks be detected?#

Yes, by well-equipped network filters. Shadowsocks has no handshake in plain sight: the first packet already carries encrypted data, so the whole stream looks like random bytes. That design is also its weak spot. In November 2021, filtering systems in regions with restrictions began dropping connections whose first packet looks “too random”.

A team of researchers from several US universities described how that works in a paper at USENIX Security 2023. The system applies simple rules to the first data packet, such as the share of printable characters, and checks only about a quarter of connections. The authors estimated it could still catch about 0.6% of normal internet traffic as collateral damage. In response, shadowsocks-rust added configurable payload prefixes in early 2022, and Outline added a similar “prefix” option to its client later that year.

Here’s what that means in practice:

• On ordinary networks, such as hotel and café Wi-Fi, office firewalls or a work trip, plain Shadowsocks with a modern AEAD or 2022 cipher works well.
• In regions with restrictions, no protocol stays reachable forever. Protocols that imitate real TLS traffic, such as VLESS with Reality or Trojan, often last longer now, and a multi-protocol client lets you switch without reinstalling anything.
• For privacy, keep in mind that Shadowsocks has no forward secrecy, even in the 2022 edition. Anyone who records your traffic and later gets the key can decrypt it, so rotate keys and don’t share links widely.

Troubleshooting#

Symptom	Likely cause	Fix
Connected, but no site loads	Cipher or password doesn’t match the server	Re-import the ss:// link instead of typing values, or decode it to compare
Connection times out	Server down, wrong port, or the port is closed on your network	Check that the server is running and try another port, such as 443
Browser works, other apps don’t	Those apps ignore the system proxy	Switch to VPN/TUN mode, or set the app’s own proxy setting
Sites still show your real country	DNS or traffic bypasses the tunnel	Use socks5h, tick “Proxy DNS” in Firefox, or switch to VPN mode
Every connection fails with a 2022 cipher	The key isn’t valid Base64 of 16 or 32 bytes, or the device clock is more than 30 seconds off	Regenerate the key with openssl rand -base64 32 (16 for aes-128) and sync the clock
“Unsupported method” error	The client doesn’t know the cipher	Update the client, or use chacha20-ietf-poly1305 on both ends
A plugin server won’t connect	The client has no plugin, or its settings differ from the server’s	Install the same plugin with matching host, path and TLS settings, or use a client with plugin support
Works for a few minutes, then stops	Filtering or throttling on the network	Try a plugin, another port, or a TLS-based protocol
Slow speeds	Distant server, overloaded VPS, or a lossy mobile link	Pick a closer server, and try kcptun on unstable connections

Shadowsocks vs SOCKS5 proxy vs VPN#

These three solve different problems, and people often pick the wrong one.

	Shadowsocks	SOCKS5 proxy	VPN (WireGuard, OpenVPN)
Encryption to the server	Yes	No; traffic and login are visible on the wire	Yes
Looks like	Random bytes, no handshake	A recognizable proxy handshake	A recognizable VPN handshake
Covers	Apps using the local proxy, or the whole device in TUN mode	Apps you configure	The whole device
Typical setup	One private server shared by a few people	Many IPs from a provider	One server or a provider’s network
Best for	Filtered networks and regions with restrictions	Scraping, automation, multi-account work, geo-testing	Everyday privacy on untrusted networks

Shadowsocks gives you one encrypted tunnel that is hard to spot, but only one exit address. Data collection and automation need the opposite, many exit IPs without the encryption overhead, and for that task SOCKS5 proxies are the better fit. If you just want to protect a whole device on public Wi-Fi, a VPN such as FineVPN is simpler than running your own Shadowsocks server.