Shadowrocket Backup and Transfer to a New iPhone: iCloud Sync and Config File Export

At a glance

This guide is for users with an existing provider and subscription who are preparing to switch iPhones. Save connection details from Home, rule files from Config, and device preferences from Settings separately, then check what can actually be restored from iCloud. Follow a set order to restore subscriptions, enable rules, and authorize the VPN again. Don’t assume that redownloading the app restores all your configuration.

1. Sort out what to back up before switching

The Shadowrocket purchase, connection details, and rule files are separate items. Redownloading the app from the App Store takes care of getting the app; you still need to check the servers, subscription URLs, and current selection in Home, along with the files in use in Config. A one-time app purchase does not include a service plan. Your subscription access and validity are managed by your own provider.

Don’t assume that a single .conf file contains everything. A config file may include rules, DNS settings, and some connection definitions, or it may rely on servers saved separately in Home or on remote resources. What the file actually contains determines what you can restore from it.

Connections and subscriptions

Where to check: Home
What to save: Existing subscription URLs, manually added servers, and authentication details
Additional notes: Group names, selected server, and manual changes
Sensitive information: Subscription tokens, passwords, and Private Keys

Check subscription URLs and manually added servers separately so you don’t overlook local entries when updating a subscription.

Rules and device preferences

Where to check: Config and Settings
File contents: Current config, rule order, DNS, and resource references
Runtime mode: Current Global Routing selection
Automatic connection: Settings → On Demand

Check VPN authorization and On Demand conditions again on the new device.

Keep a short checklist of the active config file name, the Global Routing selection, and whether On Demand is enabled. It doesn’t need to include passwords; store authentication details somewhere secure. This makes it clear what’s missing if only some items sync.

2. What iCloud sync, file storage, and device backups cover

“Saved to iCloud” can mean at least three different things: iCloud sync within the app, exported files stored in iCloud Drive, or an iPhone iCloud backup. Each has a different restore path and scope. Saving a file to iCloud Drive does not mean everything in Home syncs automatically.

Storage method	What to check	What to check after switching
In-app iCloud sync	Check the items listed in the app’s current sync options; don’t assume all of Settings is included	Use the same iCloud account and check the results in Home and Config item by item
iCloud Drive files	Stores the exported file contents, not device state beyond the file	Make sure the file has uploaded in Files, then open it and check its contents
iCloud backup	Depends on system backup settings, whether the backup completed, and which app data can be restored	Check the results during device restoration, then verify VPN authorization and the current config separately

On your old iPhone, open Settings, tap your Apple Account → iCloud, and check iCloud Drive and the relevant app permissions. System menu names may vary. If you use in-app sync, first check which items Shadowrocket actually offers to sync, then confirm they appear on the new device. Signing in or turning on a switch alone doesn’t prove that syncing is complete.

After saving a file to iCloud Drive, wait for the upload to finish in Files, then open that same file on the new device. Verify app sync by checking that the files and entries actually appear there. Sync propagates changes, so accidental deletions or overwrites may sync too. Keep a separate exported copy that isn’t changed during everyday editing.

Bottom line: verify the copy opens before wiping the old device

Don’t erase the old iPhone until the new one can read the exported file, recognize the existing subscription, and complete a connection check. Seeing that iCloud is turned on isn’t enough to confirm a successful backup.

3. Export a file from Config and save a separate copy

On the old device, open Config and identify the config currently in use before exporting anything—not just the first item in the list. Files with the same name may come from different sources. Check for your custom rules and DNS settings to avoid saving an old file that isn’t enabled.

Open Config, note the name of the active file, and open it to confirm your custom content is there.
Open the file’s action menu and use the available share or export option. Button labels and locations may vary; copying a remote URL is not the same as exporting a local file.
In the system share sheet, choose “Save to Files” and save the file to an iCloud Drive folder you control. You can also save another copy in a secure local location.
Use a recognizable filename, such as shadowrocket-before-move.conf. Keep the original, and don’t overwrite your only copy with a test file.
Open the copy in Files. Confirm it isn’t empty and contains the expected rule sections and custom entries.

If an exported config references remote rule resources, the local file usually saves the references, not the full contents of those resources. The new device may still need an internet connection to fetch them. If the file contains server credentials, sharing it could expose access to those connections, so limit who can access it.

For manually added entries such as WireGuard or Trojan, also check the authentication details required by the protocol. With WireGuard, for example, the Peer Public Key cannot replace the local Private Key. If you can no longer retrieve the original details, ask your own provider how to restore them. Don’t fill in missing fields with arbitrary values.

4. Restore on the new iPhone in dependency order

On the new iPhone, open the App Store and use the Apple Account originally used for the purchase to find and redownload Shadowrocket from your purchased apps. Your iCloud account and App Store purchase account can be different: the former affects sync and file access, while the latter determines access to your purchase history. Check the App Store page for system requirements and purchase availability.

To verify the app, visit the genuine app verification guide. Confirm the developer is Shadow Launch Technology Limited, the app ID is 932747118, and the icon matches the official one. The App Store is the app’s source. Once it’s downloaded, continue with data recovery.

Redownload the app Open the backup Restore connection details Enable the rules file Test the connection

Check sync first. Open Home and Config to see whether the original entries and files are already there. Don’t import duplicates right away.
Restore connection details next. If the subscription is missing, tap Subscribe in Home, enter the existing URL you saved, and update it. Restore manually added servers from your backup, one by one.
Import the rules file. Find the exported .conf in Files and open it with Shadowrocket using the system share sheet or “Open With.” You can also use the file import option currently available in Config.
Make sure the file is enabled. A file appearing in the Config list doesn’t mean it’s the active config. Select the restored file and check that its policy references match your current connection details.
Restore the runtime mode. To route traffic by rules, go to Home → Global Routing and select Config. Proxy, Direct, Config, and Scene are different runtime modes. Don’t infer the old setup from the connection switch alone.
Connect last. When you connect for the first time, follow the system prompt to allow Shadowrocket to add a VPN configuration. After manually verifying the connection, check Settings → On Demand and restore conditions suited to the new device’s network environment.

If you rely on Scene for network conditions or policy settings, check separately that the scene has been restored. If you’re unsure what it contains, verify the confirmed Config first, then adjust automation conditions. Avoid changing several variables at once.

5. Verify subscriptions, rules, and automatic connection

For the first round of checks, aim to match the backup; don’t rely on speed-test results alone. A successful subscription update means the URL is reachable on the current network. A successful server connection means the connection details are basically usable. A request matching the expected rule confirms that the rules and runtime mode are working together. Verify all three separately.

Subscription check: Confirm that group names and entries match your existing service details. If an update succeeds but the number of entries changes, first check what your provider currently returns. That alone doesn’t mean the local backup is damaged.
Authentication check: Compare the domain, port, password, and TLS fields with the original details. If the original entry used port 443, restore that value; don’t change every entry to 443 just because it’s common in examples.
Rules check: Confirm that the restored file is enabled in Config, Global Routing is set to Config, and request records show the expected rule and policy.
Network check: Test on both your usual Wi-Fi and cellular network. Change one condition at a time and note whether the failure is in name resolution, the server connection, or access to the destination.
Automatic connection check: Once manual connection works, test On Demand. Wi-Fi conditions from the old device may not suit the new one; in particular, check that the network name matches.

The example below shows only the rule order syntax. Use it to compare the Rule content in your backup; it is not a complete importable config. DIRECT means a direct connection, and PROXY means a proxy policy. Actual outbound traffic also depends on the current config and selected server.

[Rule]
DOMAIN-SUFFIX,example.com,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
GEOIP,CN,DIRECT
FINAL,PROXY

DOMAIN-SUFFIX matches a domain and its subdomains; IP-CIDR matches an IP range; GEOIP matches based on the IP address’s region; FINAL handles requests that don’t match any preceding rule. Rules are evaluated from top to bottom. Preserve their original order when restoring—checking that all the keywords are present isn’t enough.

6. Common questions about restoring Shadowrocket on a new iPhone

Why is Home empty even though the new phone has a config file?

Open the file and check that it actually contains connection definitions. If it only has rules and DNS settings, go back to Home and add your existing subscription with Subscribe, or restore your manually added servers. Then check that the policies referenced by the rules are available. An empty list doesn’t mean your app purchase is no longer valid.

Why can’t I see my old config after signing in to iCloud?

Check the iCloud account, iCloud Drive, and relevant app permissions in Settings, then confirm that the files from the old device finished uploading. If you use in-app sync, check which items it actually syncs. If something is still missing, restore it from your separate exported file. Don’t delete the original file on the old device first.

Why did my local changes disappear after I restored the subscription and updated it?

Updating a subscription refreshes the entries it manages based on the content returned by the remote source, and may overwrite local changes to those entries. Compare the differences with your old device’s records first. Keep manual settings you want to retain long term separate from subscription-managed content, and use the parameters provided by your service provider.

Why does the new phone ask me to authorize the VPN the first time I connect?

Importing a config file and authorizing a system VPN are separate steps. Make sure you’re using Shadowrocket, follow the system prompts to grant authorization, then start a connection from Home. If automatic connection behaves unexpectedly, check the conditions in Settings → On Demand. Repeatedly importing the file won’t fix an authorization issue.

Can I delete the old backup as soon as the new device is set up?

First check that the subscription updates, a manual connection works, the expected rules match, and switching between your usual networks works. Then tidy up the old device. Keep a separate copy somewhere secure. If a subscription token or key has been exposed, ask your own provider to replace the credentials and update the backup you keep.