Open source · Android client actively maintained

Clash for AndroidDownloads & Setup

Download Clash View the guide

From subscription import to rule-based routing, follow Android system prompts to grant access, then connect to your proxy service.

Open-source codeRule configurationDocumentation
ClashVPN on
Rule modeRule
SubscriptionAuto-update
Battery optimizationUnrestricted

Clash Meta for Android
Proxy service running

Illustration · Actual settings may vary by client and system

Configuration format YAML Rule engine mihomo Android interface VpnService

Rule-based routing and system integration

First identify how traffic reaches the client, then check which outbound route the configuration assigns. Service startup, available nodes, and rule matching are separate steps.

Rule mode: Choose an outbound route per connection

Rule-based routing · mihomo core

Open the client's mode selector and choose Rule. It checks each connection against the rules in your configuration, then sends it to a direct route, a proxy group, or a reject rule. A proxy group contains multiple outbound options; selecting a node does not mean every connection will use it. To verify that rules are working, open the connection log and check the destination domain, matched rule, and final route—not just the VPN icon in the status bar.

Keep everyday sites on a direct route and send connections that need a proxy to the appropriate group. Place custom rules carefully, especially around existing LAN rules. If only one app is affected, check its connection log before changing rules for the relevant domain or app. Routing all connections through a proxy may also disrupt access to local network devices.

Find the rule from the match result

Find the site you just opened on the Connections page and check its rule and policy chain. If it matches the final fallback rule, earlier entries probably did not match the destination. Domain and IP rules evaluate different targets, and DNS resolution can affect the result. Note the original rule, change one thing at a time, then reconnect. Existing connections may keep their previous route, so reopen the page after switching policies. This makes it easier to distinguish a rule issue from a remote connection problem than repeatedly changing nodes.

VpnService permission

Android system feature · Local VPN interface

The first time you tap Start, Android displays a VPN connection request. Confirm the app name and allow the connection so the client can receive device traffic. This VPN is a local interface provided by the system, not an included remote service; you still need to import a valid configuration and choose an available route. Usually, only one VPN service can run in the same user profile, so other VPN apps may conflict. If the permission prompt keeps appearing, check whether another service is already handling the connection.

Import and update subscriptions

Configuration management · Import from URL

On the Configuration page, choose Import from URL, paste the subscription URL from your configuration provider, and save. Wait for the download to finish, then select it as the active configuration. Subscription URLs may contain access credentials; don't share them in screenshots, comments, or public repositories. Auto-update only fetches new content—it doesn't guarantee that a subscription remains valid. If a proxy group suddenly has no entries, check the update result and expiration status, then confirm that the current core supports the configuration format.

TUN and traffic capture

Virtual network interface · Beyond the system proxy

TUN is a virtual network interface commonly used to capture connections that don't follow system proxy settings. On desktop, enabling it may require administrator privileges or a service component. Android clients typically use VpnService to handle device traffic, and may not have a switch named TUN. Start with the default setup, then adjust it to suit your needs. Enabling TUN won't fix an unavailable node; also check routing, DNS, and whether LAN access works as expected.

Choose a Clash client for your device

Check your operating system first, then choose the right package architecture. These links take you to each platform's download page, where client options, system requirements, and maintenance status are listed.

Windows

A good fit for desktop users who need a graphical interface, proxy group selection, and system proxy settings. Options include Clash Plus and Clash Verge Rev. Import a configuration after installation, then enable the system proxy. If a terminal or individual app still isn't working, check whether it reads system proxy settings; browser access alone doesn't mean every program is routed.

Go to downloads Windows client

macOS

Before downloading, check About This Mac to identify your chip and choose the Apple Silicon or Intel package. Follow the system prompts to grant permissions on first launch, then import a configuration in the client. The system proxy and TUN are different ways to route traffic. If you need access to printers, development services, or other LAN devices, verify that they remain reachable after enabling either option.

Go to downloads macOS client

Android

Most recent phones use ARM64, but check the processor and system requirements for older devices. Options include Clash Plus, Clash Meta for Android, and FlClash. After installation, set up a subscription, grant VPN permission, and review battery restrictions. Background settings vary by manufacturer; if the connection drops when the screen locks, check the app's battery and background data settings first.

Go to downloads Android client

iOS

Use the download page to visit the Clash Plus App Store listing, or see its website at clashplus.io. Follow the client prompts to add a configuration and grant system VPN permission. A phone and computer can use the same configuration source, but check the provider's device and simultaneous-connection limits. Desktop scripts and local file paths also won't necessarily work on a phone.

Go to downloads iOS client

Linux

For desktop use, consider Clash Verge Rev or FlClash, and choose a supported package for your distribution. Server and router users can consider the standalone mihomo core and manage configuration, service startup, and permissions themselves. A graphical client's system proxy settings may not affect command-line programs. When troubleshooting, check desktop apps, terminal environment variables, and network routes separately.

Go to downloads Linux client
Browse all clients →

First Android connection: three checks

Installing the client doesn't complete setup. Get a subscription URL from a trusted source, then import it, grant permission, and verify the connection in that order. Menu names may differ slightly between clients.

  1. Import and select a configuration

    Open the Configuration page, add an entry, and choose URL or remote import. Give it a recognizable name, paste the subscription URL, and save. When the download finishes, select the configuration, confirm it's active, and check that proxy groups appear on the Proxy page.

    If import fails, check for extra spaces in the URL and confirm the response is a configuration file, not a login page. You haven't reached the node connection step yet, so there's no need to keep changing proxy modes. The client does not provide subscriptions; get your configuration from a trusted provider.

  2. Choose a mode and grant permission

    For your first setup, choose Rule, then select an outbound route in the main proxy group. Return to the home screen and tap Start. When Android displays the VPN request, confirm the app name and allow the connection. A VPN icon at the top means the system interface is active; it doesn't prove that the remote service is reachable.

    For reliable background use, open the app's system settings and check battery optimization and background activity restrictions. Don't enable every advanced option right away. First verify a basic connection with a known-good configuration, then add autostart or per-app routing settings as needed.

  3. Test sites and check connection logs

    Open one site expected to connect directly and another expected to use a proxy, then check their rules and outbound routes in the client's connection log. If a site won't load, stop the service first and confirm the device can still access the internet. Then check the subscription, node connection, and DNS—the process that resolves domain names to IP addresses.

    After setup, lock the screen for a while and test again. Check your usual apps and LAN devices too. If the connection works with the screen on but fails when locked, revisit background restrictions. If only one site fails, check its connection log. Change one setting at a time and keep the original configuration so you can revert.

Read the full guide →Beginner-to-advanced guide →

The Clash open-source ecosystem and its limits

The client interface, proxy core, and subscription configuration each serve a different purpose. To determine whether a feature is available, check all three—not just the app's name.

The original project and what came after

Public maintenance of the original Clash project has ended, and community projects have continued its evolution. Meta, mihomo, and the various graphical clients are not the same product. mihomo parses configurations, handles protocol connections, and evaluates rules; graphical clients provide interfaces for importing configurations, selecting policies, viewing logs, and integrating with the system. Two apps with similar-looking interfaces may use different cores or handle configurations differently.

Choose a client based on maintenance status, device compatibility, and the features you need. Archived apps can help you follow older guides, but may not work with new devices or configurations. This site lists platform-specific options on the download page and notes the maintenance status of older projects. For protocol support, configuration fields, or permission behavior, check the project documentation and actual logs.

Public code and issue reports

You can find mihomo's source code, release notes, and issue discussions in its public repository. Open-source code can be inspected and gives the community a way to work through specific issues together; it doesn't make every third-party configuration, download source, or remote node equally trustworthy. Choosing a client and choosing a configuration source are separate decisions.

When reporting an issue, include your device and OS, client name, steps to reproduce, and relevant error messages. Remove subscription URLs, access credentials, and private network details from logs. A report that only says “it doesn't work” usually can't distinguish a network, configuration, or permission issue. Mention whether the internet works when the service is stopped and whether the issue only occurs with the screen locked to help narrow it down.

Keep a working configuration before updating

Client updates, core updates, and subscription updates are three separate changes. An app upgrade may change permissions or the interface; a core update may alter supported fields; a subscription update changes nodes and rules. If something breaks, identify which layer changed most recently and check its logs. Don't reinstall the client, replace the subscription, and change DNS all at once, or you won't know what fixed or caused the problem.

Back up local overrides and essential settings before upgrading. Afterward, confirm the active configuration, mode, and proxy group. Local edits to subscription files may be overwritten by remote updates, so put persistent rules in settings the client supports. When moving to another device, check local paths and script support too; a desktop configuration isn't necessarily a universal file that works on every platform.

Configuration sources and usage

This site provides client downloads, terminology, and setup instructions; it does not provide proxy nodes or subscriptions. Subscription availability depends on the configuration provider and remote service. A client starting successfully doesn't mean the service is working. Before sending a subscription to a conversion tool, find out how it handles URLs and configuration data. If in doubt, use the original format supported by your client.

Where network traffic goes depends on rules, DNS, app behavior, and system integration—not just a “Connected” label. Follow the relevant network policies when using work networks, managed devices, or other controlled environments. For terminology, see the glossary; for common disconnections and internet access issues, follow the steps in the FAQ.

Client maintenance and connection troubleshooting

From Migration to specific issues, choose the guide that matches what you're working on. Note the symptoms first, then check each step in order to avoid changing multiple settings at once.

Browse all articles →
Download clients