Everything you might ask,
answered right here.

Clash is an open-source proxy client whose core capability is rule-based traffic routing: it automatically decides whether each connection goes direct, through a proxy, or gets blocked based on domain, IP, geographic location, and other criteria. It supports Windows, macOS, Android, iOS, and Linux — ideal for users who need fine-grained control over their network traffic.

Completely free. Clash's core and mainstream clients are released under open-source licenses, with no ads or in-app purchases. The source code is publicly hosted on GitHub, so anyone can audit it, file issues, or contribute.

A traditional VPN usually dumps all traffic through a single server. Clash, at its core, is a rule engine that can route traffic automatically by domain or region — unrestricted sites connect directly while region-locked or blocked services route through a proxy — while also managing multiple nodes and switching automatically by proxy group, giving you noticeably more flexibility and control.

Clash is a general-purpose network proxy tool — like a browser or download manager, it's neutral technical software with no illegal content built in. Whether a particular use case is compliant depends on the laws and regulations of your region and how you actually use it, so please research and follow your local rules.

Windows: Clash Verge or Clash for Windows; macOS: ClashX or Clash Verge; Android: Clash Meta for Android; iOS: get a Clash-compatible client from the App Store; Linux: deb packages or a binary core. Head to the download page and pick your platform.

Every installer lists its SHA-256 checksum next to it. After downloading, run certutil -hashfile filename SHA256 on Windows, or shasum -a 256 filename on macOS/Linux, and compare it with the checksum — a match means the file hasn't been tampered with.

Clash clients are community-maintained and don't have a commercial code-signing certificate, so your system may flag an unknown publisher — this is expected. On Windows, click "More info" → "Run anyway"; on macOS, allow it under Privacy & Security in System Settings. We recommend verifying the SHA-256 checksum beforehand to confirm the file hasn't been tampered with.

Due to App Store review policies, installable .ipa files can't be distributed directly — you'll need to get a Clash-compatible client from the App Store.

Paste the subscription link from your provider into the client's subscription manager and save it — the client will automatically fetch all nodes and update them periodically on the interval you set, no need to fill in node info by hand. See the full steps in the tutorial.

Rule mode is recommended for everyday use, routing traffic automatically for a good balance of speed and browsing experience. Use Global mode when you need all traffic through a proxy. Switch to Direct mode when troubleshooting whether the proxy is causing an issue, or when you don't want to use a proxy temporarily.

TUN mode creates a virtual network adapter that takes over all system traffic, so you don't need to configure a system proxy separately — even command-line tools and background services get proxied. If you're only browsing in a browser, the system proxy is enough; if you want every app to follow your routing rules, we recommend enabling it.

The "Nodes" panel manages and switches proxy nodes; the "Rules" panel shows the currently active routing rules; the "Connections" panel shows in real time which rule and node each connection is using — the most useful one for troubleshooting; the "Logs" panel outputs the core's runtime logs. See the main interface explained for details.

url-test automatically picks the lowest-latency node, suitable for most cases; fallback switches in a fixed order, only using a backup node when the primary one fails; load-balance spreads concurrent connections across multiple nodes, ideal when a single node's bandwidth isn't enough. See the detailed comparison in Proxy Groups in Practice.

A Rule Provider hosts a large number of routing rules as a single, auto-updating file, so you don't have to maintain hundreds of rules by hand. Once you configure the reference URL, the core will automatically fetch the latest version on a set schedule. See the Rule Provider guide for details.

fake-ip assigns a virtual IP to each domain so the rule engine can match rules by domain before the connection is even established, without waiting for real DNS resolution to finish — improving both routing accuracy and speed. See the full explanation in DNS Configuration Optimization.

With external control enabled, you can use browser panels like yacd or metacubexd to view connections in real time, switch nodes, and hot-reload the config, without restarting the client for every change. See the dashboard setup guide for how to use it.

First confirm the client has successfully imported a subscription and a working node is selected. Then check whether the system proxy or TUN mode is enabled. Finally, confirm the node itself is online — try switching to another node in the proxy group to test.

Confirm the subscription link is complete and hasn't expired — some providers require a specific User-Agent. Try opening the subscription link directly in a browser to see if it returns valid config content, or contact your provider to confirm the subscription status.

Check whether the domain is matched by a direct or block rule — you can confirm exactly which rule was hit in the "Connections" panel, or temporarily switch to Global mode to test whether a routing rule is the cause, then go back to Rule mode and adjust accordingly.

This is usually caused by a DNS configuration conflict. Try enabling the client's built-in DNS takeover feature in settings, or restart TUN mode once. If that still doesn't work, try restarting your network adapter or reinstalling the virtual network adapter driver.

The Clash client and core don't upload usage data or connection logs themselves — all configs and logs stay on your device, and the code is public and auditable. However, your actual network traffic does pass through the proxy node you select, so you'll need to judge the trustworthiness of your node provider yourself.

By default, the external control interface only listens on 127.0.0.1, so its security is equivalent to local access. As long as you don't expose the listen address to the public internet and use a sufficiently complex secret key, it's safe for everyday use. See the dashboard setup guide for security recommendations.

A proxy server can see your connection destination (which domains/IPs you visit), but for sites using HTTPS/TLS encryption, the node can't see the actual content being transmitted. This is also why protocol choice and node reputation matter — see the full proxy protocol comparison for details.