Open-source clients · Platform links and configuration references
Find Clash clients for desktop, mobile, and Linux in one place, then learn about subscription imports, rule routing, and configuration files. The download page organizes clients by operating system, while the guides walk through the first connection in the order you actually use it.
Client names can look similar, but their interfaces, core versions, and supported system architectures may differ. Choose your platform first, then select an installer based on your device architecture, installation method, and maintenance status. If you already have a configuration, go straight to the configuration reference; if you are new to Clash, start with Getting Started.
PLATFORM DIRECTORY
The home page only directs you to the right platform section. Detailed client names, maintenance status, system architectures, and installer links are listed together on the download page, avoiding duplicated links across multiple pages. If you are unsure about your device architecture, open your system information first and compare it with the requirements table on the download page.
Suitable for common Windows 10 and Windows 11 desktop environments. Check the processor architecture and client maintenance status before downloading. After installation, you will usually need to import a subscription, choose a proxy group, and enable the system proxy. If another proxy application is already installed, check for port conflicts first.
Go to Windows downloadsThese builds target Apple Silicon and Intel Macs respectively. The first launch may require permission to open the app, approve a network extension, enable the system proxy, or authorize Keychain access. These permissions serve different purposes, so follow the client prompts and system settings step by step instead of repeatedly deleting the configuration.
Go to macOS downloadsAndroid clients route traffic through the system's local VPN interface. Check the ARM architecture before choosing an installer. After setup, review VPN authorization, notification access, battery optimization, and background-activity restrictions to prevent the system from stopping the connection after the screen locks.
Go to Android downloadsiPhone and iPad users can find the Clash Plus App Store link and official site information in the relevant platform section. After installation, iOS will ask to add a VPN configuration. Approve it before importing a configuration, selecting a proxy group, and starting the connection; everyday node switching can be done in the app.
Go to iOS downloadsDesktop users should generally start with a client that includes a graphical interface. Servers, software routers, and container environments typically use the Mihomo core directly. The configuration concepts are similar, but service management, file permissions, DNS interception, and startup behavior differ, so the two workflows should not be mixed.
Go to Linux downloadsCONFIG LABEL
Clash interfaces vary by client, but the underlying configuration usually centers on rules, subscriptions, system proxies, and overrides. The sections below explain what each feature is for, where to find it, and how it is written in YAML. Whether a field works still depends on the core used by the current client.
Rule routing answers the question “Which proxy group should handle this type of connection?” Clash checks rules from top to bottom and stops at the first match. Specific domains, LAN addresses, and special services therefore usually come first, broader rules later, and the fallback MATCH rule generally goes at the end. Unlike a basic proxy with only a global on/off switch, rule mode allows direct connections, proxied traffic, and blocked requests to coexist.
When making changes, first confirm that every proxy-group name referenced by a rule actually exists, then check the order and indentation. If a broad rule matches too early, later specific rules will never take effect. During troubleshooting, inspect the matched rule in the connection log instead of judging the configuration only by whether a webpage opens.
Read the rule syntax guide →rules:
- DOMAIN-SUFFIX,example.com,PROXY
- GEOIP,CN,DIRECT
- MATCH,PROXYSubscription management retrieves nodes, proxy groups, and rule configuration from a remote source. A successful import only means the client read the configuration; it does not mean every node can connect. After updating a subscription, group members, node names, or the default selection may change. Open the proxy-group page again, confirm that the current selection points to a valid member, then run latency and connection tests.
When an update fails, first determine whether the URL is invalid, the network cannot reach it, the response is not YAML, the configuration fields are incompatible, or local file permissions are blocking access. Reinstalling the client repeatedly usually will not fix a problem with the subscription source. Also remember that the next update may overwrite local edits to a generated subscription file.
View the subscription import steps →profile:
store-selected: true
store-fake-ip: true
proxy-providers:
provider-main:
type: http
path: ./providers/main.yamlThe system proxy is the most common link between a client and browsers or desktop applications. When enabled, the client points the operating system's HTTP or SOCKS proxy to a local listening port, allowing applications that follow system proxy settings to send requests through Clash. It does not automatically cover every process; applications that ignore system proxies, some games, and specialized network services may require their own proxy settings or TUN mode.
If the network becomes unreachable after enabling it, check whether the local port is already in use, whether the client core is running, and whether an abnormal exit left the system proxy pointing to an old address. LAN sharing also depends on the listen address and firewall rules, so an “Allow LAN” switch alone does not guarantee that external devices can connect.
View the connection and verification steps →mixed-port: 7890
allow-lan: false
mode: rule
log-level: infoConfiguration overrides are useful for preserving local changes to ports, DNS, TUN, rules, or proxy groups without manually editing the main file after every subscription update. Clients use different names for overrides, merging, and scripts, and their merge order may also differ. Before using one, confirm whether it replaces the entire field, appends to an array, or recursively merges keys.
Keep overrides small and easy to undo. If you add large numbers of DNS, rule, and proxy-group fields at once, finding the source of an error becomes difficult. A safer approach is to save the original configuration, add one feature block at a time, and check the logs after reloading. For YAML parse errors, check spaces, indentation, colons, and list markers first.
Read the override and merge guide →dns:
enable: true
ipv6: false
enhanced-mode: fake-ip
tun:
enable: true
stack: mixedQUICK START
The steps below cover the main path from installation to connection verification. Button locations vary by client, but the sequence—read the configuration, choose a proxy, enable system integration, and verify the result—is broadly consistent. When something fails, stop at the current step and check it instead of changing several settings at once.
Open the client's Configuration, Subscription, or Profiles page, paste a working subscription URL, and import it. Afterward, you should see a configuration name, update time, and proxy groups—not merely a “saved successfully” message. If no nodes appear, run a manual update and read the error. An expired URL, unreachable network, malformed response, and unsupported core fields each require a different fix.
When importing a local file, preserve its original YAML spacing and indentation. Do not edit it with a tool that automatically replaces punctuation or tabs. Node information in a configuration is connection data, so store backups somewhere you control.
After the configuration loads, set the operating mode to Rule, then open the proxy-group page. For a manually selected group, choose a node. For an automatic group, run a latency test first. Latency only shows whether a particular test address was reachable at that moment; it does not represent the real-world connection quality of every site. If the test fails, also consider the subscription status, device time, DNS, and current network.
A proxy group can reference nodes or other proxy groups. If the interface shows one group selected but traffic still exits through the wrong route, check which group the rule actually matched and which member that group ultimately selected.
Once you have confirmed that the core is running, enable the system proxy or turn on TUN if needed. Visit a stable site first to check basic connectivity, then inspect the client connection log to see whether the request appeared, which rule matched, and which proxy was used. Watching only the browser page cannot reliably distinguish cached, direct, and proxied results; connection logs provide more direct evidence.
Only after verification should you configure startup launch, background operation, or automatic updates. If other applications suddenly lose network access after the client exits, return to the system network settings and check whether the proxy address still points to a stopped local port.
OPEN SOURCE NOTES
Clash-related names can refer to the core, a graphical client, or the configuration format. Understanding how these three pieces relate helps you choose an installer, identify where a feature comes from, and find the right place to investigate incompatible fields.
Clash established a YAML-based approach to configuring proxy nodes, proxy groups, and rules, followed by graphical clients for different platforms. The configurations, proxy groups, connection logs, and system-proxy switches seen in client interfaces generally follow this model. Because the original project and later forks have different maintenance histories, choosing a client today requires checking not only its name but also the core it actually uses and how recently it has been maintained.
The graphical client handles installation, subscription management, tray menus, system permissions, and configuration editing. The proxy core reads the configuration, matches rules, establishes connections, and provides network features such as DNS handling and TUN. Different clients may use the same core, or different versions at different times, so the same YAML fields may not work identically everywhere. When troubleshooting, first determine whether the cause is the interface, operating-system permissions, or core configuration.
Mihomo is the actively maintained core implementation in the Clash Meta ecosystem, with extended support for proxy protocols, rule providers, DNS, and traffic interception. Many current clients use it underneath, but a client may wrap, hide, or generate advanced fields automatically. Before copying a complete configuration from the internet, check the supported features of the installed core and add fields in small sections. Successful YAML parsing proves only that the syntax is valid; it does not prove that proxy-group references, DNS upstreams, and rule order fit your network.
Client updates, core updates, and subscription updates are three separate paths. A client update may change the interface and system integration; a core update may change field behavior; a subscription update mainly replaces nodes, proxy groups, and rules. When something breaks, recording which layer changed makes diagnosis easier than rolling everything back at once. The download page organizes platform links, while the configuration reference explains fields; actual feature support still depends on the installed client and core versions.
SELECTED QUESTIONS
These questions cover the basic decisions involved in choosing a client and configuring it for the first time. For a fuller breakdown of installation, usage, and troubleshooting, visit the Troubleshooting page.
The client provides a usable graphical interface, subscription management, and system integration. The Mihomo core parses configuration, matches rules, and handles connections. A client can bundle the core and manage its runtime state, and the two may follow different update schedules. When choosing a download, most users should start with a graphical client; server and router users are more likely to deploy the core directly.
First confirm that the subscription URL still works, then run a manual update and inspect the returned error. Common causes include an unreachable URL, malformed response, expired subscription, fields unsupported by the current core, or a proxy-provider file that was not written successfully. Handle the specific error instead of repeatedly importing the same subscription.
No. The system proxy mainly affects applications that follow the operating system's proxy settings. Some games, command-line tools, and specialized network services may bypass those settings with their own connection paths. For broader traffic interception, consider TUN mode, but check system permissions, DNS settings, and conflicts with other networking software before enabling it.
A latency test covers only a specific test address and the connection result at that moment. Also check the rule matched by the target request, the proxy-group member ultimately selected, DNS resolution, the device's system time, current network restrictions, and the local firewall. Open the connection log and verify the request, rule, proxy group, and node in that order.
FIELD NOTES
Articles are organized around platform setup, Advanced Routing, first connections, and Troubleshooting. Each one focuses on a specific task, making it useful after basic installation or when a matching symptom appears.
Explains what network extensions, system proxies, and Keychain authorization each affect during first launch, and where to re-enable them after permission is denied. Useful for macOS users whose installation is complete but the core will not start or whose system prompts keep returning.
Read the full article →Explains how TUN differs from the system proxy through virtual-network-adapter and route-interception principles, then covers permissions, DNS coordination, and common conflicts. Suitable for programs that ignore system proxy settings or for complex network environments.
Read the full article →Follow the first-use sequence to import a subscription, choose a proxy, run a latency test, enable the system proxy, and verify the connection result. Each step explains what to watch for, helping you avoid changing multiple settings before confirming that the configuration loaded correctly.
Read the full article →