Clash FAQ

Yes, the Clash client itself is completely free and open-source software. The source code is hosted on GitHub, and anyone can download and use it for free without any hidden charges or feature limitations.

Please note that Clash is only a proxy client tool. To use proxy features, you still need to purchase a subscription service from a proxy provider (commonly known as an "airport"). Proxy services usually charge monthly or annually, but the Clash client itself is permanently free.

Clash covers five major operating systems:

• Windows: Windows 7 and above, recommended Windows 10/11; supports x64 and ARM64 architectures.
• macOS: macOS 10.13 (High Sierra) and above; supports Apple Silicon (M1/M2/M3/M4) and Intel chips.
• Android: Android 5.0 (Lollipop) and above.
• iOS: iOS 12.0 and above (requires purchasing compatible apps via the App Store).
• Linux: Mainstream distributions like Ubuntu, Debian, Fedora, CentOS, and Arch Linux; supports amd64 and arm64.

Go to the Download page to select the corresponding installer based on your device and OS version.

Please always download Clash from the following trusted channels:

• This Site's Download Page (Recommended): All installers come from the corresponding official GitHub Release pages; this site does not make any modifications to the installers.
• Official GitHub Release Pages: Each client has a corresponding GitHub repository, such as Clash Verge Rev, Mihomo, etc.
• iOS Platform: Stash, Shadowrocket, etc., can only be purchased and installed through the official Apple App Store.

This is a False Positive, not a real virus. Reasons:

• Clash clients involve low-level network operations like network proxying and TUN mode; Windows Defender and some antivirus software may misjudge these actions.
• Clash is open-source software with fully public code; anyone can audit the logic on GitHub, so there's no malicious behavior.

How to handle: Select "Run anyway" or "Allow" in the Windows Defender or antivirus prompt, and add the Clash installation directory to the trusted whitelist.

This is a macOS Gatekeeper security mechanism, not malware. Solution:

1. Open "System Settings" → "Privacy & Security."
2. Find the prompt in the "Security" section at the bottom of the page and click "Open Anyway."
3. Click "Open" again in the confirmation dialog.

Alternatively, execute the following command in the terminal to remove the quarantine attribute:

xattr -cr /Applications/ClashVerge.app

These are all GUI clients developed based on the Mihomo (formerly Clash Meta) kernel. They share the same kernel; the main differences are in UI and functional focus:

• Clash Verge Rev (Top choice for Desktop): The most feature-complete client, supporting Windows/macOS/Linux with override/scripting features and the most active community—Recommended for both beginners and advanced users.
• FlClash (Lightweight cross-platform): Developed with Flutter with a simple UI, supporting Android/Windows/macOS/Linux—Ideal for users seeking simplicity.
• Clash Meta for Android (Top choice for Android): Full-featured with TUN global proxy, optimized specifically for Android—Recommended for Android users.
• ClashX Meta (macOS Menu Bar): Light and compact with low resource usage, ideal for Mac users who don't need complex features.

Visit the Download page for full descriptions of clients for each platform.

The Clash client itself does not provide any proxy nodes; it is merely a client tool. To use proxy features, you need to:

1. Purchase a subscription plan from a proxy provider (commonly known as an "airport").
2. Obtain a Clash-format subscription link from your provider (usually starting with https://).
3. Import the subscription link into the Clash client to automatically load all nodes.

Taking Clash Verge Rev (Windows/macOS/Linux) as an example:

1. Open Clash Verge Rev and click the "Subscription" tab in the left menu.
2. Click the "New" button in the top right corner.
3. Paste the subscription link into the URL input field and (optionally) fill in a configuration name.
4. Click "Confirm" and wait for the subscription download to complete.
5. Click on the newly downloaded configuration to activate it as the currently used profile.

Clash Meta for Android works similarly: go to "Configuration" → click "+" → select "Import from URL" → paste the link.

For the full illustrated tutorial, please refer to the Usage Tutorial page.

• Rule Mode [Recommended]: Automatically determines routing based on preset rules in the subscription: direct connection for local domains and IPs, and proxy for international ones. Local access is unaffected, making it the best choice for most users.
• Global Mode: All traffic goes through the proxy, including local traffic. This will slow down local website access and should only be used to temporarily test if the proxy is working.
• Direct Mode: All traffic bypasses the proxy, equivalent to turning off the proxy. Useful for temporarily disabling the proxy or troubleshooting network issues.

In the "Proxy" tab of the Clash client, you can view all available nodes and perform latency tests:

1. Click the "Speed Test" or "Latency Test" button and wait for the test to complete.
2. Test results are shown in milliseconds (ms): under 100ms is excellent, 100-300ms is good, and over 500ms may experience lag.
3. Choose the node with the lowest latency (usually locations closer to you, such as Hong Kong, Singapore, or Japan).

Most subscription configurations also provide an "Auto-select" strategy group that automatically picks the node with the lowest current latency; using this is recommended.

Proxy providers update nodes periodically; we recommend enabling automatic updates:

• Clash Verge Rev: Right-click the subscription config on the "Subscription" page → "Edit" → set the "Auto Update Interval" (e.g., 1440 minutes = auto-update every 24 hours).
• Clash Meta for Android: Long-press the subscription on the configuration management page → "Scheduled Update" → set the update interval.
• FlClash: Set the automatic update period in the subscription detail editor.

It is recommended to set the auto-update interval to every 24 hours to ensure node information is always up to date and to avoid connectivity issues due to expired nodes.

Yes. The same subscription link can be used on multiple devices simultaneously. Simply paste the link into the Clash client on each device.

Note: The specific number of concurrent online devices depends on the "Concurrent Devices" limit of the proxy provider's plan you purchased (usually 2-5 devices). When the limit is exceeded, some devices may fail to connect. Please upgrade to a higher plan if you need more concurrent devices.

Please troubleshoot in the following order:

1. Confirm Node is Selected: Go to the "Proxy" page and ensure a specific node (not "DIRECT") is selected, and test if the node latency is normal (< 500ms).
2. Confirm System Proxy is Enabled: The "System Proxy" switch on the main interface should be shown as enabled (orange/blue).
3. Try Testing in Global Mode: Switch the proxy mode to "Global." If you can access sites in Global mode, there's an issue with your rules; update your subscription after reverting to Rule mode.
4. Update Subscription Configuration: Go to subscription management and click "Update" to redownload the latest nodes.
5. Check Firewall/Antivirus: Windows Defender or third-party antivirus software might block Clash's network requests; add Clash to the trusted whitelist.
6. Restart Clash or Your Device: Restarting can sometimes resolve abnormal system proxy settings.

Subscription links are usually hosted on overseas servers; network restrictions may cause download failures when the proxy is not yet active. Solutions:

1. Import via Provider Website: Most providers offer a "One-click Import to Clash" button on their website, which opens the subscription link directly within the client (via URL Scheme).
2. Direct Browser Download: Copy the subscription link into your browser's address bar, download the YAML config file, and then select "Import from local file."
3. Use Mobile Hotspot: Set up a hotspot from a phone (with proxy enabled) and download the subscription after connecting your PC to the hotspot.
4. Contact Provider for Mirror Links: Some providers offer mirror addresses for subscription downloads that are accessible locally.

This is usually due to incorrect proxy mode settings. Please check:

• Ensure the proxy mode is set to "Rule" instead of "Global." Global mode routes all traffic through proxy nodes, which will inevitably slow down access to local websites.
• If local access is still slow in Rule mode, the rule list in your subscription might be incomplete. Try updating your subscription or manually adding a DIRECT rule for frequently used local domains.
• Confirm that the proxy node itself has normal latency; high-latency nodes will slow down response speeds during traffic forwarding.

This is usually caused by Clash failing to automatically clear system proxy settings upon exit. Solutions:

• Windows: Open "Settings" → "Network & Internet" → "Proxy" → turn off the "Use a proxy server" switch; or reopen Clash, disable "System Proxy" in settings, and then exit.
• macOS: Open "System Settings" → "Network" → select your current network interface → "Details" → "Proxies" → uncheck HTTP/HTTPS Proxy.
• Android / iOS: This issue does not exist; internet access automatically returns to normal once the VPN connection is closed.

This is because the standard "System Proxy" mode can only proxy applications that support HTTP/HTTPS proxy settings (like browsers), while some native applications may not read these settings. Solution:

• Enable TUN Mode (Recommended): TUN mode takes over all network traffic at the system level. Regardless of whether an app supports proxy settings, traffic will be processed by Clash. Enable "TUN Mode" in Clash Verge Rev's "Settings"; macOS requires authorization to install a Helper.
• Android / iOS: Clash clients on these platforms already take over all traffic via the VPN API by default—no extra setup needed.
• Linux: Enabling TUN mode requires root privileges; you can also set the export https_proxy=http://127.0.0.1:7897 environment variable in the terminal.

Taking Clash Verge Rev as an example, you can enable both of the following options simultaneously:

1. In "Settings" → "System," enable "Launch on startup" to have Clash run automatically when the system starts.
2. In "Settings," enable "Auto-enable system proxy on startup" to have Clash automatically turn on the proxy after starting.

Once both options are enabled, the proxy will be automatically active upon startup with no manual action required.

Clash is completely open-source software with its source code hosted on GitHub and available to developers worldwide. This means:

• Anyone can audit the code to verify the absence of malicious behavior or backdoors.
• Clash itself does not record any of your network access logs.
• Clash does not upload any user data to any server.

However, please note: your network access data will pass through the proxy provider (airport) node you select; therefore, the provider may see your traffic metadata. Please choose a reputable provider and pay attention to their privacy policy.

Comparison of Core Differences:

• Traffic Split Tunneling: Clash can achieve direct local connections + proxying for international sites, without affecting local access speeds. Traditional VPNs route all traffic through a tunnel, which slows down local access.
• Protocol Support: Clash supports 10+ modern protocols like Shadowsocks, VMess, Trojan, VLESS, and Hysteria2, providing strong anti-identification capabilities. VPNs usually only support a single protocol like OpenVPN or WireGuard.
• Transparency: Clash is fully open-source with auditable code; most VPNs are closed-source software with non-transparent internal logic.
• Cost: The Clash client is permanently free; you only need to purchase a proxy subscription. VPN software itself usually requires a monthly fee.
• Flexibility: Clash supports highly customizable rule configurations, allowing fine-grained control over traffic by domain, IP, and process—VPNs cannot perform such detailed split tunneling.

Clash has a built-in comprehensive DNS leak protection mechanism. In the default configuration or rule settings provided by subscriptions, DNS queries for international domains are sent through the proxy node rather than local DNS servers, thereby preventing DNS leaks.

Suggestions for further privacy protection:

• Enabling "Enhanced DNS Mode (enhanced-mode: fake-ip or redir-host)" in Clash settings can further prevent DNS leaks.
• Use TUN mode to take over all traffic and prevent apps that bypass the system proxy from exposing DNS queries directly.
• Visit browserleaks.com or ipleak.net to test for DNS leaks.

Clash (Mihomo kernel) supports almost all mainstream proxy protocols available on the market today:

Mihomo is a community-maintained version of the Clash kernel (formerly known as Clash Meta). It builds upon the original Clash core by continuously adding protocol support, performance optimizations, and functional extensions—the mainstream kernel recommended for use today.

Using the Clash proxy can significantly improve security on public Wi-Fi:

• All proxied traffic is transmitted through an encrypted tunnel (protocols like Shadowsocks, VMess, and Trojan have built-in encryption). Even if a man-in-the-middle attack exists on public Wi-Fi, the attacker cannot decrypt your data.
• DNS queries are sent through the proxy node, preventing local DNS pollution and monitoring.
• Enabling TUN mode can proxy all traffic, including non-browser apps, providing more comprehensive protection.

• System Proxy Mode: Implements proxying by modifying system HTTP/HTTPS proxy settings. It is only effective for apps that support reading system proxies (like browsers) and does not support UDP traffic or other protocols.
• TUN Mode: Creates a virtual network card at the system level to take over all network traffic (including TCP and UDP). Regardless of whether an app supports proxy settings, all traffic will be processed by Clash—a more thorough proxy.

Scenarios suitable for enabling TUN:

• When you need to proxy game client traffic (most games don't support system proxies).
• When you need to proxy certain desktop applications.
• When you need to proxy UDP traffic (e.g., DNS, some video call apps).

Clash configuration files (YAML format) support highly flexible rule configurations:

1. In Clash Verge Rev's "Override" feature, you can append custom rules without modifying the original subscription.
2. Rule syntax examples:
   DOMAIN-SUFFIX,openai.com,Hong Kong Node (specific domain via specific node)
   DOMAIN-KEYWORD,google,PROXY (domains containing keyword via proxy)
   GEOIP,CN,DIRECT (local IP direct connection)
   PROCESS-NAME,discord.exe,US Node (specific process via specific node)

Detailed rule syntax can be found in the official Mihomo documentation (source repository deleted).

Strategy groups combine multiple proxy nodes and select which one to use based on certain logic. Common strategy group types:

• select: Manually specify a node from the list—the most flexible option.
• url-test: Automatically tests the latency of all nodes and always selects the one with the lowest latency—recommended for daily use.
• fallback: Prioritizes the first node and automatically switches to the next if it becomes unavailable.
• load-balance: Distributes traffic across multiple nodes—ideal for scenarios requiring high bandwidth, like downloads.

Most airport subscription configs already have these strategy groups preset; simply select the corresponding group on the "Proxy" page to use them.

Clash provides a RESTful API for remote management of nodes, rules, logs, and more via a web panel:

1. Enable external-controller (e.g., 127.0.0.1:9090) in the Clash configuration.
2. Visit third-party panel websites such as Yacd or MetaCubeXD.
3. Enter the API address http://127.0.0.1:9090 and the Secret (if set) in the panel to connect.

Clash Verge Rev has a built-in control panel entry, so no extra setup is needed—just click the "Open Panel" button to access it.

Clash supports LAN proxy sharing, where the device running Clash acts as a proxy server for other devices:

1. In the Clash config file, set allow-lan to true, or enable "Allow LAN connection" in Clash Verge Rev settings.
2. Check the port Clash is running on (usually mixed-port: 7890) and the device's local network IP (e.g., 192.168.1.100).
3. In the Wi-Fi settings of other devices (phones, tablets, etc.), set the proxy to: Host 192.168.1.100, Port 7890.