On this page
Choosing a phone proxy app involves more than its price and whether it can add a node. Reusing desktop rules, sharing the proxy with other devices, and maintaining scripts each require different amounts of work. List your existing configuration and the features you will actually use, then check the store and official documentation to avoid discovering after purchase that the setup needs rebuilding.
Which needs suit Shadowrocket, Stash, and Surge?
| Primary need | Consider first | Trade-offs to consider |
|---|---|---|
| Importing common node types and using basic routing, with price in mind | Shadowrocket | The workflow is less consistent if you need the full Surge module workflow or team debugging |
| Keeping Clash-style policy groups and rules | Stash | May be more complex than needed if you use one node and do not maintain rules |
| Regularly debugging requests, scripts, modules, or MITM | Surge | Higher cost and learning effort if you only update subscriptions and switch nodes |
After choosing an app, check whether it can import your existing configuration, how rules are edited, whether local-network sharing meets your needs, and the purchase method and migration costs. A node importing successfully does not mean the original rules and settings will remain unchanged.
Can these three apps import Clash configurations directly?
Stash is officially positioned as bringing Clash Premium-style capabilities to Apple platforms, so users who already organize configurations with proxy-groups, rules, and Rule Provider can usually preserve that approach more easily. You should still inspect the actual import result: scripts, TUN, DNS, and some newer Mihomo fields may not map one-to-one.
Shadowrocket is a standalone rule-based proxy tool. Its official App Store description lists domain, CIDR, and GeoIP rules, remote rule files, DNS, script filtering, and multi-hop forwarding, but it is not a Mihomo GUI. Even if the nodes import successfully, your original Clash policy groups and overrides may not retain the same structure.
Surge uses its own Profile and Module system. A Module overrides the Profile at a higher priority, which is useful for maintaining reviewable local patches. If all you have is a Clash subscription and you do not plan to rebuild your rules, Surge's larger feature set does not automatically make it the easiest migration.
Policy groups, nodes, and modules: differences in everyday maintenance
- Stash
- Best suited to choosing and overriding Clash-style policy groups and maintaining rule sets; also available on iOS, tvOS, macOS, and visionOS.
- Shadowrocket
- Well suited to quickly adding common nodes and rules, with support for iPhone, iPad, Mac, and Apple TV; check the App Store listing for current features and regional availability.
- Surge
- Well suited to inspecting connections, maintaining modules, running scripts, and debugging HTTP traffic. Its official documentation provides a complete framework for Module, MITM, and scripts.
What LAN sharing features and limitations are there?
Local-network sharing methods
| App | Confirmed method | What to consider |
|---|---|---|
| Stash | Official documentation confirms that iOS can provide HTTP and SOCKS proxies; after enabling “Allow LAN Connections,” use the phone's local-network IP and port 7890 | This is manual proxy sharing; it does not turn the iPhone into a full transparent gateway |
| Shadowrocket | The App Store description covers on-device traffic and multi-hop forwarding, but does not present local-network sharing as a primary feature | If the current version has no clearly labeled shared-listener setting, do not rely on outdated third-party screenshots |
| Surge | The official architecture documentation explains that iOS can use a local proxy service to handle requests from another device | The target device still needs a manually configured proxy; the exact listening address and permissions depend on the current Profile and version |
Whichever app you use, first grant iOS “Local Network” permission and connect both devices to the same Wi-Fi network or personal hotspot. Open a test page on the second device, then confirm in the iPhone request log that it followed the expected policy. Turn off the listener when you are done, and never expose an unauthenticated proxy on public Wi-Fi.
A normal subscription connection does not require a MITM root certificate
All three tools may support rewrites, scripts, or HTTPS decryption, but ordinary subscription-based connections do not require a root certificate. MITM causes the app to re-sign certificates locally, and some apps with certificate pinning will reject the connection outright.
Before installing a Module or remote script, read the source file to see which hosts, request headers, and response contents it changes. The Surge documentation states that a Module can override Rule, Script, URL Rewrite, and MITM settings. Do not casually import modules from unknown sources, as they may change these settings.
Check the current store listing for prices, availability, and supported devices
Prices, regional availability, Family Sharing, and supported devices can all change. The current US Shadowrocket App Store listing shows it as a standalone paid app and clearly states that no proxy service is included. For Stash and Surge, likewise check the store listing for the purchasing account's region and the official documentation.
If you may later use it on Apple TV, Mac, or a family member's device, first confirm whether the same purchase can download it, how configurations sync, and whether scripts and certificates migrate with it. Include those costs to determine the real price.
How do you migrate subscriptions, rules, and settings when switching clients?
When switching clients, do not copy all the old app’s caches and certificates. Import the subscription into the new app, confirm connectivity with one fixed node, then add your own rules, modules, or scripts one at a time.
Migration order
- Save the original subscription address and the names of currently working policy groups
- List the rules, modules, or scripts you wrote yourself; do not copy unknown caches
- In the first round, verify only the subscription, a fixed node, lock-screen behavior, and network switching
- Rebuild advanced rules one at a time, checking the connection after each addition
- Wait until the new app has been stable for several days before deleting the old configuration and certificates