shadowsocks-windows is a lightweight desktop proxy client that connects to Shadowsocks servers, routing selected traffic through an encrypted SOCKS5 or HTTP tunnel while leaving everything else on a direct connection.
shadowsocks-windows is a desktop client that turns a Shadowsocks server into a usable system-wide proxy. You add one or more servers, choose a local listening port, and enable the system proxy; applications then send their traffic through the tunnel without any per-app configuration. The client sits in the notification tray, so switching servers, toggling modes, or changing rules takes a couple of clicks rather than a config file edit. A rules engine decides which domains travel through the proxy and which connect directly, which keeps local and regional sites fast while still routing the traffic you need to protect.
Most people run shadowsocks-windows alongside a second tool that handles a different job. A proxy client like this one is built for browsing through a remote tunnel, while a full VPN client such as Pritunl Client creates a network interface and routes traffic for entire subnets, including resources that never speak HTTP. Knowing which one to reach for saves a lot of frustration: pick the proxy when only browser and app traffic needs to change, and pick the tunnel client when remote machines, file shares, or internal services have to be reachable. Both can coexist on the same machine as long as the local ports and routing rules do not overlap.
The biggest benefit of shadowsocks-windows is that it stays out of the way. It runs in the notification tray and applies proxy settings the moment you enable them, so you are not restarting browsers or editing environment variables every time the tunnel comes up. Server auto switching keeps a session alive when one endpoint slows down, choosing a replacement by latency or packet loss instead of making you hunt through a list manually. The PAC engine handles the tedious part of routing, sending matched domains through the tunnel and letting everything else connect directly, and user rules cover the sites that no public list will ever get right. Hotkeys let you toggle the proxy without touching the tray icon, and QR code import means a new server can be added from a screenshot. For anyone who needs selective, reversible proxying rather than a full network tunnel, that combination is hard to beat.
Key capabilities and highlights.
Enable the system proxy from the shadowsocks-windows tray menu and every application that respects system settings starts using the tunnel immediately. Disabling it restores direct connections in one step, which makes the client easy to switch on and off during the day.
Choose rule-based routing or send everything through the tunnel. PAC mode reads a rule set and decides per request, while global mode forces all traffic through the proxy, so you can flip between selective and complete proxying depending on the network you are on.
Rule files are generated from the v2fly geosite domain database and split into groups for direct and proxied traffic. Whitelist and blacklist modes let you decide whether unmatched domains go through the tunnel or connect directly, which covers most routing needs without manual editing.
Edit a plain rule file to force specific domains through the proxy or keep them on a direct connection, which is the practical fix when a public list blocks something you need or misses a site you use. Rules survive rule-set updates.
Point shadowsocks-windows at several server profiles and let it choose which one to use, either by random load balancing or by picking the endpoint with the lowest latency and packet loss. A dead or congested server stops being something you notice.
Besides the standard SOCKS5 listener, the client accepts HTTP proxy connections, so tools that only speak HTTP can still use the tunnel. Browsers, package managers, and command-line utilities can be pointed at the same local endpoint without extra software.
Bind key combinations in shadowsocks-windows to start, stop, and switch modes so the proxy can be toggled without opening the tray menu. The settings screen shows whether a combination is already taken by another program, which prevents silent conflicts.
Connect through a plugin by pointing a server entry at its executable, which supports setups that wrap the base protocol in extra obfuscation. Server profiles can also be imported by scanning a QR code, removing the errors that come from retyping long keys and passwords.
Browse historical releases and previous builds.
No old versions have been added yet.
Common questions about shadowsocks-windows.
It routes selected internet traffic from a computer through a Shadowsocks server. People use it to keep browsing and app traffic encrypted on untrusted networks, to reach services that are unreachable from their location, and to separate work traffic from everything else running on the same machine.
Not usually. Enabling the system proxy makes applications that respect system settings use the tunnel automatically. Anything that ignores system settings can be pointed at the client's local SOCKS5 or HTTP listener manually, and programs that only handle UDP need a separate wrapper to be forced through the proxy.
PAC mode inspects each request and applies the rules, sending matched domains through the tunnel and connecting the rest directly. Global mode ignores the rules and pushes all traffic through the proxy. Use PAC mode for everyday browsing so local sites stay fast, and global mode when everything needs to be tunnelled.
Yes. Add multiple server entries and choose an auto-switching strategy, such as random load balancing for spreading demand, or latency and packet-loss based selection for picking the healthiest endpoint. The client re-evaluates servers as conditions change, so a slow server is replaced without manual intervention.
By default, shadowsocks-windows connects regional domains and their CDNs directly and sends everything else through the tunnel. If you prefer the opposite, switch to blacklist mode, where only the domains you mark as proxied use the tunnel and unmatched traffic connects directly.
Yes. The client reads server profiles from a QR code, so a configuration can be entered by scanning an image instead of copying a long password and cipher by hand. That removes typos, which are a common cause of connections that fail without an obvious error message.
UDP relay is supported when the server handles it, but many applications still need an extra wrapper to be redirected to the local proxy, because coverage is not system-wide for every program. TCP traffic is handled directly, and most software falls back to TCP without complaint.
No. shadowsocks-windows acts as a proxy rather than creating a virtual network interface. It changes how browser and application traffic leaves the machine, but it does not put the device onto a remote network, so it cannot reach a private file share the way a VPN client can.
shadowsocks-windows is a lightweight desktop proxy client that connects to Shadowsocks servers, routing selected traffic through an encrypted SOCKS5 or HTTP tunnel while leaving everything else on a direct connection.
v2rayN is a desktop GUI that drives Xray, sing-box, and other proxy cores, letting you import subscriptions, test server latency, choose routing rules, and enable system proxy or TUN mode from one window.
sing-box is a configurable proxy platform that runs as a single binary, accepting traffic through inbounds, matching it against routing rules, and forwarding it through outbounds that can speak dozens of protocols.
Clash Verge Rev is a desktop GUI for the Mihomo rule-based proxy core, letting you import subscription profiles, switch nodes, edit rules visually, and route traffic through system proxy or TUN mode.
Surfshark is a VPN service that encrypts internet traffic, masks the user’s public IP address, and combines selective routing, tracker blocking, multi-server connections, and automatic protection for everyday privacy.
Comments