Choose a client by operating system and processor architecture. Clash Plus is recommended for Windows, macOS, Android, and iOS; Linux users can start with Clash Verge Rev. Choose the Mihomo core if you need to deploy a service yourself.
Check your system type under Settings → System → About. The GUI clients below are x64 installers. On ARM devices, confirm Windows app compatibility first; x64 and ARM64 are not interchangeable native packages.
A good starting point for a first install. Import a subscription and select its profile, then check the outbound mode and system proxy. Don’t enable the proxy before loading an outbound. When using the client across devices, check subscription format and local settings separately.
For desktop use cases that need control over profiles, rules, and traffic routing. System proxy and TUN are separate routing options. Verify the system proxy first, then configure TUN and any required service permissions if your use case calls for it.
A desktop option for importing profiles and choosing proxy groups. When migrating an existing YAML file, check file paths, rule-set locations, and external controller settings. Don’t assume local paths from another device will work here.
Another desktop interface for managing profiles. Before switching clients, quit the old one and disable its system proxy or virtual network interface to prevent processes from competing for ports. After importing, verify which profile is active.
An archived download for recreating an older setup or migrating an existing configuration. Older clients do not include the current Mihomo feature set, and may differ in protocol, DNS, and rule syntax support. For a new setup, choose one of the clients above.
| Check | Requirements and guidance |
|---|---|
| Operating system and architecture | Use a Windows version supported by your chosen client. Installers in this section are x64 / AMD64; check the installer details for the minimum supported Windows version. |
| Permissions | Importing a profile and installing a TUN service require different permissions. If a system service is needed, approve the administrator prompt shown by the client. |
| Traffic routing conflicts | Quit other proxy or VPN clients first. If a port is in use, check the logs to identify the process instead of enabling multiple traffic-routing options at once. |
Check your chip type under About This Mac. For Apple Silicon, prefer a file explicitly labeled ARM64; choose x64 for Intel. Some listed clients use the same x64 file for both architecture links; the actual file type is noted below.
Separate ARM64 and x64 files are available. Open the disk image and follow its instructions to move the app to Applications, then launch it from there. Handle any macOS security prompts on first launch, then import a profile and check that the system proxy is working.
For managing subscriptions, rules, and desktop traffic routing. The Apple Silicon link in the current list also provides an x64 disk image, not a native ARM64 build. Check Rosetta compatibility before use; don’t choose based on the device name alone without checking the file architecture.
When migrating a profile, check DNS, rule-set caches, and system proxy status separately. Both macOS links currently provide AMD64 files. Apple Silicon users should confirm compatibility; for a native ARM64 build, choose a client above with clearly differentiated architecture options.
Archived downloads are available for migrating older setups. Both links currently provide x86_64 files, not native ARM64 installers. When reusing an existing profile, account for differences in core features and system permissions. For a new install, choose a maintained client.
| Check | Requirements and guidance |
|---|---|
| Chip | Check ARM64 for Apple Silicon and x64 for Intel. Compatibility through translation is not native architecture support. |
| macOS version | Check the system requirements for your chosen client’s current installer. Before upgrading macOS, confirm that helper services and traffic-routing features are still supported. |
| Permissions | Review the specific security prompt in System Settings. For requests involving helper services, network extensions, or Keychain access, verify that they come from the client you just installed. |
Most recent phones use ARM64, but check the device’s app compatibility before choosing a package. Make sure the APK has finished downloading before installing. The first time you connect, Android will usually request VPN permission to route network traffic; this does not mean a proxy outbound is configured.
This download provides an ARM64 installer. After installation, import a valid subscription and confirm the profile loads, then choose a proxy policy and connect. If the connection drops when the screen locks, check battery optimization and background restrictions before replacing the subscription.
Choose a package for your device architecture. If you’re unsure, check whether the universal package supports your system. If you use per-app routing, make sure the target app is included; otherwise, traffic that bypasses the client may look like a rule isn’t working.
Two ARM architecture APKs are available. The architectures indicate compatibility, not different feature tiers; choose the package your system can run. If Android says the app wasn’t installed, check the existing app’s signature, architecture, and OS compatibility. Back up local settings before uninstalling.
An alternative client with a different configuration format. Surfboard profiles are not interchangeable with Mihomo YAML. Before importing, confirm the format and protocol support provided by your service; changing a file extension does not convert one format into another.
| Check | Requirements and guidance |
|---|---|
| Runtime compatibility | Confirm that your system supports ARM64 or ARMv7 apps. Universal packages must also meet the client’s minimum Android version requirement. |
| Installation permissions | Android may ask you to allow app installs from your browser or file manager. Grant this permission only to the source you’re actually using. |
| Connection permissions | Another VPN app in the same user profile may replace the active connection. Disconnect the old VPN before testing the new client. |
Install Clash Plus from the App Store. Check the store listing for the specific iPhone and iPad OS requirements and device compatibility. Import a subscription after installation, then approve the VPN configuration when you connect.
Start the installation from the App Store, then add a subscription or configuration using the guide. iPad Split View can help you compare instructions with the configuration screen, but the layout doesn’t determine whether rules work. Verify traffic routing using connection logs, proxy group selection, and requests to a target service.
| Check | Requirements and guidance |
|---|---|
| System compatibility | Check the App Store listing for the required OS version and compatible devices, then install as directed. |
| Network permissions | When connecting, allow the VPN configuration when prompted by iOS. If switching from another traffic-routing app, confirm which connection is currently active. |
| Configuration source | Use a subscription format supported by the client. After importing it, select the profile and confirm the proxy group’s outbound. |
For desktop Linux, identify your distribution’s package management system and check the processor architecture. The GUI packages below are AMD64 / x86_64. For server or router deployments, see the core downloads below; desktop installers are not command-line service binaries.
DEB and RPM target different package management systems and aren’t interchangeable archive formats. Use your distribution’s package manager to handle dependencies when possible. After the first launch, verify the desktop system proxy, core operation, and service permissions separately.
This section provides an AMD64 DEB package for compatible desktop environments. If the window opens but apps still bypass the proxy, first check whether they use the desktop proxy settings. Consider TUN and routing configuration only if you need to route additional traffic.
| Check | Requirements and guidance |
|---|---|
| Distribution | DEB packages are for distributions compatible with the Debian package system; RPM packages are for RPM-based distributions. System library versions must also meet the client’s requirements. |
| Architecture and desktop | These AMD64 / x86_64 GUI clients require a supported desktop environment. Run uname -m to help check your architecture. |
| Permissions and routing | TUN requires virtual network interface and routing permissions. When managing a remote device, keep a recovery path available so a changed default route doesn’t lock you out. |
For servers, routers, and users who manage processes themselves. Desktop and mobile users should start with the GUI clients above; the core does not include a subscription management interface.
| System | Architecture | File format | Download |
|---|---|---|---|
| Windows | AMD64 | ZIP | Download AMD64 ZIP |
| Windows | ARM64 | ZIP | Download ARM64 ZIP |
| macOS | Intel · AMD64 | GZ | Download Intel GZ |
| macOS | Apple Silicon · ARM64 | GZ | Download ARM64 GZ |
| Linux | AMD64 | DEB | Download AMD64 DEB |
| Linux | AMD64 | GZ | Download AMD64 GZ |
| Linux | ARM64 | GZ | Download ARM64 GZ |
| Linux | ARMv7 | GZ | Download ARMv7 GZ |
| Linux | MIPS · softfloat | GZ | Download MIPS GZ |
Extract ZIP and GZ files before use; GZ contains a compressed core binary, not a graphical installer. Unix-like systems may also require executable permissions. First run the configuration check command to validate the YAML, then start the core with an explicit configuration path. Don’t overwrite a running binary and skip validation.
mihomo -t -f config.yaml
mihomo -f config.yamlThese commands assume the core is available in your PATH and a usable config.yaml is in the current directory. Passing the configuration check confirms syntax and related loading checks, but doesn’t guarantee that an outbound can connect. Also verify DNS, rule-set loading, and connection logs. See the Mihomo configuration guide for deployment steps.
Check the operating system first, then the processor architecture, and finally the package format. Windows EXE, macOS DMG, Android APK, and Linux DEB and RPM files each use different installation processes. Wait for the browser to finish downloading, then open the actual file from your file manager. If it still has a temporary download indicator, wait for the download to complete instead of changing the file extension.
Architecture labels describe the environment a file supports, not a performance ranking. AMD64 and x64 usually mean 64-bit x86; ARM64 and ARMv7 are not interchangeable. Compatibility also depends on the operating system and client requirements. On macOS, some links are explicitly labeled as x64 files; they are not native Apple Silicon packages.
Before upgrading or migrating, save your local configuration, override scripts, custom rules, and settings you’ll need to restore. Subscription URLs may contain credentials; don’t include them in public screenshots, forum posts, or shared logs. Turn off the old client’s system proxy and traffic routing before launching the new one to reduce port conflicts, leftover proxy settings, and virtual network interface conflicts.
Different builds of the same client may use different signatures and configuration directories. If the installer reports a conflict, note the error and find out where the existing app came from. Don’t clear all app data just to fix an installation issue. Before uninstalling, make sure your backup can be restored and note the subscription provider’s required import format.
Installing a client does not provide a proxy service. Import a valid subscription or write your own configuration, select the active profile, and check the rule mode and proxy group. Rule is the usual mode for everyday routing. Global changes outbound selection; it won’t fix a broken subscription or restore an unavailable outbound.
On desktop, verify the system proxy first, then enable TUN if needed. On mobile, approve the system network permissions. After connecting, open the target service and check the client’s connection log. If there’s no log entry, first check whether traffic is reaching the client. If there is an entry but the request fails, check the matched rule, DNS resolution, and outbound connection in that order. See importing a subscription, system proxy settings, and connection checks for the full walkthrough.
Start by checking the package type, architecture, and installation environment.
Desktop and mobile users should start with a GUI client. Clash Plus is the recommended option for Windows, macOS, Android, and iOS; Linux users can start with Clash Verge Rev. Core binaries are for server or router users who manage configuration, processes, and routing themselves.
AMD64 and x64 usually refer to the same 64-bit x86 architecture; ARM64 is a different processor architecture. Android’s ARMv7 package is for compatible 32-bit environments, while a universal package includes multiple architectures. Check your system information and the package details rather than relying on the device brand.
For some clients in the current list, the Apple Silicon and Intel links point to the same x64 file. The package type is noted beside the relevant buttons. These are not native ARM64 packages; Apple Silicon users should check Rosetta compatibility or choose a client that explicitly offers an ARM64 file.
The client installer does not include a working proxy service. Import a valid subscription or configure a proxy outbound yourself, select a profile and proxy group, then enable the system proxy or TUN as needed. Check the connection log to confirm requests reach the client, then verify the matched rule and outbound.
First check your operating system, processor architecture, and package format. Then confirm the download completed, check available disk space, and review any OS security prompts. Avoid repeatedly installing over an existing copy. For TUN or helper services, follow the client’s instructions for administrator permissions and check the error logs.
Keep your subscription URL, local YAML files, overrides, custom rules, and any proxy group selections you want to restore. Subscription URLs may contain credentials, so store them securely. After upgrading, verify configuration parsing, DNS, and traffic routing before restoring routine settings such as automatic updates.