Clash client rankings · organized by platform

Clash Client RankingsCompare and Download

Find clients by supported platform, with guidance on subscription imports and routing rules to help you choose the right download.

Platform recommendations Config examples English guides

No.1

Top pick

Clash Plus

  • System Proxy: shown enabled
  • TUN Mode: shown disabled
  • Auto-update subscriptions: shown enabled
Go to downloads

Settings shown for illustration; actual options vary by platform and client.

No.2

Desktop picks

Clash Verge Rev

  • System Proxy: shown enabled
  • TUN Mode: shown disabled
  • Auto-update subscriptions: shown enabled
Go to downloads

Rankings reflect editorial order, not performance scores.

No.3

Mobile picks

Clash Meta for Android

  • System Proxy: shown disabled
  • TUN Mode: shown enabled
  • Auto-update subscriptions: shown enabled
Go to downloads

On mobile, traffic is typically routed through VPN permission.

CONFIG / Configuration Guide

Rules, proxy groups, and traffic routing

The client provides the controls; the core handles connections. Understand what each config field does before choosing a setting. The examples below use Mihomo syntax and are not complete configs with subscriptions or proxies.

Routing rulesconfig.yaml / rules

Rule mode evaluates rules in order, and the first match determines where a connection goes. The final MATCH rule handles everything else. This lets you send specific domains direct and route other connections through a proxy group, instead of forcing every app down the same path. Before editing, make sure the referenced proxy group exists to avoid config load errors. Rule editing varies by client, but compatible cores can use the corresponding syntax. To troubleshoot routing, check the matched rule in the connection log—it tells you more than the proxy toggle alone.

mode: rule
rules:
  - DOMAIN-SUFFIX,example.com,DIRECT
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - MATCH,DIRECT
Routing rules · rules

Rule mode evaluates rules in order, and the first match determines where a connection goes. The final MATCH rule handles everything else. This lets you send specific domains direct and route other connections through a proxy group, instead of forcing every app down the same path. Before editing, make sure the referenced proxy group exists to avoid config load errors. Rule editing varies by client, but compatible cores can use the corresponding syntax. To troubleshoot routing, check the matched rule in the connection log—it tells you more than the proxy toggle alone.

mode: rule
rules:
  - DOMAIN-SUFFIX,example.com,DIRECT
  - IP-CIDR,192.168.0.0/16,DIRECT,no-resolve
  - MATCH,DIRECT
Proxy group selection · proxy-groups

Proxy groups organize multiple outbound options into a set for manual selection or automatic checks. select lets you choose manually; url-test picks based on test results; fallback tries available options in the configured order. These are distinct from rule mode and global mode. After importing a subscription, check that the expected proxies appear in the group, then point your rules to it. Speed tests reflect requests to a specific test URL and are not a substitute for testing real-world traffic. The example below shows a group with built-in proxies; your config can include proxy names from your subscription.

proxy-groups:
  - name: Manual Selection
    type: select
    proxies:
      - DIRECT
      - REJECT
rules:
  - MATCH,Manual Selection
DNS and Fake-IP · dns

DNS settings control how domain names are resolved. Fake-IP uses virtual addresses to map domains to connections, allowing the core to route traffic by domain. Seeing addresses from the reserved range after enabling it does not mean your proxy is broken; check client logs and test actual access. For LAN services that need real DNS results, add them to the filter list as described in the core documentation. Before switching clients, check whether DNS requests reach the core and whether the upstream resolver is reachable—this usually narrows down the issue faster. The resolvers in this snippet illustrate the fields; adjust them for your network.

dns:
  enable: true
  enhanced-mode: fake-ip
  fake-ip-range: 198.18.0.1/16
  fake-ip-filter:
    - "*.lan"
    - "localhost"
  nameserver:
    - https://dns.alidns.com/dns-query
TUN mode · tun

System proxy relies on apps honoring the operating system’s proxy settings. TUN routes traffic that matches its routing rules through a virtual network interface, making it useful for apps that ignore system proxy settings. Enabling it may require administrator privileges, a service component, or VPN permission on mobile; the client determines the exact steps. It cannot restore an invalid subscription or guarantee compatibility with every app. Test with a known-good config, then check routes, DNS, and conflicts with other VPNs. Verify that regular websites load before testing the target app, and avoid changing multiple network settings at once.

tun:
  enable: true
  stack: mixed
  auto-route: true
  auto-detect-interface: true
  dns-hijack:
    - any:53

Support for each config option depends on the core in use. For rule sets, domain sniffing, local overrides, or an external controller, see the Advanced Config Guide. If you’re importing a subscription for the first time, start with the Getting Started Guide.

Client selection examples

Choose based on your use case; a similar interface does not guarantee config compatibility.

Clash Plus

Desktop and mobile platforms

If you’re looking for the installer for your operating system, start with the top pick in the rankings and check which features your platform supports.

Compare clients →

Clash Verge Rev

Desktop config management

A good fit for managing configs and proxy groups on desktop. With local overrides, distinguish the original subscription from the effective config.

Compare clients →

Clash Meta for Android

Mobile connection management

For Android config imports, VPN permissions, and app traffic routing. Check your device’s CPU architecture before installing.

Compare clients →

DOWNLOAD / Platform Downloads

Choose a client for your operating system

Identify your operating system and processor architecture before comparing clients. Download packages are just installers; subscriptions provide the available proxies. You need both, and installing a client does not provide proxy service by itself.

Windows

Start with Clash Plus, then compare Clash Verge Rev, FlClash, and Clash Nyanpasu. For help migrating an old config, see the archive notes for the discontinued Clash for Windows; it is not a recommended option for ongoing updates.

On first launch, import a subscription and confirm the core starts before enabling system proxy. If a port is already in use, identify the other proxy process first. To use TUN, follow the client’s prompts to install its service or grant administrator permissions. There’s no need to enable every networking feature on first launch.

macOS

Check About This Mac to see whether your device has Apple Silicon or an Intel processor, then choose the matching installer. Clash Plus, Clash Verge Rev, and FlClash are the main options on the downloads page. ClashX Meta is listed separately as a discontinued archive client.

Permission prompts after installation and subscription imports are separate issues: network extension or service permissions affect traffic routing, while the subscription provides proxies and rules. Before responding to a Keychain prompt, verify which app is requesting access and review your system settings. Not every startup prompt means your proxies are unavailable.

Android

The downloads page lists Clash Plus, Clash Meta for Android, FlClash, and Surfboard. Most newer devices use ARM64, but older models may need a different architecture. Check your device specs if you’re unsure rather than guessing from the phone brand.

After importing, select the config and approve the system VPN connection request. If the connection drops when switching apps or locking the screen, check background activity and battery settings. For per-app routing, confirm whether the client uses an allowlist or a blocklist so you don’t configure the target app on the wrong side.

iOS

Clash Plus is available through the App Store. Its official website is clashplus.io. Open its App Store listing from the downloads page, check device compatibility, and then add a config using the import method provided by the client.

On the first connection, allow the app to add a VPN configuration. Check the connection status in system settings. Desktop fields and steps may not apply to mobile. If a subscription format isn’t supported, confirm which export format the provider offers and follow the current client’s documentation.

Linux

Desktop users can compare Clash Verge Rev and FlClash, choosing the appropriate package format such as DEB or RPM for their distribution. Server and router users should distinguish graphical clients from the Mihomo core; desktop installers are not general-purpose command-line tools.

Check your processor architecture and runtime requirements before installing. A desktop system proxy, terminal proxy environment variables, and TUN routing do different things. Browser access does not prove that command-line tools use the proxy. Test each target app separately and check service permissions, routes, and DNS resolution.

Browse all clients →

ECOSYSTEM / Open Source

How clients, cores, and subscriptions differ

Use project documentation and your actual config to understand features. Rankings are not a measure of maintenance status, and connection speed does not come from the installer itself.

Open the Advanced Config Guide →

How Clash and Mihomo fit together

The Clash ecosystem includes many graphical clients, which provide controls for importing configs, choosing proxy groups, viewing logs, and managing network settings. Mihomo is a proxy core derived from Clash.Meta; it handles protocols, rule matching, DNS, and connection forwarding. A client name containing Clash or Meta does not mean every app uses the same core build, nor that all settings can be copied between them. To determine whether a field is supported, check the core actually in use and how the client generates its config.

Understanding these layers makes troubleshooting easier. If the interface won’t open, check the app’s runtime environment. If a config fails to load, check its syntax and fields. If a rule does not match as expected, inspect the effective config and connection log. If only one proxy is unavailable, check the subscription provider or destination network. Mixing these issues together can lead to repeated reinstalls without fixing the underlying problem. The homepage examples explain config fields; refer to the current documentation for each project for specific options.

Open-source project resources

Mihomo’s source code, issue discussions, and documentation help explain how the core works. For questions about protocol support, DNS behavior, or routing, search the documentation for the relevant field name, then review related discussions. When reporting an issue, include your operating system, steps to reproduce, and redacted logs; distinguish subscription-generated config from local edits. Public resources make it easier to follow design decisions and fixes, but open source does not mean every client has identical features, permission requirements, or release schedules.

The command below retrieves the Mihomo source code. It’s useful if you want to read the implementation, prepare a build environment, or investigate config behavior. Cloning the repository does not install a desktop client or create a working subscription. If you just want to import a config and get started, use the platform download links above. To look up core settings, visit the Mihomo documentation and search by field name.

Mihomo / Source Code Repository
git clone https://github.com/MetaCubeX/mihomo.git

View the Mihomo repository →

Update the client and subscription separately

Client updates affect the interface, system integration, and bundled core. Subscription updates affect proxies, proxy groups, and rules provided by the service. These updates can happen independently. If the proxy list hasn’t changed, first check whether the subscription request succeeded and the URL is valid. If a protocol fails to load, check whether the current core supports it. Re-fetching a remote subscription can overwrite edits made directly to its original config, so manage rules you want to keep with the client’s supported override mechanism.

Before updating, save your working config and note any manually adjusted ports, DNS settings, and traffic-routing options. After updating, confirm the config loads, test a site you use regularly, and then check that routing behaves as expected. Avoid changing the client, subscription URL, and upstream DNS at the same time; otherwise, it’s difficult to tell what caused a problem. Discontinued clients can be useful for reviewing old configs, but archive status is no promise of continued compatibility with new systems or protocols.

Subscription sources and connection checks

A client is a connection tool; users generally provide their own subscriptions. Subscription URLs may contain credentials, so protect them like passwords. Remove full subscription URLs, controller keys, and proxy credentials from screenshots, public logs, and support requests. Before adding a config, verify that its source is trustworthy and understand the service scope, expiration date, and traffic limits. Sending an unfamiliar link to a third-party conversion service may expose the full config; understand how the service handles it first.

After importing successfully, don’t rely on the connection icon alone. Confirm that the newly imported config is active and that the proxy group contains an available option. Then visit the destination you want to test and check the matched rule and proxy in the connection log. A successful proxy test only confirms that a request to the test endpoint completed; it does not prove that every site, app, or UDP use case will work. If both direct and proxied connections fail, check your local network first. If only certain domains fail, check DNS, rules, and the destination service. This sequence helps avoid unsupported config changes.

NOTES / Practical Tips

Troubleshoot installation and connection issues

Choose an article based on what you’re seeing: check ports if startup fails, system permissions if prompted on first launch, and proxy settings, DNS, rules, and proxies in turn if you can’t access sites after connecting.

Browse all articles →

Download Clash