A graphical client for Apple silicon and Intel Macs, with subscription management and rule-based routing in one place.
Illustrative client settings. Labels and menu locations vary by client; toggle states are for demonstration only.
macOS Settings at a Glance
First, distinguish the client interface, proxy core, and configuration file. The interface provides controls, the core handles connections, and the configuration defines rules and outbound policies. The six sections below follow common Mac workflows; exact features depend on the client you choose.
Turn on Set as system proxy in General Settings to point macOS proxy settings to the client's local listening address. Browsers and other apps that follow system settings can then use the proxy. Before enabling it, make sure the core is running; then visit a webpage to test the connection. This does not force every app to use the proxy: terminal tools and some games may use their own network settings. The client toggle makes switching easier than entering each setting manually, but check the active network service, especially after switching between Wi-Fi and Ethernet.
TUN mode uses a virtual network interface and routing rules to send traffic within its route scope to the core. It can help route terminal tools and other apps that ignore system proxy settings. Find the option under Network or Enhanced Mode, install the required service as prompted, grant macOS permissions, then enable TUN and check the connection log. Unlike mobile system authorization flows, TUN on Mac often requires a background service and administrator privileges. TUN does not send every connection through a proxy; routing rules determine the outbound path. If you use another VPN at the same time, watch for routing and DNS conflicts.
In Rule mode, traffic is matched against domains, addresses, and other conditions in the order defined by the configuration, then passed to the corresponding proxy group. Select Rule mode on the Proxy page, then open a proxy group and choose an available outbound. If the result is unexpected, check the matched rule on the Connections or Logs page. Proxy group names come from the configuration; they are not built-in services. Unlike a single global toggle, rule-based routing lets different destinations use different paths, but depends more on rule order and DNS results. Keep a copy of your configuration before editing, and avoid changing subscription-managed content that may be overwritten on update.
Open About This Mac from the Apple menu. If it lists an Apple chip, choose the Apple silicon or arm64 installer; if it lists an Intel processor, choose the x64 installer. Dual-architecture support means separate installers are available for each processor type, not that every download is a universal binary. A native app built for your Mac's processor is usually a better everyday choice than running it through Rosetta. Minimum macOS versions vary by client, so check the download page before installing on an older system. Make sure both the graphical client and its bundled core support your macOS version.
Add a compatible subscription URL on the Subscriptions or Configuration page. Once it downloads, set it as the active configuration and enable automatic updates if needed. Updates refresh remote rules and outbound details; they do not upgrade the client or core. Subscription management suits configurations that need regular maintenance better than importing local files by hand, but the server-provided content must still be compatible with the core. Updates may not run on schedule while your Mac is asleep, so check manually after waking it. For custom rules you need to keep, use the client's override or merge features instead of editing files generated from a remote subscription.
Mac clients typically include menu bar controls, letting you switch outbound modes, check the active configuration, or pause the proxy without opening the main window. Look in the client settings for menu bar options, window-close behavior, and launch-at-login controls. Closing a window does not necessarily quit the app; when you're done, distinguish hiding the window from quitting the app. Unlike mobile devices, where these controls often rely on the system VPN status, Mac users should check whether the menu bar app is still running and whether the system proxy resets on exit. This helps avoid leaving proxy settings pointed at a stopped port.
Turn on Set as system proxy in General Settings to point macOS proxy settings to the client's local listening address. Browsers and other apps that follow system settings can then use the proxy. Before enabling it, make sure the core is running; then visit a webpage to test the connection. This does not force every app to use the proxy: terminal tools and some games may use their own network settings. The client toggle makes switching easier than entering each setting manually, but check the active network service, especially after switching between Wi-Fi and Ethernet.
TUN mode uses a virtual network interface and routing rules to send traffic within its route scope to the core. It can help route terminal tools and other apps that ignore system proxy settings. Find the option under Network or Enhanced Mode, install the required service as prompted, grant macOS permissions, then enable TUN and check the connection log. Unlike mobile system authorization flows, TUN on Mac often requires a background service and administrator privileges. TUN does not send every connection through a proxy; routing rules determine the outbound path. If you use another VPN at the same time, watch for routing and DNS conflicts.
In Rule mode, traffic is matched against domains, addresses, and other conditions in the order defined by the configuration, then passed to the corresponding proxy group. Select Rule mode on the Proxy page, then open a proxy group and choose an available outbound. If the result is unexpected, check the matched rule on the Connections or Logs page. Proxy group names come from the configuration; they are not built-in services. Unlike a single global toggle, rule-based routing lets different destinations use different paths, but depends more on rule order and DNS results. Keep a copy of your configuration before editing, and avoid changing subscription-managed content that may be overwritten on update.
Open About This Mac from the Apple menu. If it lists an Apple chip, choose the Apple silicon or arm64 installer; if it lists an Intel processor, choose the x64 installer. Dual-architecture support means separate installers are available for each processor type, not that every download is a universal binary. A native app built for your Mac's processor is usually a better everyday choice than running it through Rosetta. Minimum macOS versions vary by client, so check the download page before installing on an older system. Make sure both the graphical client and its bundled core support your macOS version.
Add a compatible subscription URL on the Subscriptions or Configuration page. Once it downloads, set it as the active configuration and enable automatic updates if needed. Updates refresh remote rules and outbound details; they do not upgrade the client or core. Subscription management suits configurations that need regular maintenance better than importing local files by hand, but the server-provided content must still be compatible with the core. Updates may not run on schedule while your Mac is asleep, so check manually after waking it. For custom rules you need to keep, use the client's override or merge features instead of editing files generated from a remote subscription.
For a first install, import a subscription and test it in your browser before enabling TUN. For setting dependencies, recommended steps, and verification, see the Quick Start Guide. For protocol support and core compatibility, see the Protocol Guide.
Platforms & Installers
Clash is an ecosystem, and graphical clients differ in their settings and supported features. The download page lists available clients, architectures, and installation requirements by platform. Installers provide the software itself; you'll still need a compatible configuration. Whether one subscription works across devices depends on its format, protocol fields, and the service's terms.
A good fit for managing subscriptions and proxy groups on desktop. Check your system architecture before downloading, and watch for firewall and background-service prompts on first launch. System proxy and TUN are separate options; there's no need to enable both during initial setup.
Go to downloadsCheck About This Mac to see whether your Mac has an Apple chip or Intel processor, then choose the matching installer. The download page lists options such as Clash Plus, Clash Verge Rev, and FlClash. Consider menu bar workflows, service permissions, and minimum macOS requirements when choosing a client.
Go to downloadsChoose an installer for your device's architecture. On first connection, grant VPN permission when prompted. If the app frequently disconnects in the background, check battery optimization and background-app restrictions. After moving a desktop configuration to your phone, recheck its rules and DNS behavior.
Go to downloadsThe download page links to Clash Plus on the App Store and provides information from clashplus.io. After installation, follow the app's instructions to import a configuration and grant VPN permission. Supported protocols and configuration fields depend on the mobile client.
Go to downloadsDesktop users can choose a graphical client package for their Linux distribution. Server and router users need to distinguish the core from the graphical interface and configure service startup, permissions, and routing separately. Installing the core alone does not provide a desktop settings window.
Go to downloadsNote your macOS version, processor architecture, and configuration format. An older system may not run a newer client; an architecture mismatch can trigger translation or cause installation to fail; an incompatible configuration may fail to import or prevent the core from starting. Each issue has a different fix, so checking these details first is more effective than repeatedly switching installers.
If you're moving from another client, export a recoverable copy of your configuration and custom rules, then quit the old app. Don't let two clients change system proxy settings at the same time or compete for the same port. Once the new client can start its core, load the configuration, and log connections, migrate overrides and auto-update settings one at a time.
Project origins and configuration boundaries
When choosing a client, start with core capabilities and maintenance status, then consider whether the interface suits your workflow. Open-source repositories let you inspect implementations, track changes, and check configuration documentation; screenshots and app names alone can't provide that information.
The original Clash established common practices such as rule-based routing, proxy groups, and YAML configuration. The community later built different cores and clients on that foundation, with mihomo continuing the technical direction of the original Clash Meta. Similar names do not guarantee identical features. Common fields in older configurations may still work, but check the relevant core documentation for newer protocols, rule types, and DNS options. Keep a copy of the original file when migrating, then address fields explicitly flagged as incompatible in the logs.
This is why it's important to distinguish two names when choosing Mac software: the client name describes the interface, while the core name identifies the program that handles network connections. A client update doesn't necessarily include a core upgrade, and core support doesn't mean every interface provides a button for that feature. To check whether something is available, consult the client documentation, core support, and active configuration—not just the menu labels.
Browse mihomo's code, release history, and issue discussions in its project repository. Before following documentation, confirm which core and feature set it covers; don't copy configuration examples for another core directly into your current file. When reporting an issue, include your system version, processor type, client name, steps to reproduce, and relevant log excerpts. Before sharing logs publicly, remove subscription URLs, credentials, and other private data. Keep only the context needed to explain the error.
This site organizes download links and provides configuration guides. It does not treat separate community projects as one official app. Maintenance status on the download page can help you assess the risks of each option; archived clients may suit users with specific compatibility needs. For long-term use, favor a maintained client that supports your current macOS version and documents its key settings. Open-source status alone does not guarantee that every third-party package is identical to an upstream build.
Client updates mainly affect the interface, system integration, and installation services. Core updates change protocol implementations, rule handling, and network behavior. Subscription updates replace remote configuration content. These can happen independently: a successful subscription refresh doesn't mean the software itself has been upgraded. Before upgrading, note custom ports, DNS settings, and override rules. Afterward, check core startup, configuration loading, and actual connections in that order. If something breaks, this makes it easier to identify which layer changed.
Automatic updates don't replace basic checks. A subscription source may return an error page, or a field may only work with a particular core. If the app stops starting right after an update, check the configuration parsing error before changing network settings. Waking your Mac from sleep, switching network services, or starting and stopping another VPN can also change routing. During troubleshooting, adjust one setting at a time and note the results before and after each change to avoid misdiagnosing issues caused by several variables.
Installing a client does not automatically provide a working outbound connection. Subscriptions usually come from a service you already use, or you can maintain your own configuration. Before importing one, verify that its source is trustworthy, its format is compatible, and you understand its rules and DNS settings. Subscription URLs may contain access credentials; don't post them in public forums or share them casually with online conversion services. If you need to convert a format, first find out which fields may be lost, then check the converted proxy groups and rule references locally.
Troubleshoot connection issues by layer. If there are no connection records, check whether the app is routing traffic through the proxy. If a rule matches but the connection fails, check the outbound and network. If only some domains fail, investigate DNS, rule order, and the destination website. System proxy and TUN are not universal fixes. Look up symptoms in the Help Center, or use the Glossary to distinguish mixed ports, proxy groups, and virtual network interfaces before changing settings.
If you have Git installed, run this command in Terminal to download the public repository. It fetches source code only; it does not install a client or change your system proxy settings.
Clashgit clone https://github.com/MetaCubeX/mihomo.gitConfiguration and troubleshooting guides
Once your basic connection is working, explore guides for your specific issue. Format conversion is about field compatibility, certificate errors involve security, and client comparisons focus on workflow and system support. Each calls for a different troubleshooting approach.
Learn how common subscription formats differ and which clients support them. Understand how conversion works, which fields may be lost, and what to check afterward.
Learn how to tell apart incorrect system time, man-in-the-middle decryption, node hijacking, and website certificate issues. Understand the proxy's actual role in the HTTPS handshake and follow a step-by-step troubleshooting guide.
Compare popular macOS Clash clients by core version, interface, TUN support, subscription management, and resource usage, with recommendations for different workflows.