Windows
Ideal for everyday desktop use. Choose a graphical client to manage subscriptions, rule modes, and system proxy settings; if a port conflict occurs, you can inspect runtime logs and change the listening port directly.
Go to Downloads
mihomo Core · Cross-Platform Client Downloads
Clash Kernel Hub
Cross-Platform Clients
A curated selection of clients, mihomo core documentation, configuration guides, and rule references. Choose a desktop client for your device first, then import a subscription, select a proxy group, and enable the system proxy or TUN mode.
Free Forever
Open Source
English Documentation
Rule-Based Routing
Choose Your Device
Downloads for Five Platforms
Graphical clients handle subscription management, proxy selection, system proxy settings, and log viewing. Installation formats, permissions, and traffic interception differ across operating systems, so start with the relevant platform and choose from its software list. The download page also identifies maintenance status, supported architectures, and basic system requirements, helping you avoid mistaking a core archive for a desktop app.
macOS
Choose an installer for Intel or Apple silicon. On first launch, you may need to approve network extensions, system proxy access, or background service permissions before importing your subscription configuration.
Go to DownloadsAndroid
Uses the system VPN interface to route app traffic, making it suitable for phones and tablets. After importing a subscription, select a proxy group in the client and allow the system to establish the VPN connection.
Go to DownloadsiOS
Get a compatible client from the App Store. After installation, the system network extension handles connections, while subscriptions, proxy groups, and rule modes are configured in the app.
Go to DownloadsLinux
Desktop environments can use graphical clients, while servers, software routers, and containers more often run the mihomo core directly. Confirm the processor architecture and package format before choosing.
Go to DownloadsChoosing Between a Graphical Client and the Core
Most users should start with a graphical client. It combines configuration updates, proxy-group switching, system proxy controls, connection logs, and core startup in one interface, reducing everyday maintenance. mihomo core packages are mainly intended for servers, routers, containers, and automated environments, where you must provide the configuration file, startup parameters, and service management yourself. They are not different protocols that replace one another: graphical clients typically provide the interface and system integration, while mihomo parses the configuration and handles the actual traffic.
Core Workflows
Rules, DNS, and Cross-Platform Traffic Interception
A Clash client is not only about connecting to a particular proxy. The experience is shaped by rule matching, domain resolution, and how system traffic enters the core. The three sections below cover the configuration areas that most often affect results; switch between them using the tabs.
01 / RULES
Choose an Egress by Traffic Destination
Rule mode evaluates connection targets in the order listed in the configuration. Domains can be matched with DOMAIN, DOMAIN-SUFFIX, and rule providers; IP addresses can be handled by IP-CIDR, GEOIP, and similar rules, while MATCH catches anything not matched earlier. A match does not directly select a proxy; it first enters a proxy group, which then determines whether to connect directly, reject the traffic, or use a proxy route.
In practice, put more specific rules before broader ones, and make sure custom entries are not intercepted by a preceding general rule. Unlike tools with only a single global switch, Clash rule chains can handle work sites, local networks, update services, and domains requiring a proxy separately. This preserves clear traffic boundaries and makes it easier to trace which rule ultimately matched a connection in the logs.
Read the Advanced Rules and Proxy Groups Guide →
02 / DNS
Keep Domains Connected to Rules
DNS configuration determines how domains are resolved and affects whether domain rules can take effect accurately during connection setup. With built-in DNS enabled, the client can select upstream resolvers, define fallback behavior, and choose between regular addresses and Fake-IP mappings. Fake-IP mode first returns a mapped address to the application; the core then restores the domain through that mapping. In many situations, this reveals domain information earlier and avoids cases where only the destination IP remains, making domain rules difficult to match.
This configuration should not end with copying a list of addresses. Local domains, printers, router admin pages, and some system services may need to be included in filtering rules; browser secure DNS, system caches, and other networking tools may also bypass the client settings. When troubleshooting, first confirm that the request reaches Clash DNS, then inspect the resolution result and rule logs instead of repeatedly changing proxies. The full documentation also explains the separate roles of nameserver, fallback, and Fake-IP filtering.
Read the DNS Configuration Guide →
03 / SYSTEM
Choose Traffic Interception by System
Desktop systems usually begin with the system proxy, which captures apps that honor proxy settings and works well for browsers and standard desktop software. TUN mode creates a virtual network interface so more applications that ignore system proxy settings can enter the core, but it also involves routing, DNS, permissions, and firewall rules. Mobile clients generally use the system VPN interface for similar interception; the start button represents a system-level network extension, not merely a changed proxy address.
The same subscription can be used across devices, but system integration cannot be copied mechanically. Windows requires attention to service permissions and port usage; macOS requires approval for network extensions; Android and iOS display VPN authorization prompts; Linux also requires consideration of desktop sessions, daemons, and processor architecture. The site organizes clients by platform on the download page, explains permission prompts step by step in the tutorials, and covers the interaction between TUN, routing, and domain sniffing in the advanced guides.
Complete Your First Connection Step by Step →
Open-Source Ecosystem
The Boundaries Between Core, Client, and Documentation
The Clash ecosystem combines the core, graphical clients, configuration formats, rule providers, and community documentation. Understanding each component's role is more useful for long-term configuration maintenance than memorizing a particular app name.
From the Clash Configuration Model to mihomo
Clash established a configuration model built around rules, proxy groups, proxy nodes, and DNS. mihomo continues to implement networking capabilities within this model and serves as the core adopted by several active clients. The proxies, proxy-groups, rules, and dns sections each have distinct responsibilities: nodes describe connection parameters, proxy groups provide selectable egress options, rules determine which group receives a connection, and DNS preserves the relationship between domains and destinations.
A change in client name therefore does not mean the configuration logic has completely changed. During migration, check the fields supported by the core, how the client exposes system features, and whether existing rule providers still update correctly. The site's documentation focuses on current mihomo configuration behavior while retaining explanations of core Clash concepts.
Graphical Clients Handle System Integration
Graphical clients typically include subscription updates, proxy-group switching, connection history, log viewing, system proxy controls, and core process management. They do not reinvent the rule syntax; instead, they connect the underlying capabilities to the networking systems of Windows, macOS, Android, iOS, or Linux. Differences between clients mainly involve interface organization, release cadence, system services, configuration overrides, and cross-platform coverage.
The download page separates maintained clients from archived projects and lists available entry points by platform. Consider operating-system support, processor architecture, and required features first rather than judging by screenshots alone. Most desktop users need a graphical client; users comfortable with command lines, service management, and routing configuration are better suited to deploying the core directly.
Check Updates at Three Separate Levels
Client updates, core updates, and subscription updates are three different things. A client update may change the interface or system compatibility; a core update affects protocol implementation, rule capabilities, and DNS or TUN behavior; a subscription update refreshes nodes, proxy groups, or remote configuration content. When a proxy stops working, updating the subscription and checking the proxy group is usually more direct than reinstalling the client. Only when logs show core startup failures, unsupported configuration fields, or system integration problems should you investigate the client and core status further.
Site content follows this boundary: the download page covers software selection; Getting Started covers initial installation and connection; Advanced guides explain rules, DNS, TUN, and overrides; Troubleshooting focuses on port conflicts, proxy timeouts, and system proxy settings that do not take effect.
Open-Source Code Makes Implementation Easier to Verify
mihomo source code and development records are public, making it possible to understand configuration fields, behavioral changes, and bug fixes. When evaluating configuration advice from an unknown source, public documentation, code notes, and actual logs are more reliable than secondhand explanations. Release notes should also distinguish core features from client features: a capability implemented by the core may not yet have a corresponding control in every client, while a client toggle may simply provide a visual wrapper around an existing configuration field.
To inspect the code locally, use the Git command below to obtain the public repository. The command is intended for reading code and investigating issues; users who only want to install a client do not need to run it.
Featured FAQs
Confirm These Four Things Before Installing
During first use, many problems come not from the proxy itself but from a mismatch between the download platform, subscription format, proxy mode, or system permissions. The sequence below helps narrow things down; detailed steps are available in Getting Started and Troubleshooting.
What's the difference between a Clash client and the mihomo core?
mihomo is the core that processes configuration, rules, DNS, and connections. A graphical client provides the installation interface, configuration management, system proxy controls, network permissions, and core process management. Most users should download the graphical client for their operating system; servers and routers typically deploy the core package directly.
Where should I look first if no proxies appear after importing a subscription?
First confirm that you imported the complete subscription URL rather than a web page URL or a single-node description. Then update the configuration manually and check the update log for network errors, format errors, or authorization problems. If the configuration updated but the proxy group is empty, verify that the correct configuration file is active.
How should I choose between rule, global, and direct modes?
Rule mode is usually best for everyday use, with rules determining where each connection goes. Global mode sends most traffic through one proxy strategy and is useful for temporary testing; direct mode helps determine whether a problem is related to the proxy path. After switching modes, confirm that the proxy group has a working node selected.
What should I do if the client is running but my browser still cannot access the internet?
Check in order whether the system proxy is enabled, the listening port is conflicted, the proxy group has a working node selected, and DNS requests are reaching the client. If only some applications ignore the system proxy, consider whether TUN mode is needed instead of changing many rules at once. See Troubleshooting for the complete diagnostic path.
Configuration Notes
Recent Clash Guides
Articles are organized around practical questions. Each one covers a single, clearly defined topic with a diagnostic sequence, configuration locations, and verification methods, making it easy to revisit when the same symptom appears.
Clash Port Already in Use: A Complete Guide to Finding the Conflicting Process and Changing the Listening Port
If startup logs show bind: address already in use, another process is usually occupying the listening port. This article covers commands for identifying the conflict on Windows, macOS, and Linux, and explains how to verify changes to settings such as mixed-port.
How to Write Custom Clash Rules: DOMAIN Syntax and Match Priority Explained
Covers exact domain matches, domain suffixes, IP ranges, and GEOIP, explaining rule parameters, top-to-bottom matching order, and where custom rules belong in the configuration.
Read the Full ArticleClash First Connection Guide: Choose a Proxy, Test Latency, and Confirm It Works
After importing a subscription, select a node in the proxy group, identify timeout results, enable the correct system traffic interception method, and use the target address and logs to confirm that traffic has entered the core.
Read the Full Article