Open-source project · client and core updated continuously
A Clash client download and reference site for Windows, macOS, Android, iOS, and Linux users, offering complete guides on rule-based routing, subscription import, and TUN mode — with sections covering everything from first-time setup to advanced configuration.
Each of five platforms has actively maintained client options — click a platform to jump straight to its section on the download page, where the recommended pick and alternatives are both explained.
The primary desktop platform — both Clash Plus and Clash Verge Rev ship installers, supporting either system proxy or TUN takeover.
Go to DownloadSeparate builds are provided for Intel and Apple Silicon chips, with both menu-bar residency and enhanced-mode takeover configurable.
Go to DownloadTraffic is taken over via VpnService with no root required; APKs are split by architecture such as arm64, so match it to your device.
Go to DownloadInstall Clash Plus through the App Store for native support of subscription import and rule-based routing, working the same on iPhone and iPad.
Go to DownloadA deb package and desktop client are both available; for servers and routers you can run the mihomo core directly — see the core section for details.
Go to DownloadSix core capabilities listed in detail, all based on publicly documented mihomo core features, with corresponding config fields and advanced handbook sections available on this site.
Match outbound policy by domain and IP
Clash's core working method is rule matching: every connection is checked in order against conditions like domain keywords, domain suffixes, IP ranges, and GEOIP attribution, and once matched it's handed off to the corresponding policy group — proxy, direct, or reject. This mechanism lets local sites connect directly, overseas services route through a proxy, and ad domains get blocked outright, all at the same time, with no manual switching. Rules support subscription-based rule sets (rule-provider), which keep maintenance far lighter than hand-writing every entry — see the rules chapter of the advanced handbook for the exact syntax.
mode: ruleOne config covers all mainstream proxy protocols
On top of the Shadowsocks, VMess, and Trojan support found in the original Clash, the mihomo core adds newer protocol implementations like VLESS, Hysteria2, TUIC, and WireGuard. Nodes using different protocols can live in the same YAML config and be mixed into the same policy group, with the client automatically picking by latency or rule — no need to install separate tools for different protocols. Full parameter details for each protocol field can be looked up by category on the concepts reference page.
Takes over all system traffic, leaving nothing behind
System proxy settings only affect applications that honor them — command-line tools, game clients, and some UDP traffic bypass them entirely. TUN mode creates a virtual network adapter to take over all outbound traffic at the network layer, and combined with fake-ip resolution, even apps that ignore proxy settings still get routed through the rules. Desktop clients usually just need one toggle plus a driver or permission grant to enable it; the mechanism differences and recommendations between the two modes are covered in a dedicated article in the blog and advanced handbook.
tun.enable: trueBoth nodes and rules can be updated remotely
Once a provider's subscription link is imported into the client, the node list automatically refreshes on a set interval, so switching providers doesn't require reconfiguring anything. Rules can be subscription-based too: common routing rules get split into remote rule sets that the client periodically refreshes, while the local config keeps only references plus a handful of custom entries. Merging multiple subscriptions and applying local overrides is covered in a dedicated chapter of the advanced handbook, useful for anyone running several subscriptions at once.
fake-ip and grouped resolution reduce leak risk
The most commonly overlooked part of proxy setups is DNS: if queries still go through a local ISP server, browsing intent gets exposed — this is what's known as DNS leaking. Clash's built-in DNS module supports fake-ip enhanced mode, encrypted upstreams via DoH/DoT, and domain-grouped resolution, so local domains resolve through local DNS for speed while everything else resolves remotely to avoid leaks. Recommended values and troubleshooting steps for these fields are collected in the DNS chapter of the advanced handbook.
enhanced-mode: fake-ipRESTful API for connecting web dashboards
The core exposes a RESTful control API, so node switching, latency testing, connection viewing, and log output can all be done through the API. Beyond the panel built into desktop clients, it can also connect to web dashboards like metacubexd, letting you manage a core instance running on a router or server right from a browser. This is also the standard way to manage headless deployments (secondary routers, NAS, VPS) — see the blog's router deployment overview for the approach.
Installation to verification usually takes under ten minutes — here's a condensed preview of the tutorial page; see the full tutorial for screenshots and step-by-step details.
Pick a client for your OS on the download page and install it: Windows and macOS just need the installer run, Android APKs must match your phone's architecture, and iOS gets Clash Plus straight from the App Store. Grant the necessary permissions when prompted on first launch.
Copy the subscription link your provider gave you, then paste it into the client's config or subscription page to import. Once imported, the node list fills in automatically and refreshes on schedule; if the link fails to load, first check that it's complete, then check whether you need a temporary direct connection to fetch it.
Set the running mode to rule, turn on the system proxy or TUN toggle, and pick a low-latency node from the proxy group. Then visit a local site and an overseas site to confirm both direct connection and proxy are working — that completes first-time setup.
Every client and core listed on this site is an open-source project — code, release history, and issue discussions can all be checked in the public repositories.
Clash has developed as an open-source project since 2018, establishing YAML-based config and rule-based routing as the de facto standard for this category of tool. After the original core was archived, the community didn't stall: the config format, rule syntax, and usage conventions were carried forward intact, and years of accumulated tutorials and discussion still apply.
The actively maintained core today is mihomo (often called Clash Meta in the community), which stays compatible with the original config format while extending protocol support, rule types, and DNS capabilities. Clients listed on this site's download page — Clash Plus, Clash Verge Rev, FlClash, and others — all run on the mihomo core.
From the core, to desktop and mobile clients, to web control panels, the entire toolchain's source code is hosted in public repositories released under licenses like GPL-3.0. Anyone can review the implementation, file issues, or build it themselves — the most direct source of trust for a networking tool like this.
The core and clients each release independently: the core ships tagged binary builds, while clients keep pace through built-in updaters or release pages. Version numbers and links on this site's download page are parsed dynamically from the release list, staying in sync with upstream releases so you never end up with an outdated installer.
git clone https://github.com/MetaCubeX/mihomo.git
Quick pointers here, with full explanations available in both the concepts reference and the advanced handbook.
Long-form pieces on core mechanics, platform deployment, and advanced configuration, updated continuously.
Compares mihomo (Clash Meta) against the now-archived original core on protocol support, rule types, DNS capabilities, and API, explaining why mainstream clients have all shifted to mihomo and how old config files hold up.
Explains what the mixed-port and allow-lan fields actually do, walks through letting phones, TV boxes, and consoles get online through one computer's Clash over the LAN, and flags firewall and authentication gotchas.
Introduces running the mihomo core directly under both primary-router and secondary-router topologies, covering firmware choice, transparent proxy chains, DNS hijacking, and boot-on-startup config, with a comparison against the desktop client approach.