Who this beginner guide is for

If you have never installed Clash before and phrases like “import subscription” sound intimidating, this page is written for you. We will move in order: download a trustworthy client, install it with the right architecture, paste the HTTPS link your provider gives you, pick a profile, flip on system proxy, and stay in Rule mode so domestic traffic does not unnecessarily detour through a remote machine. The whole path is designed to fit into roughly ten minutes once files finish downloading.

Clash is an open-source, rule-driven proxy stack. Instead of configuring every application separately, you load one profile that describes outbound groups and matching rules. Mihomo (often packaged as “Meta” in release notes) is the community-maintained engine most modern GUI clients ship with. You rarely interact with Mihomo directly—your graphical client downloads the subscription, renders latency charts, and surfaces switches for system proxy and optional TUN capture.

This guide explains mechanics only. Laws and acceptable-use policies differ by jurisdiction and provider. Keep credentials private, avoid reposting subscription URLs in public forums, and choose vendors who publish clear privacy commitments. If you are unsure whether proxy use is permitted on your network, resolve that question before proceeding.

Before you start: what to have on hand

Collect a few items so you are not jumping between tabs mid-install. First, a subscription URL from your provider—this is usually a long HTTPS string labeled “Clash” or “Universal.” Second, administrator or equivalent rights on Windows if you later enable TUN, and on macOS the willingness to approve Gatekeeper once. Third, note whether your PC is Apple Silicon or Intel, and whether your Android phone is typical ARM64. Mismatched APKs waste time with confusing install errors.

If you have never seen a Clash YAML file, that is fine. The GUI will hide almost everything at the beginning. What matters is the mental model: the subscription downloads a profile, proxies appear as selectable endpoints, and rules decide direct versus tunneled paths. Once those three pieces click, incremental features such as external controllers or custom merge files feel like optional depth rather than mandatory homework.

Step 1: Download the correct Clash client

Not every repository labeled “Clash” receives security fixes. Prefer maintained forks that publish checksums or signed binaries and respond to upstream CVEs quickly. The table below summarizes practical defaults when you just need something that works today.

Official release pages move quickly. For predictable mirrors, use our Clash downloads hub so your first fetch is not hostage to intermittent GitHub throttling.

Step 2: Install and launch without friction

Windows (Clash Verge Rev)

1. Run the downloaded installer and finish the wizard.
2. Allow firewall access on trusted networks when Windows prompts.
3. If SmartScreen complains, choose More info → Run anyway for newly published certificates.
4. Open the Start menu entry and leave the app idle on the dashboard while you gather your subscription.

macOS

1. Open the DMG and copy the app into Applications.
2. First launch: right-click → Open, confirm once to satisfy Gatekeeper.
3. Match the build to your chip: aarch64 versus x64.

Android (FlClash)

1. Install the arm64-v8a APK unless your vendor documents an exception.
2. Grant your browser or file manager permission to sideload if asked.
3. Launch FlClash; VPN permission appears later when you actually connect.

Step 3: Import your subscription and activate the profile

Subscriptions are not magic—they are HTTP endpoints that return YAML describing nodes and provider metadata. Your client downloads the file, parses it into outbound lists, and periodically refreshes if you enable timers. Treat the URL as a secret: rotating it revokes old links but leaked URLs still burn quota until you regenerate them.

Clash Verge Rev (Windows / macOS)

1. Open the Profiles tab (wording varies slightly by skin but the icon is usually document-shaped).
2. Tap +, choose remote import, and paste the full HTTPS subscription string with its query parameters intact.
3. Save the profile and let the download finish; watch for timestamp updates instead of guessing.
4. Click the profile to mark it active—a checkmark or highlight distinguishes it from archived configs.
5. Optional but recommended: enable automatic refresh (24–48 hours is typical) so maintenance nodes appear without manual clicks.

FlClash (Android)

1. On the home screen, tap +.
2. Select URL import, paste the same HTTPS string, and confirm.
3. Return to the dashboard, select the new profile, then proceed to connection.

Step 4: Understand Rule, Global, and Direct

Before touching toggles, internalize three modes:

• Rule (recommended): follow DOMAIN, GEOIP, and IP-CIDR rulesets bundled with your profile. Local services stay fast; foreign destinations ride the tunnel.
• Global: send all compatible traffic through the selected node. Useful for quick reachability tests, noisy for daily browsing because banking CDNs may detour unnecessarily.
• Direct: bypass the tunnel entirely—ideal when diagnosing misconfigured routes or proving Wi-Fi itself is healthy.

Most providers ship sensible GEOIP lists tuned for their audience. Resist switching to Global permanently unless you fully understand the performance trade-offs on your line.

Step 5: Enable system proxy and connect on Android

On desktop, Clash Verge Rev exposes a System Proxy switch. Turn it on after Rule mode is selected and a profile is active. Applications that respect OS proxy variables—Chrome, Edge, VS Code, many Electron apps—then inherit split routing automatically.

Android does not use the same “system proxy” metaphor. When you tap connect in FlClash, the OS prompts for VPN permission; approving it routes eligible traffic through Mihomo similar to a user-space TUN on desktop. Keep Rule mode active there as well unless you intentionally need everything on one node.

Step 6: Quick verification habits

Open the client’s latency or URL-test panel and sort nodes. Pick a server geographically close unless your provider instructs otherwise. Load a few sites that exercise different rule paths—domestic vs overseas—to confirm Rule mode behaves. If everything stalls, temporarily switch to Direct to prove baseline connectivity before blaming nodes.

Document what works: profile name, refresh interval, favorite outbound group. Future you will thank present you after an OS reinstall.

Mini glossary for first-time users

• Profile: the active configuration bundle, usually downloaded from a subscription.
• Proxy group: selectable strategy such as URL test, fallback, or manual pick.
• Outbound: a concrete server entry that your rules can target.
• Ruleset: downloadable fragments maintaining domain or IP lists you do not want to hand-edit.

Troubleshooting and common questions

No nodes appear after import

Open the subscription in a browser. If it never returns YAML or base64 text, the entitlement expired or the URL changed. If the browser works but the client fails, suspect TLS interception on public Wi-Fi or an overzealous antivirus HTTPS scanner.

Browsers fail even with system proxy on

Confirm a profile is active, mode is not Direct, and at least one outbound responds to latency tests. Some corporate VPNs stack poorly—disable overlapping VPNs while testing Clash alone.

Android connects but some apps bypass

Check per-app split settings inside FlClash if offered. Certain banking apps pin certificates and refuse tunnels; that is expected behavior.

Performance anxiety

Throughput depends on your ISP, peering, and the remote POP. Rotate nodes before assuming YAML mistakes. Persistent slowness across every region usually signals upstream saturation—escalate with the provider.

Why a maintained Clash build still matters for newcomers

Many newcomers bounce between abandoned forks that bundle years-old cores, cluttered settings screens that hide basic toggles, or repackaged binaries with opaque telemetry. Those clients can make a healthy subscription look broken—random disconnects, missing protocols, or silent failures after an OS update, even when the YAML itself is valid.

In contrast, an actively maintained Mihomo-based distribution pairs quick security fixes with UX that exposes subscription import, Rule mode, and system proxy without forcing you into config-file archaeology on day one. You still get room to grow—TUN, mixin layers, external controllers—once fundamentals feel boring rather than scary.

If you want curated installers for multiple CPU targets and mobile ABIs hosted on dependable mirrors—so download latency does not become the first bottleneck—open our platform downloads page and pick the bundle that matches your hardware.

Download Clash free for your platform →