Clash for Android: How to Add Subscriptions and Switch Nodes

What to prepare before adding a Clash for Android subscription

Clash for Android is easiest to use when you separate three tasks that beginners often mix together: importing a provider subscription, selecting a profile, and enabling the Android proxy service. A subscription URL is normally an HTTPS address supplied by your proxy provider. It may return a YAML configuration, a Base64-encoded list, or a provider-specific response that the app converts into a usable profile. The URL is not the same thing as a single server address, and copying one node link into the wrong field will not create a complete profile.

Before opening the app, obtain the subscription URL from a trusted account dashboard and keep it private. Treat the URL like a password because many providers embed an account token in the address. Anyone who obtains it may be able to refresh your profile, consume traffic, or view the node information associated with your account. Avoid posting the full URL in screenshots, public issue trackers, or group chats. If you believe the link has leaked, revoke or regenerate it from the provider portal instead of merely deleting the profile from your phone.

Also check the Android version, available storage, and battery restrictions on your device. A profile with hundreds of nodes can take longer to parse and may create a crowded server selector, especially on an older phone. Android manufacturers frequently place background network services under aggressive power-saving rules. Those rules can stop the client from refreshing a profile or maintaining a connection after the screen has been off for several minutes. You do not need to disable every battery feature immediately, but you should know where the system hides background activity, auto-start, and unrestricted battery settings.

Finally, close competing VPN applications while testing. Android generally permits one active VPN service at a time, so a corporate VPN, DNS firewall, game accelerator, or another Clash-compatible client may prevent the service from starting. If the application reports that the VPN permission is unavailable, do not assume the subscription is invalid. First inspect Android’s VPN settings and disconnect other tunnel-based tools. Establishing a clean baseline makes later profile and node troubleshooting much faster.

How to add a subscription URL in Clash for Android

Launch Clash for Android and look for the profile or configuration area. Depending on the application build and language, it may be labeled Profiles, Configurations, or Subscriptions. The important distinction is between a local configuration file and a remote subscription. A local file is imported from device storage, while a remote subscription is saved as a URL that the application can update later. Choose the remote URL option when your provider expects regular profile refreshes.

1. Open the profile manager. Use the add button or the menu item for a new profile. Do not paste the subscription into the node selector, mixed-port field, or general settings page.
2. Select URL import. Choose the option that accepts an HTTPS subscription address. If the interface offers QR-code scanning, verify that the scanned address belongs to your provider before saving it.
3. Paste the complete URL. Make sure no spaces, quotation marks, or line breaks were added at the beginning or end. A truncated token can produce an HTTP 401 or 403 response even when the visible domain looks correct.
4. Give the profile a useful name. Use a short label such as “Personal”, “Travel”, or the provider name. Avoid storing access tokens in the name itself.
5. Save and download the profile. The app should contact the provider, retrieve the configuration, parse its YAML, and display the available proxy groups or nodes.

A successful download does not always mean the configuration is ready for traffic. The application may accept the file but mark it as invalid because a required field is missing, a rule provider cannot be reached, or the selected core does not support a particular configuration feature. Open the profile details and look for a validation message or parser log. Pay attention to whether the failure occurs during HTTP download or during YAML parsing. “Could not fetch profile” points toward the URL, DNS, authentication, or network path; “invalid configuration” points toward the returned content or core compatibility.

When the provider offers both a normal subscription and a Clash or Mihomo-compatible format, select the format explicitly intended for Clash. A generic “universal” link may return a plain list that lacks proxy groups, rules, or DNS settings. In that situation the profile can appear to download correctly while the interface contains no usable selector. Some provider dashboards also require you to choose a device type or subscription template before copying the URL. If the imported profile contains only a few unexpected entries, return to that dashboard and confirm the template rather than editing random YAML fields on the phone.

Update profiles without losing your working setup

Remote subscriptions change over time. Providers may add nodes, remove expired servers, update certificates, revise group names, or alter rule providers. Clash for Android normally lets you refresh a profile manually from its profile card or overflow menu. Use that action when a provider has announced a change, when a node disappears, or when the app reports that a rule provider is outdated. A refresh downloads the current remote response; it does not necessarily mean that the newly downloaded profile has become the active one.

Keep one known-good profile available while testing a new import. If the app supports duplication or renaming, preserve the old profile before making large changes. This is especially useful when a provider publishes an emergency update that contains a syntax mistake. A backup does not need to expose your token: export only when the application’s security model and your local policy allow it, and store the file in protected storage. If you cannot export safely, at least record the profile name, the selected group, and the settings that were working.

After refreshing, verify four separate results. First, confirm that the update timestamp changed. Second, check that the profile still parses without an error. Third, open the proxy group and confirm that expected node names are present. Fourth, inspect the rule and DNS sections if the provider’s template normally includes them. A new timestamp alone is weak evidence because an intermediary cache, an error page, or an unchanged provider response may still have been saved.

• HTTP 401 or 403: the token may be expired, revoked, malformed, or restricted by the provider.
• Timeout or connection reset: the phone cannot complete the request through its current network path.
• Parser or YAML error: the response was received but is not valid for the selected Clash core.
• Empty node list: the provider template may require a different format or the account may have no active subscription.
• Profile updates but traffic fails: the configuration is present, but the selected node, rule mode, DNS behavior, or Android VPN state needs inspection.

Avoid refreshing repeatedly as a first response to an error. Many providers impose request quotas, and repeated downloads can make a temporary outage look like account abuse. Capture the time, network type, HTTP status, and profile name, then test once on another permitted connection if appropriate. Good troubleshooting records distinguish an unavailable provider endpoint from a broken Android client.

How to test node speed and choose a server

A node selector is not a leaderboard of universal truth. The latency shown by a Clash client usually measures a specific request from your phone to a test URL through a particular proxy path. It may reflect handshake time, DNS behavior, server load, congestion, and the distance to the test endpoint. A node with a low displayed latency can still perform poorly for video or downloads, while a node with a higher number may provide steadier throughput and fewer resets.

Start with a small, understandable comparison. Select three to five nodes from the same geographic group or provider tier and run the built-in delay test if the application exposes one. Wait for each result instead of tapping every test action repeatedly. Record whether the result is a number, timeout, or error. A timeout is not simply “slow”; it may indicate that the node is unavailable, that the test URL is blocked on that path, or that the application cannot complete the probe.

Next, test the kind of traffic you actually use. For ordinary browsing, open several HTTPS sites and watch whether pages complete without repeated reloads. For video, observe startup time and buffering over several minutes rather than judging the first ten seconds. For messaging or work tools, check stability while the phone changes between Wi-Fi and mobile data. For large downloads, compare sustained speed and connection recovery, not only the initial peak. These practical tests are more meaningful than choosing the smallest latency number in isolation.

Remember that a node can be healthy while its upstream route to one service is poor. If only one website fails, inspect the selected rule and destination rather than immediately replacing the node. The active group may send that domain through a different policy than ordinary web traffic. Similarly, IPv6 availability, DNS mode, and captive portals can create symptoms that resemble a bad server. Test after signing into the network and after confirming that the phone’s date and time are correct.

Selector, fallback, and automatic testing groups

A selector group gives you direct control. You tap one member, and compatible traffic follows that choice until you change it. This is the best starting point for beginners because it makes cause and effect visible. If browsing changes immediately after selecting another node, you know which decision affected the session. The drawback is that a selector does not automatically move away from a failing node.

A fallback group usually checks members in an order and moves to another when the current choice fails its health test. It is useful when you prefer continuity over manual control, but a probe result cannot predict every application’s real experience. A server may answer the probe while streaming, DNS, or a long-lived connection remains unreliable.

A url-test group compares measured responses and chooses a candidate according to the configuration’s tolerance and interval. It can reduce manual switching, yet frequent changes may make your public exit appear inconsistent and can interrupt sessions. Learn the selector first, then try automated groups when you understand how the profile names them and how often they reevaluate nodes.

Switch nodes and select the right proxy mode

After choosing a profile, open its proxy group and tap the node you want to use. The interface should show a selected state, but do not assume that selection alone sends phone traffic through it. Clash for Android generally has a separate service or VPN switch. Start that service and approve Android’s VPN permission when prompted. Android displays a system confirmation because the application is creating a local VPN interface; this permission is not the same as granting the app access to your subscription account.

Proxy mode controls how the configuration’s rules are interpreted. In Rule mode, destinations are matched against the profile’s rules and sent to a proxy group, directly connected, or rejected according to those rules. Rule mode is usually the practical daily setting when the provider supplies a maintained ruleset. It allows local services and permitted domestic traffic to remain direct while selected destinations follow the chosen group, although the exact result depends entirely on the profile.

Global mode sends traffic through the global proxy choice whenever the application can intercept it. This is useful as a diagnostic because it removes much of the rule-selection uncertainty. If a site works in Global but not in Rule mode, inspect the rule match, group selection, DNS behavior, and fallback policy. Global mode is not automatically faster or safer, and it may route services that should remain local through a remote exit.

Direct mode bypasses the proxy for traffic covered by the direct path. Use it as a comparison test, not as proof that the provider or node is broken. If a page works in Direct but fails in Rule mode, the issue may be the selected proxy route. If it fails in both Direct and Global, look at the underlying network, DNS, captive portal, or destination service. Some builds also expose a system proxy switch separately from the VPN service. Confirm which layer is active before interpreting results.

For a clean test, use one profile, one selected node, one proxy mode, and one browser. Change only one variable at a time. Stop the service, change the mode or node, start it again if necessary, then repeat the same test. This slower method prevents a common mistake: changing the node, refreshing the profile, enabling TUN-like capture, and switching from Rule to Global all at once, then having no reliable explanation for the result.

Android permissions, battery settings, and common fixes

Android may ask for notification permission, VPN permission, storage access, or permission to run in the background. The exact prompts depend on the Android release and the client build. Grant only what the application genuinely requires, but do not ignore the system VPN confirmation if you want device traffic to pass through Clash. If the VPN icon disappears immediately after starting, inspect Android’s VPN settings for another active service and check whether the application was restricted by a work profile.

Battery optimization is a frequent cause of “it worked until the screen turned off.” Open the application’s battery page and, where your personal or organization policy allows, choose an unrestricted or optimized setting appropriate for a persistent network tool. Also review background data, auto-start, and manufacturer-specific memory cleanup. Do not blindly enable every permission on a managed phone; ask the administrator when policy controls those settings.

If browsing is slow after switching nodes, first confirm that the phone is not still connected to another VPN. Then test the same profile in Direct mode, check whether the selected group has actually changed, and inspect the log for repeated DNS or connection errors. A DNS failure may appear as a blank page even though the proxy tunnel itself is alive. Conversely, a page can resolve successfully while the TLS connection fails because the node or destination route is unhealthy.

If only one application ignores Clash, verify whether it uses its own VPN, private DNS behavior, a restricted work profile, or an application-level proxy. Some apps deliberately avoid system proxy settings, while a VPN-based capture mode may require additional permission or a compatible core. Do not keep changing subscription URLs for an application that is simply outside the interception path.

Practical rule: diagnose in layers—Android network first, Clash service second, profile parsing third, proxy group fourth, node health fifth, and destination-specific rules last. This order prevents a harmless node switch from hiding a permission or DNS problem.

FAQ: subscriptions, nodes, and everyday Clash use

Why does my subscription URL work in a browser but fail in Clash for Android?

A browser may display an error page or download text without validating it as a Clash configuration. The app must also authenticate, parse the returned format, and confirm that the profile is compatible with its core. Check the HTTP status, remove accidental spaces, confirm that the provider issued a Clash-compatible URL, and review the parser message. If the URL contains a token, regenerate it when you suspect it has expired or leaked.

Why did a node disappear after I refreshed the profile?

A refresh replaces the remote response with the provider’s current version. The node may have expired, been removed from your account, moved to another group, or been filtered by a subscription template. Compare the new profile timestamp and group list with the provider dashboard. Restoring an old local copy may bring the entry back temporarily, but it will not restore a server that the provider has intentionally withdrawn.

Should I always choose the node with the lowest latency?

No. Latency is only one measurement from one location to one test endpoint. Prefer a node that remains stable during the activities you actually perform, with acceptable startup time, throughput, and reconnect behavior. If two nodes are similar, choose the one with fewer errors and more predictable performance rather than chasing a tiny numerical difference.

Which proxy mode should a beginner use?

Start with Rule mode when the profile includes a trustworthy ruleset, because it gives the configuration a useful balance between direct and proxied traffic. Use Global mode temporarily to determine whether a problem comes from rule matching, and use Direct mode as a baseline for the underlying network. Once the results make sense, return to the mode that matches your privacy, performance, and policy requirements.

Some lightweight Android proxy apps make subscription handling look simpler but provide little visibility into profile parsing, group selection, or logs, while full VPN products may hide individual node behavior behind a single automatic switch. Clash for Android is more transparent: you can refresh a remote profile, test individual nodes, compare Rule and Global behavior, and identify whether Android permissions or a provider response caused the failure. If you want that control without assembling the client workflow from separate tools, download Clash V.CORE and use the same deliberate profile-and-node process described above.