Clash for Android: How To Add Subscriptions and Switch Nodes

What a Clash for Android subscription actually provides

A Clash for Android subscription is more than a single server address. It is usually a provider-managed URL that returns a profile containing proxy nodes, proxy groups, routing rules, DNS settings, and sometimes update information. When you paste that URL into a compatible Clash client, the application downloads the profile and presents its contents through the Android interface. You normally do not need to copy individual VMess, VLESS, Shadowsocks, Trojan, or SOCKS5 links one by one. The subscription acts as a reusable source that can be refreshed when the provider changes servers or retires an endpoint.

This distinction matters because an imported profile and an active connection are separate things. Importing proves that the application can reach the subscription endpoint and parse the returned configuration. It does not prove that every node is usable, that the selected proxy group has a working member, or that Android applications are actually sending traffic through the Clash local service. A profile can appear correctly in the list while its nodes are expired, its provider quota is exhausted, or its rules send the application directly to the network.

Before starting, obtain the subscription URL from a provider or administrator you trust. Treat the URL like a password: anyone who possesses it may be able to retrieve your node list or consume your account quota. Do not post it in a public issue, screenshot it with the token visible, or paste it into an unverified online converter. If the provider offers separate URLs for different clients, use the one intended for Clash, Mihomo, or a compatible YAML-based client rather than a generic link designed for another application.

Also check the basic Android environment before importing anything. Update the client from a trustworthy source, allow the application to create its VPN service when Android asks, and temporarily close other VPN applications during the first test. Android normally permits only one active VPN service at a time. A corporate VPN, ad-blocking VPN, security suite, or another Clash-based client can therefore make a perfectly valid subscription look unavailable. Reliable Wi-Fi or mobile data is preferable during the first import because a captive portal, unstable signal, or restrictive DNS service can interrupt the profile request.

How to import a Clash subscription on Android

Open Clash for Android and locate the section named Profiles, Configurations, or a similar profile-management entry. Different forks and Mihomo-based Android clients use slightly different labels, but the workflow is consistent: add a remote profile, enter the subscription URL, assign a recognizable name, and download the configuration. If your application opens on a dashboard, look for a plus button, an import icon, or an action menu rather than assuming the empty dashboard itself is the profile editor.

1. Choose remote import. Select an option such as Import from URL, New Profile, or Download configuration. Avoid choosing local file import unless you already have a YAML file stored on the device.
2. Paste the subscription URL. Paste the complete HTTPS address without adding spaces, quotation marks, or punctuation. If the provider supplied a conversion URL with parameters, preserve the entire query string because those parameters may determine the output format.
3. Name the profile clearly. Use a short name such as “Personal mobile” or “Work test” rather than leaving several entries called “config.” A useful name makes later updates and troubleshooting much easier.
4. Save and download. Tap the confirmation or download action and wait for the request to finish. Keep the app open during the first download so Android does not suspend it in the background.
5. Activate the profile. Select the newly downloaded entry and use the application’s activate, use, or checkmark control. A profile can be downloaded successfully without becoming the configuration used by the dashboard.

When the request succeeds, inspect the profile details before connecting. A healthy result normally shows a recent update time, a non-zero number of proxies, and groups containing selectable members. If the application reports that the content is not valid YAML, the provider may have returned an HTML error page, a login page, a quota warning, or a format intended for a different client. If the response is empty, check whether the URL was truncated when copied from a message. Some Android keyboards also replace ordinary characters with typographic punctuation, so compare the pasted URL with the original source.

A subscription that imports but contains no nodes requires a different diagnosis. First refresh it once and read the returned message. Then confirm that the account is active, the provider has not limited the number of devices, and the profile format is compatible with the client core. Do not repeatedly refresh every few seconds: some providers rate-limit subscription downloads, and rapid retries can turn a temporary network problem into a quota problem. If the provider supplies a user-agent or client-specific link, follow its instructions rather than randomly changing parameters.

Protect the imported profile on your phone

Android backups, notification previews, clipboard managers, and file-sharing tools can expose configuration data. After importing, clear the subscription URL from the clipboard if your keyboard keeps clipboard history, and avoid exporting the profile to an unencrypted public location. A downloaded YAML file may include server addresses, credentials, rule-provider URLs, and private metadata even when the application hides those details in its interface. If you sell or reset the device, remove the profile first and revoke the subscription from the provider when that option exists.

How to update the profile and verify changes

Node providers change infrastructure frequently. A profile that worked last week may contain retired servers, changed ports, or a new proxy group layout. Updating the profile downloads the provider’s current configuration; it is not the same as testing a node and it does not automatically guarantee that the active selection changes. Find the refresh icon or the profile menu, select the remote entry, and choose Update, Refresh, or Fetch. Wait until the client reports completion before leaving the page.

Record the update time and compare the node count before and after the refresh. A large change is not automatically bad: providers may reorganize groups or remove unhealthy servers. However, a sudden drop to zero nodes, a profile size of only a few bytes, or a new error message deserves attention. Open the update log if available. Messages such as HTTP 401 or 403 usually point to an expired token or authorization restriction, while timeout and TLS errors suggest a network path, DNS, certificate, or captive-portal issue.

After updating, reselect the profile if the client created a new revision instead of replacing the old one. Some interfaces retain an old active configuration while showing a newer downloaded file beside it. Confirm that the dashboard references the current profile and that the proxy groups have also changed. If you edited local YAML rules, check whether the refresh operation overwrote those edits. Remote subscriptions are provider-owned documents; local changes may disappear unless the client supports profile patches, overrides, or merges.

How to test servers and switch nodes

Once the current profile is active, open the Proxies or Proxy Groups screen. You may see a top-level group such as “Proxy,” “GLOBAL,” or “Main,” followed by child groups for regions, streaming services, or automatic selection. The top-level group is often a selector: it does not represent a physical server by itself, but chooses one of its members. Tap the group that receives ordinary traffic, then review the available nodes.

Node testing measures reachability from your phone to a chosen probe destination. Depending on the client, the action may be called latency test, URL test, health check, or delay test. A low number is useful, but it is not a complete quality score. The result may measure only the time needed to reach a lightweight HTTP endpoint; it does not reveal long-session stability, streaming performance, congestion at busy hours, or whether a destination-specific rule will use that group. Treat latency as a filter, not as an automatic winner.

1. Run a batch test. Use the group menu or test button to measure several nodes. If the client lets you choose a test URL, select a stable HTTPS endpoint that is permitted in your environment and avoid overly frequent testing.
2. Remove obvious failures. Ignore nodes marked timeout, connection refused, TLS failure, or unavailable. Do not keep a node merely because its displayed latency is low if the log shows repeated handshake failures.
3. Compare a small shortlist. Test two or three healthy nodes across different regions or provider labels. Check both delay and consistency instead of selecting a single unusually fast result.
4. Select the node in the correct group. Tap the member name inside the group used by your traffic rules. Selecting a node in an unused group will not affect ordinary Android applications.
5. Confirm the active indicator. Return to the dashboard and verify that the selected group displays the chosen member. Then test a permitted application and watch the request or connection log.

Automatic groups require special care. A url-test group may periodically choose the member with the best recent probe result, while a fallback group usually follows an ordered list and moves only when the current member fails. A manual selector gives you the most predictable behavior because your choice remains in place until you change it. If you need stable logins, consistent regional behavior, or a recognizable exit location, manual selection is often easier to reason about. If you need resilience on a changing mobile network, automatic selection may be more convenient, provided you understand when it can switch.

Test the chosen node with more than one application. A browser page may succeed while a video player, game, messaging client, or background synchronization service behaves differently because Android applications use different protocols and destination domains. Read the Clash logs while opening the test application. Look for the actual rule, the selected policy group, and the final node. This confirms whether the problem is a dead server, a wrong group, a direct connection, a DNS failure, or an application that does not honor the proxy path.

Choose the right proxy mode for Android apps

Clash for Android commonly offers a system proxy mode and a TUN or VPN mode, although names vary by client and core. System proxy is lightweight and works well for applications that honor Android’s proxy settings. It is a sensible first test because it usually requires fewer permissions and makes the traffic path easier to understand. Some games, banking applications, embedded SDKs, and applications with custom network stacks may ignore system proxy settings entirely.

TUN or VPN mode creates an Android VPN service and captures a broader range of application traffic before forwarding it through the Clash core. It can cover apps that bypass ordinary system proxy settings, but it requires VPN permission and may conflict with another VPN service. It can also change DNS behavior, battery use, local-network access, and how applications detect connectivity. Enable it only after the profile and selected node work in a simpler mode, then test local printers, casting devices, corporate resources, and banking applications separately.

• Use system proxy first when you are validating a new subscription or need low overhead.
• Use TUN or VPN mode when specific applications ignore the system proxy and the client supports the required Android version.
• Use rule mode when local services and ordinary domestic traffic should remain direct while selected destinations use a proxy group.
• Use global mode cautiously because it sends a much wider range of traffic through the selected group and can expose compatibility or policy issues.

A mode switch does not replace node selection. You still need an active profile, a usable policy group, and a healthy member. After changing modes, disconnect and reconnect the Clash VPN service if the dashboard does not update, then reopen the test application. Android may display a VPN key icon even when the selected node cannot reach its destination, so the icon confirms that the local VPN service exists, not that the remote path is healthy.

Frequently asked questions

Why does my subscription URL fail to import?

Check the complete URL, account status, network access, and profile format. Open a normal webpage first to rule out a captive portal, then retry once in Clash. If the client reports invalid YAML or unexpected HTML, the provider may be returning an error page rather than a configuration. A URL made for another client may also require conversion or a different subscription format. Do not paste the token into an untrusted converter; ask the provider for a compatible Clash or Mihomo link.

The profile is active, but Android has no internet. What should I check?

Confirm that the top-level proxy group has a selected, healthy member and that the dashboard shows the expected active profile. Review logs while opening a permitted website, then check whether the request is going DIRECT, matching a blocked rule, or failing during DNS resolution. Disable other VPN applications, test a different node, and compare system proxy mode with TUN mode. If only one application fails, that application may use its own DNS or networking stack rather than indicating a complete Clash failure.

Why does the selected node change back after an update?

The provider may define an automatic group, regenerate group members, or replace the profile during refresh. Select a manual selector if you require a stable choice, and confirm that you are changing the group used by the relevant rules. Some clients also restore the last profile revision after a restart, so verify both the active profile and the selected member after updating.

Why can I not start TUN or VPN mode?

Android generally allows one VPN service at a time. Stop another VPN, ad-blocker, security tunnel, or second Clash client, then try again. If the permission dialog was previously denied, open Android settings and review the application’s VPN or network permissions. Battery optimization can also stop a long-running service, so exempt the client only when that is acceptable for your device and security policy.

Compared with one-click VPN apps that hide node groups, refresh behavior, and routing decisions, Clash for Android gives you clearer control but expects you to understand which profile, group, mode, and rule are active; older proxy clients may also offer fewer diagnostics or handle subscription updates inconsistently. Clash V.CORE provides a maintained, transparent workflow for importing profiles, switching nodes, reviewing logs, and matching proxy behavior to Android applications, making it a practical next step when you want repeatable configuration rather than guesswork. If you are ready to test that workflow, download Clash V.CORE and begin with a small, verifiable profile setup.