Know the difference between GUI clients, cores, and subscriptions
Choosing a Clash client is about more than screenshots. The GUI handles subscription imports, proxy group selection, system proxy settings, and logs. The core parses configuration, matches rules, resolves DNS, and establishes outbound connections. Similar-looking apps can use cores from different generations, while different clients may use the same type of core.
Clash Meta continued development under the name mihomo. When a guide mentions the “Meta core,” check which mihomo version it actually uses rather than looking for “Meta” in the interface. The original Clash, Clash Premium, and mihomo don't support exactly the same features. Older cores may not recognize newer protocols or configuration fields.
- Client version: Determines the menus, subscription management, background services, and system integration.
- Core version: Determines protocol support, rule capabilities, and some DNS and TUN behavior.
- Subscription contents: May provide nodes alone, or include proxy groups, rules, and DNS settings. Not every subscription is a complete configuration.
Compare popular clients: narrow down by platform first
This is a guide to choosing a client, not a speed ranking. The platforms available in our download section may not cover every platform supported by each project. Before installing, check the CPU architecture, minimum OS version, and download source. Don't assume similarly named forks are the same project, or use one fork's documentation to interpret another's menus.
| Client | Platforms covered on this site | What to consider | Best for |
|---|---|---|---|
| Clash Verge Rev | Windows、macOS、Linux | Manage configuration, connections, and desktop proxy settings with mihomo; check service status before enabling TUN. | Users who need full desktop configuration management and regularly inspect rules and connections. |
| Clash Nyanpasu | Windows | Focuses on configuration management and GUI workflows; available cores and switching options depend on the installed version. | Users who want to compare desktop workflows and are comfortable checking how configurations are merged. |
| FlClashs | Windows、macOS、Linux、Android | Similar workflows across devices; check this fork's release notes and core details separately. | Users who switch between a computer and Android and want a consistent workflow. |
| ClashX Meta | macOS | Menu bar controls and familiar macOS workflows; don't assume the name means it has a full TUN management interface. | Mac users who primarily use the system proxy and prefer switching from the menu bar. |
| Clash Plus | Windows、macOS、Android、iOS | Check import formats, traffic routing, and core details for each platform separately; don't assume features are identical. | Users who want to start by choosing a client for their device platform. |
| Clash for Windows、Clash for Android | Available for Windows and Android | The original project is no longer maintained. Old guides and configurations are still common, but it's not a good default choice for a new setup. | Users who need to identify legacy setups or migrate existing configurations. |
To browse available installers by platform, start with the Download Center. For a broader comparison of system proxy, TUN, and maintenance status, see our client comparisons. Avoid installing multiple clients that try to manage network traffic at the same time.
Check core compatibility before comparing appearances
Check the subscription format, then protocol support
A subscription containing only a list of node addresses isn't necessarily a complete Clash YAML with proxies, proxy-groups, and rules. If an import fails, first determine whether the download failed, the format is invalid, or the core doesn't support it. An unrecognized proxy type in the logs is a different issue from a subscription URL returning a login page.
For example, if a subscription uses Hysteria2 or TUIC nodes, check whether your core version supports the protocol and its parameters. Seeing a node name in the client only means one step read the entry; it doesn't prove the core loaded it successfully. Check the startup logs, then try connecting.
Inspect the active configuration to troubleshoot faster
- Make sure you can view the specific load error, not just an “Import failed” popup.
- Confirm which subscription is active so you don't edit a configuration that isn't in use.
- For custom rules, check whether the client supports overrides, merging, or scripts, and learn the order in which they're applied.
- After a subscription update, check that your local changes are still there. Direct edits to a cached remote subscription are often overwritten on the next update.
A more feature-rich core doesn't mean you need a more complicated configuration. For common nodes and domain-based routing, a readable, recoverable configuration is usually easier to maintain than a stack of obscure overrides.
System proxy or TUN: choose based on the apps you use, not the number of toggles
A system proxy tells apps that honor system settings where to find a local HTTP or SOCKS proxy. Browsers often use it, but some games, command-line tools, and background processes won't. TUN routes traffic through a virtual network interface, covering more apps but also introducing permissions, routing, DNS, and VPN conflict concerns.
| Use case | Try this first | What to check |
|---|---|---|
| Mostly browsing the web | System proxy | System proxy address and port, plus any proxy extensions in your browser. |
| The app lets you enter a proxy manually | HTTP or SOCKS settings in the app | Confirm the proxy type is correct and the app supports the traffic you need to route. |
| The app ignores the system proxy | Try TUN if needed | Service permissions, virtual interface, routes, and DNS. The protocol and node must also support the traffic in question. |
| Running a company VPN at the same time | Keep traffic routing to one tool at a time, then test each setup separately | Company network policies, route priority, internal domains, and DNS conflicts. |
If your configuration uses mixed-port: 7890, enter 127.0.0.1 as the address and 7890 as the port for an app's manual proxy settings. This is an example, not a default shared by every client. In Windows 11, check the system proxy under Settings → Network & internet → Proxy. On macOS, go to System Settings → Network → select your current network service → Details → Proxies.
Subscription management and usability: focus on everyday tasks
Judge a client by five everyday tasks: importing a subscription, finding its update time, selecting a proxy group, identifying the rule that matched a connection, and reading an error log. Comparing themes and animations tells you little about the effort required to maintain it.
- Import: Check that your subscription format is supported. If the provider requires request headers or a specific client identifier, follow their instructions.
- Updates: See whether the old configuration is kept when an update fails, and whether manual and scheduled updates are easy to tell apart. Don't repeatedly refresh just to get a success message.
- Selection: Check that proxy group names and the active node are clear. Switching the outbound mode isn't the same as switching nodes.
- Troubleshooting: The connection list should show the destination, matched rule, and outbound chain. Logs should be easy to copy so you can investigate errors.
- Migration: Make sure you can export or back up local configuration. Treat access tokens, controller secrets, and subscription URLs as sensitive information.
If you manage several configurations on desktop, compare the workflows in Clash Verge Rev and Clash Nyanpasu. For lightweight switching on a Mac, first check whether ClashX Meta meets your needs. If you often move between a computer and Android, consider how consistently clients such as FlClashs work across devices. A consistent workflow doesn't mean every platform has the same permissions.
Choose a client for your device and needs
Windows: get the system proxy working before deciding on TUN
For a new setup, compare the current releases of Clash Verge Rev, Clash Nyanpasu, FlClashs, and Clash Plus. Choose x64 or ARM64 based on your device's processor. If you keep multiple clients on one PC, quit the old one before launching another. If both listen on 7890, the second client may fail to bind the port, and the system proxy may keep getting changed back and forth.
macOS: check processor architecture and background permissions separately
Choose an ARM build for Apple silicon and an x64 build for an Intel Mac. For menu bar controls, start with ClashX Meta; for fuller configuration management and connection views, compare desktop clients such as Clash Verge Rev. Permission to launch the app, run background services, and use network extensions are separate approvals. Don't assume one confirmation enables every network feature.
Android and iOS: check OS networking restrictions first
On Android, compare options such as FlClashs and Clash Plus from our download section, then check background activity and battery restrictions. Android generally allows only one regular VPN service to run at a time. Switching to an accelerator or another VPN app may interrupt the current connection. You can carry over workflows from the older Clash for Android, but new subscriptions may not work with its older core.
For iOS, check how the client is installed, which subscription formats it supports, and what network extension permissions it needs. Being able to import a configuration doesn't guarantee support for every desktop-specific field. If you choose the Clash Plus iOS option, follow its platform-specific instructions rather than relying on desktop screenshots.
Linux: check package format and desktop environment together
Debian and Ubuntu-based systems generally use DEB packages; Fedora and other RPM-based systems use RPM. Check the architecture and system dependencies, too. Tray support in your desktop environment, the client's ability to change system proxy settings, and TUN service permissions all affect everyday use. On a headless server, managing the core and services directly is usually more practical than installing a full desktop environment just to switch nodes.
Verify your choice with the same tests after installation
A client can't increase a node's bandwidth on its own. With the same connection and core configuration, speed test results can still vary due to the test endpoint, caching, concurrent connections, rules, and DNS. Don't rank entire clients by a single latency result. Use the steps below to compare real-world usability instead.
- Back up your old configuration, quit other proxy tools, and run only one client.
- Import the same subscription, select the same node and rule mode, and leave TUN off to start.
- Check which port is actually listening. If it's
7890, use the command below to send a request explicitly through the local HTTP proxy. - On the connections page, check the request's destination, matched rule, and outbound policy to make sure it wasn't sent direct.
- Enable TUN only if needed. Test apps that didn't follow the system proxy before, and check that your local printer and intranet sites still work.
- Update the subscription once and restart the client once. Confirm that proxy group selections, overrides, and service status are as expected.
curl --proxy http://127.0.0.1:7890 --head --max-time 15 https://example.com/In Windows PowerShell, change the start of the command to curl.exe to avoid differences caused by an alias with the same name in older environments. 15 is the maximum time in seconds for the entire request, not a node latency threshold. Even after receiving an HTTP response, check the connection logs to confirm the outbound route. One successful request doesn't prove that UDP, every domain, or every app is working.
The selection process is straightforward: rule out versions that don't support your platform or architecture, check the core features your subscription needs, then compare configuration management, logs, and traffic routing. For long-term use, choose a client that updates subscriptions reliably, preserves local rules, and clearly shows where connections are going. For initial setup, continue with the Clash configuration guide. To check rule and DNS fields, see the protocol reference.