Clash Subscription Import Guide: URL, Base64, and YAML Formats

First, distinguish the URL from its response

Before importing a Clash subscription, check two things: whether you have a download URL or a node itself, and whether the URL returns a full config or just a node list. This is often why a link opens in a browser but fails to import in a client.

A URL is an address; YAML and Base64 describe a content format or encoding. They are different concepts. A subscription URL beginning with https:// might return Clash YAML, a Base64-encoded node list, or an account sign-in page. The file extension, URL length, or whether it opens in a browser does not tell you whether it is compatible.

Full YAML configs vs. node lists

A full config is more than a list of nodes

A usable Clash config needs to do more than define connections: it determines how traffic reaches the core, which policy group rules use, and which outbound to use when no rule matches. Common fields include mixed-port, mode, proxy-groups, rules, and dns. Core support varies, so the presence of a field does not mean every client can parse it.

The YAML snippet below illustrates common fields; it is not a subscription with proxy nodes. 7890 is an example listening port, not evidence that your client uses that port. MATCH,DIRECT sends requests that reach this rule directly.

mixed-port: 7890
mode: rule
log-level: info
rules:
  - MATCH,DIRECT

When importing, preserve the original file's structure and space indentation. Do not treat rich text displayed on a webpage as a config file. YAML indentation must use spaces, not tabs. The line number in a parser error is a good place to start, but the actual problem may be on the line above—for example, a missing quote, a malformed colon separator, or a misaligned list item.

YAML can also be a provider file

Some URLs return only a top-level proxies: field and a list of nodes. This is typically meant for proxy-providers; it is not a full config with policy groups and routing rules. The main config must declare the provider and reference it from a policy group using use. Importing the file as a full config may parse successfully but leave you without the expected groups or routing behavior.

If your provider offers separate “Clash config” and “node provider” options, start with the former. Use the latter only if you plan to maintain the main config yourself. For field definitions, see the config field reference; do not infer a file's purpose from its extension alone.

How to import a subscription URL on each platform

The steps below cover common client interfaces. Menu labels may vary between versions. If the wording differs, look for a “Subscriptions,” “Config,” or Profiles page—not the node search field in the connection list. Before your first import, keep a copy of your working config rather than deleting it to test a new one.

Windows and macOS: Clash Verge Rev

1. On your service provider's subscription page, choose Clash or a format explicitly marked as compatible with mihomo. Copy the full HTTPS subscription URL, not the webpage address from your account portal.
2. Open the “Subscriptions” page in Clash Verge Rev, paste the URL into the subscription field, and click “Import.” If the interface offers a “New” option, choose the remote type and enter a name and URL.
3. Wait for the remote config to finish downloading, then select it. Adding an entry to the list does not necessarily make it the active config.
4. Open the “Proxies” page and check that the expected policy groups appear, then choose an outbound within a group. For rule-based routing, set the operating mode to “Rule.”
5. Enable the system proxy or TUN as needed, then check the connection log. For the first test, avoid changing DNS, rules, and TUN settings at the same time; otherwise, it is hard to tell what made a difference.

On Linux, subscription import works the same way in the same client. The main differences are permissions for the system proxy and TUN, and how the service is installed. A successful subscription download and routing system traffic through the proxy are separate outcomes.

Android: importing a config vs. starting the VPN

In older versions of Clash for Android, the usual path is “Config” → “+” → “Import from URL.” Enter a name and URL, then save. Back in the config list, select the imported config and return to the main screen to start it. When Android first asks for VPN permission, grant it to route the relevant traffic. This project is no longer maintained, so check compatibility with newer protocols and config fields before using them.

In actively maintained clients such as FlClash, look for an add or URL import option on the “Config” page. The steps are similar: add the URL, download the config, select it, and start it. The Android VPN icon does not confirm that a subscription loaded correctly; it only indicates that the VPN service is running.

iOS: check which formats the client accepts

iOS clients do not share a standard Clash import menu. Check the client's documentation first to see whether it accepts full Clash YAML, a node subscription, or only single-node URIs. Then use the appropriate “Add subscription” or “Import config” option. Support for the same proxy protocol does not mean two apps support the same config file.

If the subscription page has an “Open in client” button, check the imported name and destination URL after the app opens. An app appearing in the system share sheet does not mean it can parse the content. If you need another client, check its platform and core type on the client downloads page.

Working with Base64 and single-node links

Decoding Base64 does not create routing rules

Base64 is an encoding, not encryption. An encoded node list may look like a long string, but decoding it usually yields multiple lines of node URIs—not proxy-groups, rules, or DNS settings. Some lists omit trailing padding or use a URL-safe variant, so a basic online decoder may report an error.

The easiest option is to return to your provider's page and choose the subscription format for Clash or mihomo. Convert the content only if no native format is available. Do not guess by appending format=clash to the URL; format parameters are server-specific, and there is no universal syntax that works across all subscription services.

A successful single-node import does not mean it will stay up to date

Links such as ss://, vmess://, and trojan:// typically include the server, port, authentication, and transport parameters. The client must support both the protocol and the URI's parameter format. Some newer protocols require a core such as mihomo; changing the protocol name will not make them work with an older Clash core.

Manually imported nodes are generally snapshots. If the server later changes its port, credentials, or transport parameters, the node will not update just because it once came from a subscription page. To keep nodes up to date automatically, save the remote subscription and use the client's update mechanism.

Fields to check before and after conversion

• Protocol and authentication: Make sure the node type, server port, password, or UUID has not been lost. A matching node name alone does not prove the conversion worked.
• TLS settings: Check SNI, ALPN, and certificate verification. Do not disable certificate verification just to make a converted config connect.
• Transport settings: The WebSocket path and headers, as well as the gRPC service name, can affect the handshake. Missing any of these can prevent a connection.
• Config structure: Policy groups and rules generated by a converter must reference each other correctly. If a rule points to a group that does not exist, the entire config may fail to load even if the nodes are valid.

Troubleshoot import failures by the response

First distinguish a failed request from a successful request that returned the wrong content. For request failures, check the network, URL, and certificate. For content or parsing errors, check the format and core compatibility. Do not keep adjusting YAML indentation when the download failed, or switch nodes when parsing failed.

A URL working in your browser does not mean the client can download it

Your browser may have a login cookie that the subscription downloader does not. The server may also return different content based on the User-Agent. Check the response the client actually received. If the log reports an expired certificate or certificate chain error, check the device time, system certificates, and server certificate status first. Skipping certificate verification is not a routine fix.

For timeouts, check whether the subscription domain resolves and whether the client uses a direct connection or an existing proxy to update subscriptions. If you need a proxy to download the subscription, use the client's proxy download option while keeping your working config. Without a working config, do not select an outbound that depends on a new subscription being downloaded first; that creates a dependency loop.

Four checks to make after importing

1. Check the active config. Verify the selected entry, last update time, and load log to avoid downloading a new subscription while still running the old config. If an update fails, keep the old copy and replace it only after confirming the new config works.
2. Check policy group references. On the “Proxies” page, confirm the expected nodes appear in each group. In rule mode, check which rule and outbound a connection uses. Passing a test in global mode does not prove that routing rules are correct.
3. Check how traffic enters the proxy. The system proxy mainly affects apps that follow system proxy settings; other programs may ignore it. TUN coverage also depends on routing and exclusions. A subscription does not automatically route traffic from every app through the proxy.
4. Check update settings. The client usually manages refreshes for a full remote config. The interval for proxy-providers is measured in seconds; for example, 3600 means one hour. These are separate settings, and the refresh interval should follow your provider's requirements.

Keep this order in mind: check the response format, import and activate the config, verify the policy groups, then check the system proxy or TUN. Separating these steps makes it easier to tell whether a problem lies with the URL, config, or traffic routing—instead of starting with a client reinstall every time.