Three Things to Confirm Before Downloading
The mainstream Windows Clash clients today are GUI apps built on the Clash Meta (mihomo) core, with popular options including Clash Verge Rev, Clash Plus, and FlClash. They offer similar functionality, differing mainly in interface style and update frequency—any of them will work fine with the steps in this guide. Before downloading, it's worth confirming the following three points to save troubleshooting time later.
Check your Windows version and architecture
Windows 10 1809 and later, as well as Windows 11, all support installation—download the x64 installer for 64-bit systems. A few clients also offer an ARM64 build for Windows on ARM devices, so make sure not to mix them up.
Confirm the download comes from an official release page
Get the installer only from the client project's official release page or the download page compiled on this site. Avoid downloading through search engine ads or file-sharing links from unknown sources, since these channels are prone to being swapped with tampered installers.
Have your subscription link ready in advance
Right after installation, the first step is importing a subscription. Copying the subscription URL provided by your proxy service or self-hosted node in advance lets the whole setup flow smoothly, without switching away midway to hunt for the link.
Installation Steps: From Double-Clicking the Installer to First Launch
Installer formats vary slightly between clients—common options are an .exe setup wizard or a portable .zip build that needs no installation—but the overall process is basically the same.
Run the installer
Double-click the downloaded
.exefile, choose an install directory in the wizard, and complete the setup. For the.zipportable version, extract it to a directory without special characters and run the main executable directly—no additional installation steps are needed.Handle the system prompt on first launch
On first launch, Windows Defender SmartScreen may pop up a "Windows protected your PC" warning. This is common for newly released apps or ones with a low download count, and doesn't mean there's a problem with the installer itself—see the troubleshooting section below for how to handle it.
Install the driver components needed for TUN mode
If you plan to use TUN mode (which takes over all system traffic rather than just acting as a system proxy), some clients will prompt you in the settings to install a network adapter driver or run with administrator privileges. Just confirm as prompted—enabling TUN mode for the first time usually requires restarting the client once.
Confirm the core has started along with the app
The client's GUI is really just a shell—actual traffic forwarding is handled by the bundled Clash Meta (mihomo) core process. After a normal installation, the core starts automatically along with the main program, and the interface usually shows the core's running status or version number. Keep an eye on this status as the first sign of whether installation succeeded.
Importing a Subscription and Checking the Node List
Once installation succeeds, the next step is to import the subscription link into the client so it can fetch node information and generate a usable proxy list.
Paste the subscription URL
In the client's subscription or profile management page, find an entry like "New Profile" or "Import Subscription", paste the subscription link your provider gave you, and click Download or Update. The program will fetch the remote config file and parse out the nodes and rules.
Set the auto-update interval
Most clients let you set an auto-update interval for each subscription (for example, every 24 hours) to prevent outdated node information from causing connection failures. It's best to enable this rather than updating manually every time.
Switch to the newly imported profile
After importing, you need to manually click "Apply" or "Switch to this profile". Quite a few people get stuck at this step—the subscription downloaded successfully, yet the client is still using an old or default empty profile, which shows up as an empty node list.
If you want to manually verify that the node section was written correctly, open the config file and confirm a structure like the following exists:
proxies:
- name: "hk-01"
type: ss
server: example-hk.example.com
port: 8443
cipher: aes-256-gcm
password: "your-password"
proxy-groups:
- name: PROXY
type: select
proxies:
- hk-01What a subscription link delivers is usually a full config file made up of three parts: proxies (nodes), proxy-groups (proxy groups), and rules (traffic rules). When checking manually, focus on whether these three sections contain content, rather than verifying every parameter of every node one by one.
Enabling the System Proxy and Verifying Connectivity
After importing nodes, you still need to make Windows actually route its network traffic through Clash. Many people overlook this step, and the symptom is that node latency tests look fine in the client, but browser traffic is still going through the original network.
Turn on the system proxy switch
The client's main screen usually has a "System Proxy" or "Set as System Proxy" toggle. Turning it on makes the client automatically write Windows's proxy settings, pointing HTTP/HTTPS traffic to the local mixed listening port (7890 by default).
Or use TUN mode to take over all traffic
If some applications don't respect the system proxy settings (common with game clients and certain messaging apps), you can switch to TUN mode instead. It takes over all traffic at the network layer, independent of whether an app reads the system proxy configuration, but it requires running the client with administrator privileges.
Check node latency
Run a latency test on the nodes under the current proxy group in the node list. A healthy node's latency shows up in milliseconds; if a node stays timed out or unavailable for a long time, try switching to a different node first to rule out a single-node issue before looking into configuration problems.
Verify actual connectivity
Open a browser and visit a target site, or run
curlfrom the command line to test the exit node currently in use:
curl -x http://127.0.0.1:7890 -I https://www.google.comIf you get back an HTTP status code instead of a timeout or connection refused, the system proxy is working and traffic is indeed being routed through Clash.
Troubleshooting Common Installation Issues
Below are the most commonly reported issues during installation and initial setup, ordered by how often they occur.
SmartScreen Blocking the Installer
Windows Defender SmartScreen pops up a warning for apps with low download counts or without enterprise code signing. This is a statistical judgment based on download volume and signing reputation, not the same as a virus scan result. To proceed, click "More info" in the prompt window, then click "Run anyway". If the installer came from the official release page or this site's download page, you can safely continue; if the source is unclear, verify it before deciding whether to run it.
Launch on Startup Not Working After Enabling It
Some users enable the "Launch on startup" option in the client settings, only to find the client hasn't started after a reboot. Common causes include: the app being manually disabled in Windows's own "Startup Apps" management, an install path containing special characters that breaks the startup entry's path, or some security software flagging the auto-start entry as suspicious behavior. Try toggling the startup option off and on again in the settings, and also check the system's "Startup Apps" page to confirm the status shows as "Enabled".
Browser Still Can't Connect After Enabling the System Proxy
First check whether the browser is using its own separate proxy settings (some browser extensions or enterprise policies override the system proxy). Next, confirm the client's mixed listening port hasn't been taken by another program, forcing it to auto-switch to a non-default port—check the client's settings to make sure the port number actually in use matches what was written into the system proxy.
The Core Won't Start After Installation
If the client interface reports the core isn't running, or the app keeps crashing, common causes are insufficient permissions on the install directory (for example, installing into a protected system folder) or security software mistakenly deleting the core executable. It's best to install the client under a regular user directory and add the client's install directory to your security software's trusted list.
If you notice abnormal access to certain intranet apps or LAN devices after enabling TUN mode, first check the client's "LAN direct connection" or bypass rule settings, rather than immediately turning off TUN mode entirely to start troubleshooting from scratch.