Install Clash on Windows: Complete Setup Guide, Downloads to System Proxy

Choose the client, architecture and core before installing

On Windows, “Clash” usually refers to both the graphical client and the proxy core. The graphical client handles configuration management, the tray menu, system proxy controls and logs; the Clash core actually parses rules and establishes connections. Windows clients still receiving updates in 2026 generally use the mihomo core. The last commonly used Clash for Windows release, 0.20.39, is no longer maintained and is not suitable for configurations that depend on newer mihomo fields.

Choose a maintained mihomo client

Common options include desktop clients based on mihomo, such as Clash Verge Rev. Before downloading, open Windows “Settings” → “System” → “About” → “System type” and choose the matching installer. Most Intel and AMD PCs use x64; devices with ARM processors such as the Snapdragon X series use arm64. The architecture in the filename must match—do not choose solely based on whether you use Windows 10 or Windows 11.

What to do when security software blocks the download

Proxy clients listen on local ports, modify the system proxy and may install a TUN service, all of which can trigger heuristic detections. If a download is blocked, do not keep switching to installers from unknown sources. First verify the filename, version and publisher, then open “Windows Security” → “Virus & threat protection” → “Protection history” to review the detected item and the action taken.

If the installer disappears immediately after launch, also check the Windows SmartScreen prompt. Select “More info” to view publisher and file details. On a company-managed PC, an administrator may need to approve the software execution policy. After installation, the program folder and configuration folder are usually separate; uninstalling the client may not remove user configuration.

Finish installation and diagnose first-launch issues

Standard installation steps

1. Quit any older Clash client that is running so it does not continue occupying ports such as 7890, 7891 or 9090.
2. Run the installer that matches your processor architecture and follow the setup wizard.
3. Launch the client from the Start menu and confirm that its icon appears in the system tray.
4. Open “Settings” → “System settings” and confirm that the application data folder opens normally.
5. Open “Settings” → “Clash settings”, or the equivalent core page, and check the core status and version.

Menu labels vary by client version. Clash Verge Rev commonly places desktop behavior under “Settings” → “System settings”, and ports, the core and run modes under “Settings” → “Clash settings”. Clash for Windows 0.20.39 mainly shows ports, the system proxy and startup controls on the General page.

No window after double-clicking does not necessarily mean the app failed to start

Windows clients usually continue running in the tray after the main window is closed. Start troubleshooting by clicking the hidden-icons arrow on the right side of the taskbar instead of repeatedly launching more processes. You can also open “Task Manager” → “Details” and search for the client process and mihomo.exe. If the graphical interface remains open while the core repeatedly exits, check the in-app “Logs” page.

The first error in the log is usually more useful than the cascade of errors that follows. Configuration syntax problems often appear as parse config error; port conflicts commonly show bind: Only one usage of each socket address; and service permission issues may include Access is denied. Note when the error occurred and compare it with application logs in Windows Event Viewer to distinguish a GUI crash from a core startup failure.

Import a subscription and verify that the configuration is actually running

Import via a subscription URL

Copy the subscription URL, open the client’s “Subscriptions” or “Profiles” page, choose “New” → “Import from URL”, paste the URL and give it a recognizable name, such as “Provider A — Main profile”. Subscription URLs usually contain access credentials, so do not paste them into public converter sites, screenshots or support tickets.

A successful import only means that the client downloaded the content; it does not mean the configuration is active. Select the profile in the configuration list, wait for the core to reload, then open “Proxies” and confirm that at least one proxy group and selectable node are present. If the page shows only empty groups, check whether the subscription response was replaced by a login page, error message or HTML.

Minimum checks for a local YAML configuration

When importing YAML manually, use spaces for indentation. The following basic fields explain ports and the control interface; they are not a complete node configuration:

mixed-port: 7890
allow-lan: false
mode: rule
log-level: info
external-controller: 127.0.0.1:9090

dns:
  enable: true
  listen: 127.0.0.1:1053
  enhanced-mode: fake-ip

mixed-port: 7890 means HTTP and SOCKS requests can enter through the same local port; allow-lan: false means connections from other devices on the LAN are rejected by default; external-controller is the control interface, not the proxy port to enter in a browser. If you mistakenly use 9090 as the proxy port, connections may be refused or return a control-interface response.

Test a node before enabling the system proxy

On the “Proxies” page, select a node and run a latency test. The result represents one HTTP round trip to the test URL and does not by itself prove that the node has stable bandwidth. A more reliable first check is to confirm that the proxy group has selected a node, review the logs for an outbound connection, and then use a browser to open ordinary HTTP and HTTPS pages.

You can also explicitly test the local proxy in PowerShell to bypass the system proxy settings:

curl.exe -x http://127.0.0.1:7890 https://www.gstatic.com/generate_204 -I

Under normal conditions, an HTTP status line should return within a few seconds. If the command succeeds but the browser fails, the issue is usually with the Windows system proxy or a browser extension. If the command also fails, continue checking the node, rules, DNS and local listening port.

Enable the system proxy and resolve port conflicts

Which applications are affected by the system proxy

After you enable “System proxy” in the client, Windows proxy settings usually point to 127.0.0.1:7890. Open “Settings” → “Network & internet” → “Proxy” to check the current state. Apps such as Chrome and Edge that follow the system proxy connect through Clash, but some games, command-line tools, background services and software with its own networking stack may ignore it.

If websites still connect directly after the system proxy is enabled, fully quit the browser and restart it. If a proxy extension is installed, disable it temporarily so PAC settings, a fixed proxy and Windows settings do not override one another. Command-line tools have their own rules: Git may read http.proxy, while some system components use WinHTTP settings. Do not assume every application follows the desktop proxy automatically.

Check whether port 7890 is already in use

Running multiple proxy clients at once is a common cause of port conflicts. In PowerShell, with or without administrator privileges, run the following command to find the process listening on 7890:

Get-NetTCPConnection -LocalPort 7890 -State Listen |
  Select-Object LocalAddress, LocalPort, OwningProcess

Get-Process -Id process ID

You can also use a built-in Windows command:

netstat -ano | findstr :7890
tasklist /fi "PID eq process ID"

If the port belongs to an older Clash instance, another proxy tool or a leftover core process, exit the relevant program normally first. If two clients must run at the same time, change one mixed port to 7892 and update the system proxy target accordingly. Editing YAML without reloading the configuration will not change the port immediately.

The system proxy remains after closing the client

If the client exits unexpectedly, Windows may not have time to restore its proxy settings. Reopen the client, disable “System proxy” and then exit normally. If the client can no longer start, open “Settings” → “Network & internet” → “Proxy”, turn off the manual proxy server and check whether the address and port are still 127.0.0.1:7890.

TUN mode: installation, permissions and DNS troubleshooting

When do you need TUN mode

TUN mode creates a virtual network interface so applications that ignore the system proxy can still pass through mihomo. Game platforms, some command-line programs and applications using UDP are more likely to need TUN. For ordinary browser traffic, start with the system proxy. After confirming that the subscription, node and rules work, enable TUN separately to make troubleshooting easier.

Enabling TUN on Windows usually requires administrator privileges or a service component installed by the client. In Clash Verge Rev, for example, install service mode under “Settings” → “System settings”, then enable TUN under “Settings” → “Clash settings”. Menu locations vary by client version, but “service installed successfully” and “TUN enabled” are two different states.

Four checks when TUN cuts off network access

1. Check the service status: Open the “Services” app and confirm that the service belonging to the client is running. If it stops immediately after starting, check the client log and Windows system log.
2. Check the virtual adapter: Open “Settings” → “Network & internet” → “Advanced network settings” and confirm that the TUN interface was created and has not been disabled manually.
3. Check DNS: If the log repeatedly shows resolution timeouts, first confirm that the DNS servers in the configuration are reachable, then check whether other DNS filtering software is occupying port 53.
4. Check for routing conflicts: Corporate VPNs, game accelerators, Hyper-V, WSL and other virtual adapters can all add routes. Temporarily quit similar software and test again to quickly identify the source of the conflict.

mihomo TUN configurations may include fields such as stack, auto-route and auto-detect-interface. A common setup uses the mixed stack with automatic routing enabled, but the valid values ultimately depend on the core version. Do not copy an entire TUN configuration from an old tutorial and overwrite the settings supplied by your subscription.

tun:
  enable: true
  stack: mixed
  auto-route: true
  auto-detect-interface: true
  dns-hijack:
    - any:53

dns-hijack passes specified DNS requests to the core for handling. It does not mean every DNS issue will disappear automatically. Resolution can still fail when an upstream server is unreachable, rules send DNS requests through the wrong outbound path, or local security policies block the virtual interface.

Restore startup behavior after failed autostart or an upgrade

Distinguish app startup, core startup and proxy takeover

“Start with Windows” involves at least three stages: launching the graphical client after Windows sign-in, having the client start the mihomo core, and restoring the system proxy or TUN state. Seeing a tray icon does not prove that traffic is being intercepted; likewise, a running background service does not mean the current configuration loaded successfully.

Open the client’s “Settings” → “System settings” and enable startup with Windows, then open “Task Manager” → “Startup apps” and confirm that the entry is enabled. Some versions use a registry startup entry, while others use a scheduled task or the Startup folder. After an upgrade changes the installation path, an old startup entry may still point to an executable that no longer exists.

Troubleshooting order when startup restores without a proxy

1. After signing in to Windows, wait 15 to 30 seconds and confirm that the client appears in the system tray.
2. Open the client log and check whether the core finished starting and loaded the current configuration.
3. Confirm that the subscription profile is still selected rather than falling back to a blank or default profile.
4. Check whether the “System proxy” or TUN switch was restored according to the client settings.
5. Check that the Windows proxy address uses the current port, for example 127.0.0.1:7890.

If the client starts before the network is ready, an automatic subscription update may fail during sign-in. Do not mistake that failure for an invalid node. Once the connection is stable, update manually and check the HTTP status and log timestamps. When a laptop resumes from sleep and switches Wi-Fi networks, it may also need to rediscover the default network adapter, especially when TUN is enabled.

What to preserve when upgrading the client

Before upgrading, record the client version, core version, port, run mode and profile name. Save the subscription URL and local override rules separately instead of relying only on the client’s internal database. After upgrading, keep TUN disabled and complete one connection test through the system proxy before restoring service mode and TUN.

When migrating from Clash for Windows 0.20.39 to a mihomo client, do not copy the entire old data folder. The old client’s UI settings, database and override scripts may not be recognized by the new client. A more reliable approach is to import the subscription again, then migrate rules, DNS and port settings one by one.

Post-installation acceptance checklist for Clash on Windows

After installation, follow the sequence below for a complete acceptance check. Each step verifies a clear state, making it easier to identify the failing layer later.

• The client architecture matches the system, and both the graphical interface and mihomo core run reliably.
• The subscription has been downloaded and selected; the Proxies page shows proxy groups and nodes.
• The local 7890 port is listening and is not occupied by another program.
• A curl.exe test targeting 127.0.0.1:7890 returns an HTTP response.
• The Windows system proxy address and port match the values actually used by the client.
• In Rule mode, the logs show the matching rule and outbound policy when you visit different sites.
• When TUN is needed, the service, virtual interface, automatic routing and DNS all work normally.
• After restarting Windows, the client, core and proxy takeover state all recover as expected.

The main challenge when installing Clash on Windows is not the installer itself, but keeping the graphical client, mihomo core, subscription configuration, system proxy and TUN routes in sync. Verifying them in the order “core running → configuration loaded → local port → explicit proxy test → system proxy → TUN” makes specific problems easier to isolate than changing several switches at once.