How to Install and Use Clash for Windows (2026 Guide)

If you’re looking to install Clash for Windows, there’s something you need to know first: the original app was abandoned in late 2023. The developer deleted the GitHub repository, the last version is v0.20.39, and it hasn’t received a single update since. That said, it still works for a lot of people, so this guide covers both — how to set up the legacy Clash for Windows, and what to use instead if you want something that’s actually maintained.

What Is Clash for Windows?

Clash for Windows is a GUI client built on top of the Clash proxy engine. It’s not a VPN in the traditional sense — it’s a rule-based proxy tool that routes traffic through configurable nodes using protocols like Shadowsocks, VMess, Trojan, and SOCKS5. You load a config file (usually a YAML subscription from a proxy provider), set your proxy mode, and it handles the routing.

The thing that made it popular was the combination of a clean interface, solid rule-based routing, and support for TUN mode — which lets it capture all traffic on the system, not just browser traffic. It was, for a while, the go-to GUI client for this kind of thing on Windows.

But the project is dead now. Well, sort of — it’s actually more like: the app still runs fine for most use cases, but it won’t get fixes for security issues or support for newer protocols like Hysteria2 or TUIC v5. Whether that matters depends on what your proxy provider is using.

Quick Summary

• Clash for Windows (original): Last version v0.20.39, no longer updated, still functional for basic use
• Clash Verge Rev: The actively maintained alternative, built on the Mihomo (Clash Meta) core, supports newer protocols
• If your subscription provider still uses Shadowsocks or VMess, legacy CFW works fine
• If your provider uses Hysteria2 or TUIC v5, you need Clash Verge Rev or another modern client
• TUN mode requires running the app as administrator

How to Install Clash for Windows (Legacy v0.20.39)

Step 1: Download the Installer

The original GitHub repo is gone, but mirrors exist. Look for Clash.for.Windows.Setup.0.20.39.exe (the installer version) or the portable .7z package. The file should be around 60–70 MB.

Don’t trust random third-party sites advertising “the latest version” — if they claim anything newer than 0.20.39, it’s not the real app. There is no newer version.

Step 2: Run the Installer

Double-click the .exe. Windows SmartScreen will probably pop up with a warning because the app doesn’t have a valid digital signature. Click More info → Run anyway. This is expected with CFW — not a sign of malware specifically, just an unsigned binary.

If you downloaded the portable .7z version, extract it and run Clash for Windows.exe directly. No installation needed.

Step 3: First Launch

The app opens with a sidebar on the left. You’ll see:

• General — basic settings, system proxy toggle, startup behavior
• Proxies — your proxy nodes and policy groups
• Profiles — where you load config files
• Connections — live traffic view
• Logs — useful for debugging
• Settings — more advanced options

The interface is pretty quiet on first launch because there’s no config loaded yet.

Loading a Subscription / Config File

This is where most people get stuck. Clash for Windows doesn’t come with any proxy nodes — you need a configuration file from a proxy service provider.

Option A: Import via URL (Recommended)

1. Go to Profiles in the sidebar
2. Paste your subscription URL into the text field at the top
3. Click Download
4. The config appears in your profile list — click it to activate

Most providers give you a one-click “copy subscription link” option. That URL is what you paste here. Once active, the profile name will be highlighted and your nodes will appear under Proxies.

Option B: Import a Local YAML File

If your provider gave you a .yaml or .yml file instead of a URL:

1. Go to Profiles
2. Click the folder icon or drag-and-drop the file into the profile list
3. Click the imported profile to activate it

And if you’re writing your own config from scratch — that’s a whole separate rabbit hole involving proxy groups, rules, and DNS settings. Out of scope here, but the Clash documentation covers it.

Basic Usage: Connecting and Switching Modes

Once a profile is loaded:

1. Enable System Proxy

Go to General and toggle on System Proxy. This tells Windows to route browser traffic through Clash. You’ll see the toggle turn blue. Most apps on your system will now go through the proxy.

2. Choose a Proxy Mode

Under Proxies, there’s a mode selector at the top:

• Rule — traffic is routed based on the rules in your config file. Domestic traffic goes direct, foreign traffic goes through the proxy. This is the default and what most people should use.
• Global — all traffic goes through the proxy, no exceptions
• Direct — all traffic bypasses the proxy (basically disabling it without turning off System Proxy)

Rule mode is almost always what you want. From what I’ve seen, a lot of people switch to Global when something isn’t working and never switch back — which just adds unnecessary load on the proxy for local traffic.

3. Select a Node

Under the proxy groups in the Proxies tab, select the server you want. Some configs have a single “Select” group, others have separate groups for different services (Netflix, YouTube, etc.). Click the node name to switch.

TUN Mode: Capturing All Traffic

System Proxy only captures HTTP/HTTPS traffic and apps that respect system proxy settings. Windows Store apps, some games, and certain system services will bypass it entirely. TUN mode fixes that.

To enable TUN mode in Clash for Windows:

1. Go to General
2. Find Service Mode — click Install if it shows as not installed. This installs a system service that allows kernel-level traffic capture. It’ll ask for admin privileges.
3. Once installed, enable TUN Mode (the toggle below Service Mode)
4. Turn off System Proxy — TUN mode replaces it

You’ll see the tray icon change color when TUN is active. And yes, you have to run CFW as administrator for TUN mode to work properly. If you launched it normally and TUN isn’t working, restart it with admin rights.

Important warning: Before you close the app, make sure you disable System Proxy first. If you quit while System Proxy is enabled, Windows keeps using Clash as the proxy even though Clash is no longer running — and you’ll lose internet. To fix it, reopen the app, disable System Proxy, then quit. Or go to Windows Settings → Network → Proxy and turn off manual proxy.

What Actually Worked For Me

Honestly the first time I set this up, the profile loaded fine but nothing worked. Connections were timing out, the tray icon showed green, but Chrome wasn’t routing through the proxy. Spent about fifteen minutes checking the node selection and re-downloading the config before I realized the issue: I’d installed it without admin rights and TUN mode had silently failed. Service Mode wasn’t installed at all.

Restarted with “Run as administrator,” installed Service Mode, enabled TUN mode — everything worked. The fix wasn’t clever, just embarrassingly obvious in hindsight.

Common Issues and Fixes

System Proxy toggles on but nothing routes through

Check that the proxy port in Settings matches what your config expects (default is 7890). Also check that your firewall isn’t blocking Clash.

Profile downloads fail

Your subscription URL might itself be blocked if you’re behind a firewall. Some providers offer alternate download links or manual download buttons on their dashboard.

App launches but crashes immediately

This sometimes happens if there’s a leftover config.yaml from a previous install that’s malformed. Navigate to C:\Users\[YourName]\.config\clash and delete or rename config.yaml, then relaunch.

UWP/Microsoft Store apps not going through proxy

This is a known limitation of System Proxy mode. Use TUN mode, or go to General → UWP Loopback and enable the relevant apps. CFW has a built-in UWP loopback helper for exactly this.

Should You Use Clash for Windows in 2026?

Probably not as a long-term choice. The app still works for basic Shadowsocks and VMess setups, but it won’t get security fixes, and newer protocols like Hysteria2 (which a lot of providers are moving to) aren’t supported. Not 100% sure when the tipping point will be — your mileage may vary depending on your provider — but it’s a dead-end setup.

The recommended replacement is Clash Verge Rev, which is the community-maintained fork built on the Mihomo kernel. It has an almost identical interface, imports the same subscription URLs, and is actively maintained as of mid-2026. If you’re starting fresh, just use Clash Verge Rev instead.

Comparison: Clash for Windows vs Clash Verge Rev

FAQ

Is Clash for Windows safe to use in 2026? The app itself isn’t malware, but “safe” depends on a few things. Since it’s no longer updated, any future security vulnerabilities won’t be patched. The bigger risk is downloading from shady mirrors — stick to well-known sources and verify the file size matches expected (~70 MB).

What’s the difference between System Proxy and TUN mode? System Proxy tells Windows to route HTTP/HTTPS traffic through the local Clash port. Apps that ignore system proxy settings (many games, some system services, Microsoft Store apps) bypass it completely. TUN mode installs a virtual network interface at the kernel level and captures all traffic, no exceptions.

My subscription URL isn’t loading in the Profiles tab — what do I do? Try pasting the URL directly in your browser to see if it returns a YAML file. If it doesn’t load at all, the URL itself might be blocked. Some providers offer an alternate “copy plain URL” or a download button — try that. Also check that System Proxy isn’t already enabled on an unrelated proxy that’s breaking the download.

Can I use Clash for Windows without a proxy provider? Yes, if you write your own YAML config or have your own proxy server. The app just needs a valid config file with at least one proxy node defined. But most home users get configs from a commercial provider.

Does Clash for Windows work with WireGuard? No. The Clash engine doesn’t support WireGuard natively. If you need WireGuard, use a dedicated WireGuard client or look at sing-box.

Why does Clash show “Connected” but I still can’t access certain sites? Check your proxy mode. If you’re in Rule mode and a site is classified as “domestic” or “direct” in the rule set, it won’t go through the proxy. Switch to Global mode temporarily to test. If it works in Global, the rules in your config are routing that site directly.

Is Clash Verge Rev really a drop-in replacement? For most users, yes. You import the same subscription URL, get the same node list, same proxy modes, same rule-based routing. The UI is slightly different but similar enough. The main thing to check is whether your config uses any Clash syntax that Mihomo handles differently — in practice, most standard configs are fine.

Editor’s Opinion

Look, Clash for Windows was genuinely good when it was active. Clean UI, reliable TUN mode, good rule support. But it’s been dead for two and a half years now. If you’re just trying to get it working because someone sent you an old guide, fine — it’ll probably work. But don’t build your whole setup around it. Switch to Clash Verge Rev, import same subscription URL, done in five minutes. Not worth staying on unsupported software.