Clash Subscription Import Guide: URLs, Local YAML, and Base64 Formats

First, distinguish subscription URLs from configuration content

Before importing, identify what you have. A URL is a resource address, YAML is a text format for configuration files, and Base64 is an encoding method. These aren't mutually exclusive subscription types: the same HTTPS address might return YAML, a Base64-encoded list of nodes, or even a login page.

A Clash client manages configurations, provides the interface, and starts the proxy core. mihomo is a core compatible with the Clash configuration ecosystem, with additional features; it's also known as Clash Meta. Whether a config works depends both on the returned content and on whether the current core supports its protocols and fields.

Import a URL subscription: from copying the link to selecting the config

1. Copy a subscription for Clash or mihomo

Go to your subscription provider's account page and choose an export option labeled “Clash,” “Clash Meta,” or “mihomo.” Different options may return different protocols and config structures; a “generic subscription” may not work as a complete Clash config.

Copy the actual subscription URL—not the browser address of your account page or the explanatory text next to a button. Check that there's no leading space or trailing period. The &, =, and percent-encoded characters in the URL may be significant, so don't remove or change them.

2. Import it from the client's config page

1. Open the client and go to “Config” or “Profiles.” In Clash Verge Rev, for example, select “Config” in the sidebar, then use the subscription URL field on that page.
2. Paste the full URL and click “Import.” If your version uses a “New” dialog, choose the remote config type and enter the URL.
3. Wait for the config card to appear. Check its update time or any error message; don't keep clicking Import.
4. Select the config you just imported to make it active. Seeing it in the list doesn't mean it's enabled.
5. Open the “Proxies” page, expand the policy group you need, confirm it contains nodes, then select an available node.

Other clients may put the same controls under “Config” in the menu bar app's menu. Labels vary, but the process is the same: fetch remote content, parse the config, select it, and check its policy groups.

3. Tell a successful download from an active config

“Subscription updated successfully” usually means the content was fetched and processed. It doesn't mean the selected node can connect or that browser traffic is using the proxy. First confirm the active config, then check the proxy mode. “Rule” mode is a good starting point; the config's rules determine what goes direct and what uses the proxy.

Import a local YAML file: check its structure and source

YAML uses indentation to show hierarchy. Clash configs commonly include proxies (nodes), proxy-groups (policy groups), and rules (routing rules); they may also use proxy-providers to load nodes externally. No inline proxies section doesn't necessarily mean the config is empty.

1. Save the file somewhere easy to find, such as your Downloads folder. Make sure it isn't an HTML file saved from a web page.
2. Open the client's config page and choose “Import file” or the local config option. Some clients support drag-and-drop; follow the on-screen instructions.
3. Select the config and check for parse errors. If an error gives a line number, check the indentation, colons, and quotes on that line and the one above it.
4. Check that external node and rule sources load successfully. A local file can still depend on network resources.

Minimal config for testing the import process

Here's a YAML example you can save as a local config. It listens on port 7890 on your Mac and sends requests through the direct connection. It has no proxy nodes, so use it only to verify the file format and config loading—not to test a proxy route.

mixed-port: 7890
allow-lan: false
mode: rule
log-level: info
rules:
  - MATCH,DIRECT

mixed-port is a combined port that accepts both HTTP and SOCKS proxy requests. The 7890 value here is an example, not a port shared by every client. If the port setting in the interface or a config override changes it, use the actual listening port.

When editing YAML, indent with spaces, not tabs. Quote node passwords, URLs, or names when required by YAML syntax. Direct edits to a remote config may be overwritten by the next update; for lasting changes, use the client's override or merge feature where possible.

Identify Base64: check the decoded content too

Base64 isn't encryption. Encoded text commonly contains letters, numbers, plus signs, and slashes, sometimes ending in equals signs; URL-safe variants may use hyphens and underscores. But a long string of characters isn't, by itself, proof of a valid subscription.

Three common types of decoded content

• Multiple node URIs: For example, several ss:// or vmess:// links. These are a collection of nodes and don't include complete policy groups or routing rules.
• YAML text: Check the config structure and core compatibility. Successful decoding alone doesn't mean the config will work.
• An error message or other text: Check the provider page for subscription access, link type, and expiration.

If you need to inspect it offline, run the command below in Terminal on your Mac. First copy the encoded text to the clipboard, then run the command. It only decodes the text locally, and the result appears in Terminal.

pbpaste | /usr/bin/base64 -D

This command uses options for a built-in macOS tool. A decoding error could mean the text was truncated, contains extra characters, or uses a different encoding variant; it doesn't necessarily mean the account is invalid. Decoded content may include passwords, so don't record your screen or share it as-is. Clear your clipboard when you're done.

If the result is a node list but the client's remote config field accepts only complete YAML, go back to the provider and choose a Clash-specific subscription. Use a generic node subscription only if the client explicitly supports it or you have a trusted local conversion process. Don't send a credential-bearing subscription to an untrusted online converter just to import it.

First-run checks: verify the config, node, and traffic

First, check the config and policy groups

Make sure the current config is marked as selected and that the node names on the Proxies page match the imported content. A policy group is a set of configured connections from which you can choose one. If a rule references a missing group, the file may download but still fail to load or route traffic correctly.

Next, check that a node is available

Run a latency test from the Proxies page. The result reflects the client's probe to a test address; it isn't a download speed measurement and doesn't guarantee access to every site. If it times out, try another node once and check the logs for connection or authentication errors. Don't reinstall the client based on a single red number.

Finally, check whether the app is using the proxy

Enable “System Proxy” in the client, then open the site you're testing in a browser. System Proxy is a macOS setting for apps; only apps that honor it will use the proxy. Terminal commands and some apps may not follow it automatically, so you can test by specifying the proxy port explicitly:

curl --proxy http://127.0.0.1:7890 --connect-timeout 10 --max-time 20 -I https://example.com

Before running the command, replace the port with the client's actual HTTP or mixed port. 127.0.0.1 refers to this Mac. The connection wait limit is 10 seconds, and the overall request limit is 20 seconds. An HTTP response means the request received a response, but to confirm it went through a remote node, check the matched rule and exit route on the Connections page or in the logs.

TUN routes traffic through a virtual network interface and usually covers more than System Proxy. You don't need to enable TUN right after importing a subscription. First get the config and standard proxy requests working, then adjust traffic capture to suit your apps; this keeps troubleshooting simpler.

Set a subscription update interval: verify a manual update first

First, select “Update” from the config card's actions menu. Confirm that the update time changes and the config still loads. Then open that config's edit or settings view and look for automatic updates and the update interval. Different clients may use minutes, hours, or seconds, so check the unit before entering a value.

• Typical personal use: Start with one update every 24 hours—that's 1440 minutes or 86400 seconds. This is a starting point, not a protocol requirement.
• Frequently changing nodes: Follow your provider's guidance and update every 6 or 12 hours. Don't set the interval to a few seconds.
• After changing nodes or plans: Once the provider has made the change, run a manual update and check whether the new nodes appear in the policy groups.
• Mac often sleeps with the lid closed: Client tasks usually won't run on schedule during sleep. Check the last update time after waking, and update manually if needed.

Updating a subscription, node sources, and rule sources, and running a latency test are four separate operations. The interval for a provider in YAML is often measured in seconds, but it isn't a universal setting for updating a client config card. Don't change every field named interval just to refresh the subscription more often.

If the current config needs an existing proxy to refresh, keep at least one working node before updating. If the update fails, check whether the client kept the old config. Don't delete your only working config and then discover the new URL can't be reached.

Import and update failures: troubleshoot by error type

Content downloaded, but no nodes found

Check whether you imported a rules-only file or a node source file that requires another config to reference it. Full configs, node provider files, and rule provider files serve different purposes; don't treat them as interchangeable just because they all use YAML extensions.

The URL opens in a browser, but the client can't update

The browser may send a login cookie that the client doesn't inherit; the server may also return different formats based on request headers. Get a dedicated subscription URL from your account page and check the actual error in the client logs. Don't bypass the error by disabling certificate verification.

What to do if your URL was exposed

Reset the subscription token in your provider account, then update the URL on every device and confirm that the old URL no longer works. Deleting a chat screenshot or removing a local config can't revoke credentials that have already been exposed.