Install Clash for Windows on Windows 10: SmartScreen to First Subscription Step by Step

Why a Windows 10–specific Clash for Windows install guide?

Search intent splits cleanly: Clash for Windows plus Windows 10 is not the same audience as Verge Rev, Mihomo Party, or the Win11 variant where SmartScreen copy and proxy panels moved slightly. Classrooms, SOHO routers, and corporate laptops still run build 19045 daily. Those users want the familiar Profiles column, General toggles, and system tray workflow—not a lecture about every Meta GUI fork. A dedicated Win10 page keeps firewall prompts, Settings → Network & Internet → Proxy paths, and troubleshooting verbs aligned with what they actually see.

Treat this article as the CFW-focused complement to our Clash for Windows setup guide, which contrasts legacy clients with modern stacks. The upstream CFW repository was archived, yet binaries and tutorials remain in circulation; that status raises supply-chain stakes rather than invalidating the UI. Pair this walkthrough with honest maintenance expectations: verify checksums, prefer channels that publish hashes, and plan a migration to actively maintained clients when your threat model demands fresher releases.

Consumer Windows 10 exited mainstream support in late 2025, but extended servicing and enormous install bases mean these steps still matter in 2026. Patch before you proxy: cumulative updates and Defender signatures reduce false positives when you extract Go-based cores into user profile folders. Document your build number (Win+R → winver) in support notes so volunteers do not debug against the wrong screenshot set.

Before you start on Windows 10

Airport panels sometimes require overseas HTTPS before the subscription URL resolves—the classic chicken-and-egg. Mitigations are boring: provider mirror, phone tether, or YAML export from a trusted second machine. Note which workaround you used so you do not confuse an expired token with a broken client. If your YAML references modern outbound types, plan for kernel switching to Clash Meta early; legacy premium cores choke on keys providers adopted years ago.

Download Clash for Windows from a defensible source

Start from the original project’s GitHub Releases history or our Windows download section. When release pages publish SHA256 digests, verify locally—PowerShell Get-FileHash or CertUtil -hashfile on Windows 10 both work. Mismatched filenames (“latest.exe” from forum links) are stop signs. Installers target Program Files; portable archives unpack to a folder you control—pick portable when elevation is impossible, installer when you want predictable shortcuts and uninstall entries.

Run from a normal NTFS path such as Downloads. Launching from synced cloud folders can preserve Mark-of-the-Web alternate data streams that keep SmartScreen loud. After download, right-click → Properties and unblock if Windows shows a security warning at the bottom—only after hash verification, not as a blind habit.

SmartScreen, UAC, and why warnings are loud on Windows 10

Double-click the installer and Microsoft Defender SmartScreen may warn about an unrecognised app. That is reputation scoring—not a guaranteed malware verdict. Utilities that rewrite system proxy settings sit in a high-risk category because malware loves the same hooks. Workflow: verify first, dismiss second—read the publisher line, compare the path to your download folder, reconcile hashes, then More info → Run anyway. Never teach colleagues to click through because “everyone does it.”

User Account Control is separate. Approving elevation lets installers write under protected directories and register services some community builds bundle. Denying UAC mid-flight yields partial installs—shortcuts that point nowhere, cores that never extract. If Group Policy forbids elevation, stop and choose portable layout or IT exception; guessing wastes more time than a ticket.

Install steps and where files land

1. Launch the installer, accept sensible defaults, prefer Program Files unless policy dictates a user-writable tree.
2. Allow Start menu shortcuts—they matter when you later pin the app or run as administrator for stubborn listeners.
3. Finish setup; reboot only if release notes demand it after bundling a driver—most CFW builds start immediately.

Portable users unzip to a directory excluded from overzealous real-time scrubbers. Some antivirus engines stall Electron bundles mid-write. Pin Clash for Windows.exe manually; Windows Search on older spinning disks may lag indexing fresh paths.

First launch: firewall, system tray, and core readiness

Open Clash for Windows from Start or your shortcut. The app minimizes to the system tray—learn the cat icon in the notification area (click the ^ overflow chevron if hidden). Windows Defender Firewall may ask about private versus public networks—allow private first; tighten later. The dashboard should show General, Profiles, Proxies, Connections, Logs, and Settings.

Before subscription import, confirm the core is actually running. Open Logs immediately if the tray icon looks idle or Proxies never populates—stale locks from crashed sessions, quarantined executables, and port collisions surface there faster than reinstall loops. Capture the exact error string before deleting folders; support threads without log lines rarely converge.

Kernel switching: make Clash Meta ready before import

Classic CFW shipped with a premium-era core, yet most 2024–2026 provider YAML expects Clash Meta parsers (vless, hysteria2, extended rule providers, and similar). That gap is why kernel switching belongs in every Windows 10 install tutorial—not as an advanced footnote. Open Settings inside CFW, locate Clash Core (wording varies slightly by community build), choose Clash Meta, and download the core when prompted. Wait until the UI reports the Meta binary is present; switching without downloading leaves you on a hollow selection.

1. Settings → Clash Core → select Clash Meta (sometimes labelled Meta or Mihomo in forks).
2. Trigger Download if the button appears; watch progress—corporate proxies may block GitHub CDN edges.
3. Return to Logs → restart core from the UI if offered → confirm no unknown field spam on an empty profile.
4. Only then proceed to subscription import—importing first on the wrong core produces empty Proxies tabs that look like provider outages.

After switching, reload the active profile. Dormant child processes from the old core occasionally hold ports; quitting CFW fully from the tray (Exit, not merely closing the window) clears most ghosts on Windows 10. If logs mention incompatible configuration versions, you are still on premium—repeat the switch and verify the downloaded binary was not quarantined by Defender.

Log symptom	Likely fix
unknown proxy type or unknown rule type	Switch to Clash Meta kernel and reload profile
Core download stalls at 0%	Firewall, TLS inspection, or blocked GitHub assets—try another network
Meta selected but premium binary still runs	Exit tray app completely, delete stale core lock files per build docs, relaunch

YAML config directory on Windows 10

CFW stores profiles and runtime state under your user profile—commonly %USERPROFILE%\.config\clash or a .config\clash-win sibling depending on build. The Profiles tab mirrors remote downloads into that tree; opening the folder from Settings (when available) helps classroom debugging: you can confirm whether YAML actually landed on disk after a “successful” import. Back up the directory before experimental edits; a broken hand-edited file is easier to restore than a mystery half-sync.

Enterprise roaming profiles sometimes redirect .config to network shares—latency there causes truncated downloads that look like provider failures. If imports succeed on a local account but fail on domain accounts, ask IT whether folder redirection excludes hidden config paths.

How Clash for Windows thinks: profile, listeners, modes

Under the Electron chrome, CFW is still profile → listeners → modes. The UI makes knobs discoverable; newcomers fail when they paste a subscription yet never mark that row selected, leaving the core on an empty factory template even after a successful download indicator.

Symptom	Likely cause
Proxies tab shows zero nodes	Inactive profile, wrong kernel, or failed subscription download
Browser ignores proxy though CFW says ON	Windows proxy overwritten or wrong loopback port
bind: address already in use	Second CFW copy or another tool holding the mixed port

Once baseline browsing works, explore LAN proxy sharing—not during your first hour.

Subscription import: remote URL to active profile

Navigate to Profiles. Create or select a remote profile row, paste your subscription URL without trailing whitespace, name it clearly (“Home fibre”, “Lab trial”), then click Download or refresh. Wait for success; impatient double-clicks strand you on truncated YAML. After import, click the profile so it becomes active—highlighting or checkmarks vary by skin, but one profile must be selected, not merely listed.

1. Paste URL → save → trigger download.
2. Select the profile → confirm active state.
3. Open Proxies → verify policy groups or node lists.
4. Set auto-update interval (often 12–24 hours) so maintenance windows propagate.

Paste the URL into a browser on a machine with clean HTTPS—you should see YAML, not an HTML login wall. When documentation demands custom headers, copy precisely; improvised headers cause 403 loops. Clipboard hygiene matters: PDF exports sometimes add invisible Unicode—paste through Notepad and inspect edges.

Enable system proxy on Windows 10—stay on Rule mode first

In General, toggle System Proxy. Windows 10 mirrors manual proxy fields to the loopback listener CFW publishes—often near 7890 for mixed stacks, but read the port printed in the UI. Set Mode to Rule so domestic destinations stay direct while overseas hosts follow YAML. Reserve Global for contrast tests.

Cross-check Settings → Network & Internet → Proxy on Windows 10: manual configuration should point at 127.0.0.1 while CFW owns the switch. If the toggle snaps back, suspect login scripts or third-party cleaners. The tray menu can pause system proxy during captive portals—re-enable after login completes.

Prove the first connection before advanced knobs

Run latency probes in Proxies after picking a healthy group. Widespread timeouts usually mean upstream blockage or expired credentials—not DNS witchcraft yet. Load an overseas site and a domestic landing page while watching Connections or Logs; overseas domains should attach to proxy outbounds while domestic hosts stay direct per rules. Only then trust IP checkers—misconfigured DNS can lie while TCP tunnels behave.

If shutdown leaves Windows offline until reboot, read resetting system proxy after quitting Clash—usually a dangling manual proxy flag, not disk format time. For deeper traffic stats after baseline works, see traffic stats and core logs in Clash for Windows.

TUN mode and auto-start—defer until baseline works

Some forks advertise TUN adapters for traffic that ignores system proxy—useful for stubborn binaries—but on Windows 10 that path invites Wintun permissions drama. Attempt TUN only after system-proxy browsing succeeds. Enable “start with Windows” only after sleep/wake cycles prove proxy flags return cleanly; automation on a broken baseline just automates failure.

FAQ—SmartScreen, kernel switch, subscriptions

Why does SmartScreen block Clash for Windows on Windows 10?

SmartScreen ranks freshly downloaded networking binaries harshly. If hashes and publishers check out, use More info → Run anyway; if they do not, delete the file and restart from a verifiable channel.

Do I need Clash Meta on Windows 10?

For most current provider YAML, yes—use kernel switching in Settings before blaming empty proxy lists. Legacy premium cores remain relevant only for ancient configs you maintain yourself.

Subscription downloaded but proxies stay empty

Re-select the profile, confirm Meta core is running, restart the core, validate YAML in a browser, rotate tokens if the dashboard shows schedule changes you missed.

Some apps tunnel, others ignore CFW

UWP and Microsoft Store sandboxes may ignore WinINET proxy for loopback unless exemptions apply—see our UWP loopback guide once HTTP browsers already work.

Summary—the shortest trustworthy path on Windows 10

Windows proxy tutorials exploded in every direction—some chase the newest GUI weekly, others bury classic CFW under unrelated forks—yet the annoyances repeat: unclear download sources, skipped verification, wrong kernel switching, inactive profiles, and proxy toggles fighting third-party cleaners. Clash was built around predictable YAML workflows, transparent rule control, and documentation that maps cleanly from subscription import to everyday browsing on long-lived Windows 10 machines.

Where brittle repacks expect you to trust anonymous binaries, Clash emphasises reproducible setups: understand what you downloaded, which core is active, and how traffic splits before you touch exotic drivers. That discipline scales from your first overseas search result to teams standardising on audited configs in the YAML config directory.

If you want that steadier baseline without hunting mirrors alone, pull a curated build from our download hub after you finish this checklist—the next step should feel like continuity, not a sales pitch. When you have proof of life in the browser, you have earned the right to tune extras.