Move from Surge | Potatso Docs

How to import a Surge profile into Potatso on iPhone and iPad, how its proxies, groups, rules and rule sets convert, and what doesn't carry over.

Potatso imports Surge profiles. It converts the proxies, proxy groups, rules, rule sets and DNS servers it has an equivalent for, and lists everything else in the import preview.

Bring your profile

If your Surge profile comes from a URL, such as a managed profile from your provider, import that URL:

Copy the profile's URL.
In Potatso, on Home, tap the + button, then Import via Link/File.
Paste the URL and tap Continue.
Check the preview. Under Import To, choose where it goes, then tap the button at the bottom.

A profile imported from a URL keeps updating, daily by default, and changes you make in Potatso are kept across updates. See Import subscriptions and configurations.

If your profile is a file, export it from Surge so that it's in the Files app. Then in the importer, choose File under Source, tap Choose File… and pick it. It must be UTF-8 text and no larger than 5 MB. A file is imported once.

Potatso doesn't follow #!include lines. Import each included file on its own.

Proxies

Potatso imports [Proxy] lines of these types: ss, http, https, socks5, socks5-tls, vmess, trojan, snell, hysteria2 and anytls. See Protocols for the settings each supports.

These proxies are skipped:

Other types, such as wireguard, tuic, ssh and external.
Proxies that use Shadow TLS, a TLS client certificate, server-cert-verify-name or sni=off.

A proxy with an underlying-proxy is imported, but connects to its server directly: the chain isn't imported.

Proxy groups

Surge group	In Potatso
`select`, `url-test`, `fallback`, `load-balance`	✅ The same kind of group
`smart`	An automatic (`url-test`) group of its proxies
`subnet`, `ssid`	A manual group set to its default policy. Potatso doesn't switch policies by network.
`policy-path` (HTTP or HTTPS)	✅ A proxy provider
`include-other-group`, `include-all-proxies`, `policy-regex-filter`	✅

Rules

Potatso converts each Surge rule into its own rule format:

DOMAIN, DOMAIN-SUFFIX, DOMAIN-KEYWORD and DOMAIN-WILDCARD rules.
IP-CIDR, IP-CIDR6, GEOIP and IP-ASN rules, keeping no-resolve, and SRC-IP rules.
DEST-PORT, SRC-PORT and IN-PORT rules, including port ranges.
PROTOCOL,TCP and PROTOCOL,UDP.
AND, OR and NOT rules.
RULE-SET and DOMAIN-SET, which become rule providers.
FINAL, which becomes where everything else goes.

These rules are skipped:

Rule	Why
`USER-AGENT`, `URL-REGEX`	Potatso doesn't inspect HTTP requests.
`SCRIPT`	Scripts aren't supported.
`SUBNET`, `CELLULAR-RADIO`, `CELLULAR-CARRIER`, `HOSTNAME-TYPE`	No equivalent
`DEVICE-NAME`, `MAC-ADDRESS`	No equivalent
`PROTOCOL` other than TCP and UDP	No equivalent
`RULE-SET` inside `AND`, `OR` or `NOT`	Not supported
A rule whose policy isn't in the profile	Its target is unavailable.

The preview lists each skipped rule under Compatibility Issues, with its rule number and the reason.

DNS

Potatso imports the dns-server and encrypted-dns-server servers from [General]. With encrypted servers, the plain ones only look up the encrypted servers' addresses, as in Surge. h3:// servers are used over HTTPS.

What doesn't carry over

Potatso has no HTTPS decryption (MitM), rewrites or scripts. These Surge sections aren't imported, and the preview names the ones your profile has:

[MITM], [Script], [URL Rewrite], [Header Rewrite], [Body Rewrite], [Map Local], [Host], [IP Rewrite], [SSID Setting], [Panel], [Port Forwarding], [Snell Server], [MTProto], [Ponte], and WireGuard and Tailscale sections.

After you import

A Surge profile with proxy groups or rules imports in Rule mode. On Home, check the outbound mode. See Outbound modes.
Turn on the switch on the status card to connect. The first time, iOS asks to add Potatso's VPN configuration: tap Allow.

To change rules and groups after import, see Rules and rule sets and Proxy groups and speed tests.