---
title: "Move from Surge"
description: "How to import a Surge profile into Potatso on iPhone and iPad, how its proxies, groups, rules and rule sets convert, and what doesn't carry over."
---

> Documentation Index
> Fetch the complete documentation index at: https://potatso.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Move from Surge

Potatso imports Surge profiles. It converts the proxies, proxy groups, rules, rule sets and DNS servers it has an equivalent for, and lists everything else in the import preview.

## Bring your profile {#profile}

If your Surge profile comes from a URL, such as a managed profile from your provider, import that URL:

1. Copy the profile's URL.
2. In Potatso, on **Home**, tap the **+** button, then **Import via Link/File**.
3. Paste the URL and tap **Continue**.
4. Check the preview. Under **Import To**, choose where it goes, then tap the button at the bottom.

A profile imported from a URL keeps updating, daily by default, and changes you make in Potatso are kept across updates. See [Import subscriptions and configurations](/docs/guides/import-subscriptions/).

If your profile is a file, export it from Surge so that it's in the Files app. Then in the importer, choose **File** under **Source**, tap **Choose File…** and pick it. It must be UTF-8 text and no larger than 5 MB. A file is imported once.

Potatso doesn't follow `#!include` lines. Import each included file on its own.

## Proxies {#proxies}

Potatso imports `[Proxy]` lines of these types: `ss`, `http`, `https`, `socks5`, `socks5-tls`, `vmess`, `trojan`, `snell`, `hysteria2` and `anytls`. See [Protocols](/docs/protocols/) for the settings each supports.

These proxies are skipped:

- Other types, such as `wireguard`, `tuic`, `ssh` and `external`.
- Proxies that use Shadow TLS, a TLS client certificate, `server-cert-verify-name` or `sni=off`.

A proxy with an `underlying-proxy` is imported, but connects to its server directly: the chain isn't imported.

## Proxy groups {#groups}

| Surge group | In Potatso |
| --- | --- |
| `select`, `url-test`, `fallback`, `load-balance` | ✅ The same kind of group |
| `smart` | An automatic (`url-test`) group of its proxies |
| `subnet`, `ssid` | A manual group set to its default policy. Potatso doesn't switch policies by network. |
| `policy-path` (HTTP or HTTPS) | ✅ A proxy provider |
| `include-other-group`, `include-all-proxies`, `policy-regex-filter` | ✅ |

## Rules {#rules}

Potatso converts each Surge rule into its own rule format:

- `DOMAIN`, `DOMAIN-SUFFIX`, `DOMAIN-KEYWORD` and `DOMAIN-WILDCARD` rules.
- `IP-CIDR`, `IP-CIDR6`, `GEOIP` and `IP-ASN` rules, keeping `no-resolve`, and `SRC-IP` rules.
- `DEST-PORT`, `SRC-PORT` and `IN-PORT` rules, including port ranges.
- `PROTOCOL,TCP` and `PROTOCOL,UDP`.
- `AND`, `OR` and `NOT` rules.
- `RULE-SET` and `DOMAIN-SET`, which become rule providers.
- `FINAL`, which becomes where everything else goes.

These rules are skipped:

| Rule | Why |
| --- | --- |
| `USER-AGENT`, `URL-REGEX` | Potatso doesn't inspect HTTP requests. |
| `SCRIPT` | Scripts aren't supported. |
| `SUBNET`, `CELLULAR-RADIO`, `CELLULAR-CARRIER`, `HOSTNAME-TYPE` | No equivalent |
| `DEVICE-NAME`, `MAC-ADDRESS` | No equivalent |
| `PROTOCOL` other than TCP and UDP | No equivalent |
| `RULE-SET` inside `AND`, `OR` or `NOT` | Not supported |
| A rule whose policy isn't in the profile | Its target is unavailable. |

The preview lists each skipped rule under **Compatibility Issues**, with its rule number and the reason.

## DNS {#dns}

Potatso imports the `dns-server` and `encrypted-dns-server` servers from `[General]`. With encrypted servers, the plain ones only look up the encrypted servers' addresses, as in Surge. `h3://` servers are used over HTTPS.

## What doesn't carry over {#not-imported}

Potatso has no HTTPS decryption (MitM), rewrites or scripts. These Surge sections aren't imported, and the preview names the ones your profile has:

`[MITM]`, `[Script]`, `[URL Rewrite]`, `[Header Rewrite]`, `[Body Rewrite]`, `[Map Local]`, `[Host]`, `[IP Rewrite]`, `[SSID Setting]`, `[Panel]`, `[Port Forwarding]`, `[Snell Server]`, `[MTProto]`, `[Ponte]`, and WireGuard and Tailscale sections.

## After you import {#next}

1. A Surge profile with proxy groups or rules imports in Rule mode. On **Home**, check the outbound mode. See [Outbound modes](/docs/guides/outbound-modes/).
2. Turn on the switch on the status card to connect. The first time, iOS asks to add Potatso's VPN configuration: tap **Allow**.

To change rules and groups after import, see [Rules and rule sets](/docs/guides/rules-and-rule-sets/) and [Proxy groups and speed tests](/docs/guides/proxy-groups-and-speed-tests/).

Source: https://potatso.com/docs/guides/migrate-from-surge/index.mdx