Where apps hide your files

Tunnelblick's configuration folders

Updated 2026-10-28 · 6 min read

Tunnelblick keeps each VPN profile as a .tblk folder, in your own Library if it is Private or in the system /Library if it is Shared. Here are both paths, how to remove or back up a profile properly, and what to keep secret.

The location

Tunnelblick keeps each VPN configuration in one of two places, depending on whether you chose Private or Shared when you added that configuration (Tunnelblick asks each time you drop one on its menu bar icon):

~/Library/Application Support/Tunnelblick/Configurations
/Library/Application Support/Tunnelblick/Shared

The first is for your account only. The second is available to every user on the Mac. Tunnelblick's own file-locations page lists both, and adds a third kind: a "Deployed" configuration, which sits inside the app (in a Deploy folder under Tunnelblick.app/Contents/Resources) and comes from an organisation that built its own copy of Tunnelblick.

To open either folder, choose Go > Go to Folder (⇧⌘G) in Finder, paste the path and press Return. From Terminal:

open ~/Library/Application\ Support/Tunnelblick/Configurations
open /Library/Application\ Support/Tunnelblick/Shared

Tunnelblick was not installed on the Mac used for this guide, so the paths and menu names here come from Tunnelblick's documentation at tunnelblick.net rather than from a local check.

Private or shared: what changes

	Private	Shared
Folder	~/Library/Application Support/Tunnelblick/Configurations	/Library/Application Support/Tunnelblick/Shared
Who can use it	Only you, while you are logged in	Anyone logged in to the Mac
Edit the OpenVPN file	Yes, from VPN Details	No, convert it to Private first
File types	.tblk, or an older .ovpn or .conf	.tblk only

To edit a Private configuration's OpenVPN file, select it in VPN Details, click the gear button below the list and choose Edit OpenVPN Configuration File…. That opens the installed copy in TextEdit, not your original. The documentation says a Shared configuration cannot be edited this way: convert it to Private, edit it, then change it back to Shared. Changes to keys or certificates mean editing your original .tblk and installing it again.

What a configuration looks like

A .tblk is a folder whose name ends in .tblk, which is why Finder shows it with a Tunnelblick icon. Inside you will find one or more OpenVPN files (.ovpn or .conf), the certificates and keys they refer to (.crt, .key, .pem, .p12 and similar), and sometimes shell scripts that end in .sh. If you drag a bare .ovpn onto the Tunnelblick icon in the menu bar, the app wraps it into a .tblk for you.

Treat these folders as secrets. A .key or .p12 file inside is a credential for your VPN. List the names to see what is there, but do not email, paste or upload the contents anywhere:

ls -la ~/Library/Application\ Support/Tunnelblick/Configurations

The shadow copy under /Library

For Private configurations, Tunnelblick also keeps a secured "shadow" copy that it creates and maintains itself:

/Library/Application Support/Tunnelblick/Users/<your username>

(Tunnelblick's file-locations page prints this path with a slash missing after Application Support; the path above is the one in Tunnelblick's source code.) Backups of Deployed configurations go under /Library/Application Support/Tunnelblick/Backup.

That is why the same configuration name can turn up in two places. Do not edit the shadow copy: change the configuration from inside Tunnelblick and let it refresh its own copy. Tunnelblick's source sets these secured folders to be owned by root, so you can list the folder names from your account, but most files inside, including keys and the OpenVPN files, are readable only by root. That is expected, and you do not need to get in.

Removing a configuration the supported way

1. Click the Tunnelblick icon in the menu bar and open VPN Details.
2. Select the configuration in the list.
3. Click the minus sign below the list. ⌘-click or ⇧-click to select several first.

Deleting the .tblk from Finder is not the documented route, and for Shared configurations the files in /Library are protected. Use the minus button so Tunnelblick removes the configuration through its own secured process and the menu entry goes with it.

If you want to remove Tunnelblick itself, the documentation warns that uninstalling deletes your configurations and settings, so export first (below). In Tunnelblick 3.8.5beta02 and later, open VPN Details, choose the Utilities panel and click Uninstall Tunnelblick…. For older versions, use the separate uninstaller from the Downloads page, and disconnect every VPN and quit Tunnelblick before you run it. Dragging the app to the Trash leaves the folders above behind.

Backing up or moving to a new Mac

The supported backup is Tunnelblick's own export:

1. Open VPN Details and choose the Utilities panel.
2. Click Export Tunnelblick Setup.
3. A compressed .tar.gz named "Tunnelblick Setup" with the date and time is saved to your Desktop.

Double-click it to expand it into a .tblkSetup file. On the new Mac, install Tunnelblick, expand the archive, and drag the .tblkSetup onto the menu bar icon. You choose which local user each user's data goes to. It carries configurations (private and shared) and Tunnelblick's settings.

It does not carry saved usernames, passwords or passphrases, which live in the Keychain. Expect to type them again on the new Mac. The export contains your VPN keys, so keep it somewhere private and delete the Desktop copy when you are done.

Your own copy of the original .tblk or .ovpn file that you installed from is a separate matter. Tunnelblick copies it in, so the original in Downloads or your VPN provider's zip can be kept as a backup or moved to another Mac.

Other files worth knowing

• Preferences: ~/Library/Preferences/net.tunnelblick.tunnelblick.plist
• The launch-at-login agent: ~/Library/LaunchAgents/net.tunnelblick.tunnelblick.LaunchAtLogin.plist
• Logs: /Library/Application Support/Tunnelblick/Logs
• The helper daemon: /Library/LaunchDaemons/net.tunnelblick.tunnelblick.tunnelblickd.plist
• Connect-at-startup entries: files in /Library/LaunchDaemons whose names begin net.tunnelblick.startup.

These are all outside the Configurations folders, so you can leave them alone when you only want to find or back up a VPN profile. Older Tunnelblick versions (3.2beta10 and earlier) used com.openvpn.tunnelblick.plist for preferences.

Why a normal search misses them

Finder and Spotlight searches leave out ~/Library and the system /Library folders, and a configuration is named by whoever made it (often your VPN provider or a server name), not "Tunnelblick". Finder can also show a .tblk as a single item (Tunnelblick's docs have you rename one to edit inside it), so the .ovpn and key files within rarely surface in its results.

Finding a profile next time

If you remember anything of the profile's name, type it into Everywhere, or type .tblk to list every Tunnelblick configuration folder on the Mac together with the folder each sits in. It covers ~/Library/Application Support and /Library/Application Support without extra setup, and it matches file names only, so it will not tell you which server a profile connects to. Press ⌘↵ to reveal one in Finder.

Common questions

Where does Tunnelblick store .ovpn configurations on a Mac?

Private ones are in ~/Library/Application Support/Tunnelblick/Configurations and Shared ones in /Library/Application Support/Tunnelblick/Shared. Tunnelblick converts an .ovpn you drop on its menu bar icon into a .tblk folder.

How do I remove a VPN configuration from Tunnelblick?

Open VPN Details, select the configuration and click the minus sign below the list. That removes the configuration and its menu entry together, which deleting files in Finder does not.

What is the difference between a Private and a Shared configuration?

Private is usable only while you are logged in, and its OpenVPN file can be edited from VPN Details. Shared is usable by anyone logged in to the Mac and has to be converted to Private before it can be edited.

How do I move my Tunnelblick setup to a new Mac?

Use Export Tunnelblick Setup in VPN Details > Utilities, expand the archive to a .tblkSetup file and drag it onto Tunnelblick's menu bar icon on the new Mac. Saved usernames and passwords are not included.