PassTunnel

PassTunnel

Connect your VPN without ever typing a one-time code again.

PassTunnel is an open-source macOS app for OpenVPN, FortiGate SSL VPN, Cisco AnyConnect and Palo Alto GlobalProtect (experimental). It keeps your TOTP secret in the Keychain and fills in the current code (and your password) every time you connect.

Website · Features · Install · Quick start · Code format · Cisco AnyConnect · Palo Alto GlobalProtect · CLI · AI assistants · FAQ · Security · Project · Türkçe

---

Features

One-time codes, handled

• No more typing codes. The TOTP secret lives in the macOS Keychain; PassTunnel generates the code and sends it with your password when you click Connect. If 5 seconds or less are left in the current window, it waits for a fresh code instead of racing the clock (a setting, on by default). A code that was already sent is never sent again.
• Any format your server expects. Append, prepend, password:code, password,code, or a custom template with any literal text, or send the code separately (OpenVPN static challenge, FortiGate OTP field, Cisco AnyConnect's second password field). See Configuring the code format.
• Authenticator-style main window. The sidebar lists every profile with its state and live code; the selected one shows its code in large digits with a countdown ring, and what the server receives. Click the code to copy; the clipboard is cleared again after 1 minute (or 30 seconds, or 2 minutes, in Settings), unless you copied something else meanwhile. Codes can be hidden until you click them.
• QR import. Drop a screenshot of your provider's QR code, choose an image or paste from the clipboard, or (macOS 14 and later) scan the QR code where it is on screen, for example in your browser, without saving a screenshot. Digits, period and algorithm (SHA-1/256/512) are read from the otpauth:// link. Pasting a Base32 secret or an otpauth:// link works too.
• Auto-type (optional, off by default). With global shortcuts on, ⌃⌥C types the current code into the focused field (also in the menu bar panel), for web portals and other places that still ask for it. Needs Accessibility permission, which is only requested when you turn the feature on.
• Confirm with Touch ID (optional, per profile). Touch ID or your Mac password before connecting and before showing codes (the command line can also set it to ask before connecting only); the saved secrets are then encrypted with a key in the Mac's Secure Enclave, so a one-click connect needs you, not just your unlocked Mac.

VPN client

• OpenVPN, FortiGate SSL VPN, Cisco AnyConnect and Palo Alto GlobalProtect (experimental), using bundled, signed copies of openvpn, openfortivpn and openconnect. Nothing else to install. Cisco AnyConnect and Palo Alto GlobalProtect (password and one-time code) need macOS 15.4 or later; see Cisco AnyConnect and Palo Alto GlobalProtect.
• Menu bar panel. Every pinned or active profile with its state, live code and a switch to connect or disconnect, plus copy and type for the current code. A colored badge (five palettes) marks a profile that needs attention, with a red dot when a connection dropped unexpectedly.
• Stays connected. Optional auto-reconnect with backoff, a health check host inside the VPN, reconnect after wake, chosen profiles connected at login, and a reminder before a server-side session limit runs out.
• Several VPNs at once, each with its own status, log and settings.
• Shareable profiles. Export a .passtunnel file for your team. It never contains passwords, TOTP secrets or user names.
• Command-line tool. passtunnel connect, passtunnel code -c, --json output, stable exit codes and shell completions: the same features as the app.
• Works with AI assistants. passtunnel mcp is an MCP server, so Claude Code, Claude Desktop and other MCP clients can check your VPNs, read logs and diagnose problems. Read-only unless you allow connecting, and it never hands out passwords, secrets or codes.
• No sudoers rule, no admin password at every connect. A small privileged helper, registered through macOS's own SMAppService and approved once, runs only the VPN tools signed and shipped inside the app, with sanitized configurations. See SECURITY.md.
• English and Turkish user interface (follows your macOS language).

How it works

PassTunnel.app ──XPC──▶ PassTunnelHelper (root) ──▶ bundled openvpn / openfortivpn / openconnect

│ (code-signature checked) │ ├─ Keychain: password + TOTP secret └─ management socket (OpenVPN), └─ ~/Library/Application Support/PassTunnel log file, status ──▶ back to the app

1. You click Connect. The app reads your password and TOTP secret from the Keychain, computes the current code and builds what the server expects (for example secret123456).
2. The app hands the request to the privileged helper over XPC. The helper accepts only the signed PassTunnel app, checks that the profile folder belongs to you, sanitizes the OpenVPN config (or writes the openfortivpn config itself from typed fields) and starts the bundled tool, which it lets run only after checking the signature of the code that was actually loaded. For Cisco AnyConnect, the app signs in first (as you, not as root) and hands the helper only the resulting session cookie, which the helper uses to build the openconnect configuration itself.
3. The app follows the connection state (OpenVPN through a management socket that only your user can open, FortiGate and Cisco AnyConnect through the log) and shows it in the window and the menu bar.

The full security model, including what is *not* protected, is in SECURITY.md. The code layout is described in docs/ARCHITECTURE.md.

Install

Requires macOS 13 Ventura or later on a Mac with Apple silicon. Cisco AnyConnect and Palo Alto GlobalProtect profiles need macOS 15.4 or later; on an older macOS the rest of the app works as usual.

Download

Download the disk image, open it and drag PassTunnel to Applications. Launch it from there: the helper can only be installed from the Applications folder. The app is signed with a Developer ID and notarized by Apple. What changed is in the release notes.

PassTunnel keeps itself up to date (Settings → Updates); updates are signed and checked before they are installed. After an update, the helper is updated automatically as soon as no VPN connection is active (only when PassTunnel runs from the Applications folder).

Homebrew

brew trust passtunnel/tap

brew install --cask passtunnel/tap/passtunnel

Since Homebrew 6, casks from third-party taps load only once you trust the tap, hence the first line. The cask also links the passtunnel command. Updates arrive through the app itself, so brew upgrade leaves it alone unless you run brew upgrade --greedy.

Build from source

You need Xcode 15.3 or later (Swift 5.10, plus xcstringstool for the Turkish strings) and Homebrew, which provides the VPN tools that get bundled into the app:

brew install openvpn openfortivpn openconnect

git clone https://github.com/passtunnel/passtunnel.git cd passtunnel scripts/build-app.sh # → build/PassTunnel.app (ad-hoc signed)

build-app.sh builds a release binary, assembles the bundle, copies openvpn, openfortivpn, openconnect (Cisco AnyConnect, Palo Alto GlobalProtect) and their libraries in (scripts/bundle-tools.sh, with their license files), compiles the helper with the code-signature hashes of exactly these tools and libraries, and signs everything inside-out with the hardened runtime. An ad-hoc build signs the app without library validation: an ad-hoc signature has no Team ID, so macOS would otherwise refuse to load Sparkle.framework into it.

[!IMPORTANT]

The helper only talks to an app, and only runs tools, signed with the project's Developer ID Team ID.

An **ad-hoc build is fine for the window, codes, QR import, profiles and the CLI, but cannot

connect**. To connect with your own build, set teamID in

Sources/PassTunnelShared/Identifiers.swift to your

Team ID and sign with your certificate:

`sh

scripts/build-app.sh --sign "Developer ID Application: Your Name (TEAMID)"

`

Then move build/PassTunnel.app to /Applications before installing the helper.

Quick start

Without any profile, the window opens on Add your first VPN:

1. Install the helper. The card at the bottom explains what it is for. Click *Install Helper*, then turn PassTunnel on in System Settings → General → Login Items (macOS asks once). You can also do this later from Settings → Helper.
2. Add a VPN. Drop a file on the dashed area, or pick one of the other ways in.

Add a profile

Click + at the bottom of the sidebar (the same view, titled Add a VPN), or drop a file onto the window. The File menu has the same items:

| A Cisco AnyConnect server | Enter details by hand, choose Cisco AnyConnect (File → New Cisco AnyConnect Profile…), then paste the address your IT team gave you, for example `https://vpn.example.com/sta