OpenVPN for your Mac's menu bar, code included.

Burrow connects in one click and types the one-time password for you, or asks for it each time. OpenVPN 3 runs inside its own network extension: no Tunnelblick, no root helper.

Download for Mac View on GitHub

Apple silicon and Intel · Notarized by Apple

Tue 9:41

One-time passwords

The code, typed for you

Give Burrow your authenticator's setup key, or a picture of its QR code, and it computes the same six digits as your phone. One click on the power button sends your password and the current code together.

Every sign-in gets a fresh code. A code is never sent twice: with less than three seconds left, Burrow waits for the next one and counts down. If the server says no, it tries once more, then stops, so a typo can't lock your account.

Rather keep two real factors? Choose Ask me for the code: a small window takes the code from your phone. It's the recommended mode, and the one new configurations start with.

Burrow's settings for a configuration: account, one-time password mode and setup key

The sign-in window asking for the one-time password

Routing

Same addresses at home and at the office? Fine.

When your Wi-Fi at home uses 192.168.1.x and so does the office behind the VPN, macOS sends it all to your router and the company servers disappear. Burrow spots the clash, finds the devices on your own network, keeps those local and sends every other address of the range through the VPN.

It looks again every ten minutes and whenever you change networks. Want a server always through the tunnel, or a range always local? Tick it in Choose Routes…, by address or by name.

The routes table: a range shared with the Wi-Fi network set to Auto, VPN routes and servers added by name

Sign-in

Works the way your VPN signs in

Burrow runs OpenVPN 3 in its own network extension and handles the sign-ins it offers, from a plain password to a page in your browser.

Username and password
Password + one-time code
Certificate
Encrypted private key
Static challenge
Dynamic challenge (SMS, RADIUS)
Web sign-in (SSO)
PKCS#12 certificate
HTTP proxy login
Session tokens

Not supported: certificates on a smart card or in the macOS keychain (PKCS#11), and static-key configurations, which OpenVPN 3 dropped.

Details

Made to stay out of your way

Reconnects by itself

After sleep, a network change or a server restart, a 1-click configuration signs in again with a fresh code. The others ask you with a notification.

Secrets stay in the keychain

Passwords, keys and setup keys are keychain items. The tunnel holds them in memory only: never on disk, never in a log.

Moves over from Tunnelblick

Imports your Tunnelblick configurations with their saved logins, or any .ovpn file with the certificates and keys next to it.

No root helper

The tunnel is Burrow's own network extension, which you allow once in System Settings. No kernel extension, no privileged helper tool.

Signed, notarized, up to date

Notarized by Apple. Updates are checked against their signatures before Sparkle installs them.

Open source

Licensed under the AGPL-3.0, with the complete source code published next to every release.

Install

Connected in a couple of minutes

Download

Open the disk image and drag Burrow to your Applications folder.
Allow the VPN

On first launch, turn Burrow on in System Settings › General › Login Items & Extensions.
Add your VPN

Import from Tunnelblick or open the .ovpn file from your company, then click the power button.

Download for Mac

macOS 15 or later · Apple silicon and Intel · User guide

FAQ

Questions

Is it safe to let Burrow generate the code?

It's convenient, but it isn't two-factor any more: the setup key sits on your Mac next to your password, so anyone using your unlocked Mac can connect. Use it only on a Mac you alone use, with FileVault on, and check that your VPN's policy allows it. Otherwise choose Ask me for the code.

Which VPNs does it work with?

Any OpenVPN server you connect to with an .ovpn configuration, over TLS 1.2 or later. Burrow doesn't support certificates on a smart card (PKCS#11) or static-key configurations.

Do I still need Tunnelblick?

No. Burrow imports its configurations and works without it. Quit Tunnelblick before you connect with Burrow: two tunnels with the same routes get in each other's way.

Why isn't it in the Mac App Store?

OpenVPN 3 is licensed under the AGPL, which doesn't fit the App Store's terms. Burrow is signed with Developer ID and notarized by Apple instead.

How do updates work?

Choose Check for Updates… in the panel, or let Burrow check automatically. It downloads the new version, verifies its signatures, replaces itself and relaunches. The VPN drops for a moment while it restarts.

Where do my passwords go?

Into your Mac's keychain, unless you'd rather type them each time. Burrow has no account, no server of its own and no analytics: it talks to your VPN, and to GitHub when it checks for updates.