To be notified of new releases, use Tunnelblick's built-in update mechanism or subscribe to the Tunnelblick Announce Mailing List.
Beta versions are suitable for most users. See Stable vs. Beta for details.
You should verify all downloads. Even though https:, the .dmg format, and the application's OS X digital signature provide some protection, they can be circumvented.
Comparing the SHA256, SHA1, and MD5 hashes of your downloaded file with the official published ones will provide additional assurance that the download is legitimate and has not been modified. You can compare the hashes with programs included with macOS without the need to install additional software.
To compute the hashes of a file you've downloaded, type the following into /Applications/Utilities/Terminal:
shasum -a 256 path-to-the-file
Then compare the computed hashes with the values shown near the link for the downloaded file.
(Don't type 'path-to-the-file' — type the path to the file, that is, the sequence of folders that contain the file plus the file name (e.g. /Users/janedoe/Desktop/Tunnelblick_3.7.2a_build_4851.dmg). An easy way to get it into Terminal is to drag/drop the file anywhere in the Terminal window. The pointer will turn into a green and white plus sign ("+"_) to indicate the path will be dropped. So you would type 'shasum -a 256 ' — with a space at the end — and then drag/drop the disk image file anywhere in the Terminal window.)
For additional assurance that the hashes displayed on this site have not been compromised, the hashes are also available in the description of each "Release" on Tunnelblick's GitHub site, which is hosted and administered separately from this site.
Verifying GnuPG Signatures
Recent Tunnelblick disk images are also signed with GnuPG version 2.
To prepare for verifying signatures, you should download and install GnuPG 2.2.3 or higher, and then add the Tunnelblick Security GnuPG public key (key ID 6BB9367E, fingerprint 76DF 975A 1C56 4277 4FB0 9868 FF5F D80E 6BB9 367E) to your trusted GnuPG keyring by typing the following into /Applications/Utilities/Terminal:
gpg --import TunnelblickSecurityPublicKey.asc.
To verify the signature of a file, download the corresponding signature file and then type the following into /Applications/Utilities/Terminal:
gpg --verify path-to-the-signature-file path-to-the-disk-image-file
The result should be similar to the following:
gpg: Signature made Sat Dec 16 19:17:03 2017 EST
These downloads have been contributed by users and usually help deal with special circumstances. They are not endorsed or checked by the Tunnelblick project, and you use them at your own risk. To contribute a download, send it to the developers or post it on the Tunnelblick Discussion Group.
Before using these scripts, please read Tunnelblick and VPNs: Privacy and Security. (Actually, everyone using a VPN should read that!)
Note: these scripts are executed as root. Instructions for using scripts.
In June 2015 there was much discussion (and outrage) about SourceForge providing downloads that contain unwanted or malicious software; SourceForge has changed their policies to help avoid this. Tunnelblick binaries were hosted on SourceForge from the fall of 2013, when Google Code stopped hosting new binaries, until 2015-07-17, when they were moved from SourceForge to GitHub.
Tunnelblick protects against unwanted software insertions by publishing the SHA1 and MD5 hashes for each of our downloads. You should verify the hashes of all Tunnelblick downloads by following the instructions above.
Additional safeguards automatically protect updates performed by Tunnelblick's built-in update mechanism: