Common questions about generating and installing iOS configuration profiles with SafeClip.
A .mobileconfig file is an XML-based Apple Configuration Profile. It lets you push settings — like WiFi passwords, VPN servers, or DNS resolvers — directly into iOS/macOS system settings without manual entry. Think of it as a one-tap settings installer for Apple devices.
No. SafeClip generates unsigned profiles that anyone can install for free. An Apple Developer account ($99/year) is only required if you want to sign profiles with a trusted certificate so iOS does not show the "Unsigned Profile" warning.
Completely safe. SafeClip uses 100% client-side generation — all profile XML is built inside your browser using JavaScript. No passwords, URLs, or configuration data are ever transmitted to any server. You can even use SafeClip offline after the page loads.
The generator itself works in any browser. However, .mobileconfig profiles are an Apple-only format — they can only be installed on iPhone, iPad, and Mac. Android and Windows do not support this format.
Download the .mobileconfig file in Safari or any browser, then double-click it. macOS will open System Settings → Privacy & Security → Profiles. Click "Install…" and enter your administrator password to confirm.
A WebClip profile installs a shortcut directly on your iOS Home Screen with a custom icon, exactly like a native app. Unlike Safari bookmarks, WebClip icons can launch in full-screen mode, bypassing the browser UI. The icon is permanent and survives browser data clears.
Verify that 'Remote Address' and 'Remote ID' fields match exactly — most IKEv2 servers require both to equal the server's domain name or IP. Also confirm your Shared Secret and user credentials match the server configuration.
The Shared Secret (PSK) is the pre-shared key used for IPSec tunnel authentication — it is separate from your user login password. Ensure the PSK matches exactly what is configured on your VPN server, including case.
This usually means the plist XML is malformed. Do not manually edit the downloaded file. Return to SafeClip, re-enter your settings, and generate a fresh file. SafeClip is optimised for iOS 16 and later.
The VPN server likely does not have IP forwarding (NAT) enabled, or is missing a default route. On the SafeClip side, ensure 'Override Primary' is enabled in the L2TP settings so all traffic is routed through the tunnel.
Yes. A .mobileconfig file is a plain template with no device binding. AirDrop, email, or iCloud Drive the file to each iPhone, iPad, or Mac and install it on each.
L2TP/IPSec is a legacy protocol with broad router support. IKEv2 is the modern standard — it is faster, supports MOBIKE (seamlessly switches between WiFi and cellular), and is more battery-efficient. Choose IKEv2 if your server supports it.
Check that the SSID matches your router name exactly — WiFi names are case-sensitive. Also confirm 'Auto Join' was enabled when you generated the profile.
Yes. Enable the 'Hidden Network' toggle when generating your WiFi profile. iOS will then actively probe for the SSID instead of waiting for a broadcast.
Yes. Profiles are static snapshots. Remove the old profile in Settings → General → VPN & Device Management, generate a new one with the updated password, and reinstall.
iOS shows this when 'Private WiFi Address' (MAC randomisation) is active. It is a normal iOS privacy feature and does not indicate a problem with your profile or network security.
No. The profile only governs the specific SSID. When you leave range, iOS automatically falls back to 5G/LTE as normal.
Standard DNS queries travel in plain text, allowing ISPs, coffee-shop routers, and other observers to log every domain you visit. DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) encrypt those queries so third parties cannot read or manipulate them.
Popular privacy-focused providers include Cloudflare (1.1.1.1 — https://cloudflare-dns.com/dns-query), Google (8.8.8.8 — https://dns.google/dns-query), and Quad9 (9.9.9.9 — https://dns.quad9.net/dns-query). For ad-blocking, try NextDNS or AdGuard DNS.
Strict DNS providers block ad or tracking domains that some apps depend on. Remove the profile temporarily to confirm; if the app works again, switch to a less aggressive DNS or whitelist the affected domain in your DNS provider dashboard.
No. Profiles are read once at install time and stored as native system settings. They do not run background processes or consume CPU, and have zero measurable battery impact.
You can install multiple profiles, but iOS enforces a single active VPN and a single active DNS configuration at a time. Switch between them in Settings → VPN or Settings → General → VPN & Device Management.
After downloading, open the Settings app. A 'Profile Downloaded' banner will appear near the top. Tap it to begin installation. If you dismissed it, go to Settings → General → VPN & Device Management.
In-app browsers (Instagram, WhatsApp, WeChat, TikTok) block system-level file installation. Copy the SafeClip URL and open it in Safari. Look for a 'Open in Safari' option or paste the link into Safari manually.
This is usually a name conflict or a stale cache. Go to Settings → General → VPN & Device Management, remove any profile with the same name, restart your iPhone, then try installing the new profile again.
iOS does not support in-place profile updates. Remove the old profile (Settings → General → VPN & Device Management → select profile → Remove Profile), generate a fresh one in SafeClip with your new settings, and reinstall.
No. For security, iOS does not expose profile credentials after installation. Always keep a separate record of your passwords.
For personal use, share the .mobileconfig file via AirDrop, iCloud Drive, or email. For enterprise deployments, consider Apple Business Manager (ABM) or a Mobile Device Management (MDM) solution such as Jamf or Mosyle to push profiles over the air at scale.
Still have questions?
Try generating a profile on the homepage — all generation happens locally in your browser, so it's always safe to experiment.