Tutorials

Step-by-Step Guides

Follow these tutorials to generate and install iOS configuration profiles with SafeClip. Each guide covers one feature from start to finish.

Beginner⏱ 3 min

How to Create a WebClip Home Screen Shortcut

Add any website to your iPhone Home Screen with a custom icon

A WebClip profile installs a shortcut on your iOS Home Screen that launches a website in full-screen mode — no browser chrome, no address bar. It looks and feels like a native app.

  1. 1

    Open SafeClip and select the WebClip tab

    Go to safeclip.online in Safari. Click the "WebClip" tab at the top of the generator — it is selected by default.

  2. 2

    Enter the website URL

    Type or paste the full URL you want the shortcut to open, e.g. https://example.com. HTTPS is required for full-screen mode on iOS 9 and later.

  3. 3

    Set a label (shortcut name)

    Enter the name that will appear beneath the icon on your Home Screen. Keep it under 16 characters to avoid truncation.

  4. 4

    Upload a custom icon (optional)

    Tap the icon upload area and choose a PNG image. Recommended size is 180×180 px. SafeClip accepts files up to 200 KB.

  5. 5

    Configure display options

    Enable "Full Screen" to hide the Safari toolbar. Enable "Precomposed Icon" to prevent iOS from adding a gloss effect to your icon.

  6. 6

    Click "Generate Configuration File"

    SafeClip builds the .mobileconfig XML entirely in your browser. No data is uploaded. You will see the generated XML appear on the page.

  7. 7

    Tap "Download" and open in Settings

    Safari will download the file and show a "Profile Downloaded" banner in the Settings app. Tap it to begin installation.

  8. 8

    Install the profile

    In Settings → General → VPN & Device Management, tap the profile name, then tap "Install" in the top-right corner. Enter your device passcode when prompted.

  9. 9

    Find the icon on your Home Screen

    The shortcut icon now appears on your Home Screen. Tap it to open the website in full-screen mode.

⚠️

You must use Safari to download and install the profile. In-app browsers (Instagram, WhatsApp, Chrome) block system-level file installation.

💡

If you see "Unsigned Profile" during installation, this is normal. SafeClip profiles are unsigned — tap Install to proceed safely.

💡

To update the icon or URL later, remove the old profile in Settings → General → VPN & Device Management, then generate and install a new one.

WebClip parameter reference →
Beginner⏱ 3 min

How to Set Up WiFi Auto-Connect

Let your iPhone join a network automatically — no password entry needed

A WiFi profile pre-configures a network so your device joins it automatically when in range. Useful for distributing office or home network credentials to multiple devices.

  1. 1

    Open SafeClip and select the WiFi tab

    Go to safeclip.online in Safari. Click the "WiFi" tab at the top of the generator to open the WiFi configuration panel.

  2. 2

    Enter the SSID (network name)

    Type the exact WiFi network name. This field is case-sensitive — "MyNetwork" and "mynetwork" are treated as different SSIDs.

  3. 3

    Choose the security type

    Select the encryption your router uses: None, WEP, or WPA/WPA2 Personal. Most modern routers use WPA/WPA2 Personal — iOS will automatically negotiate WPA3 if both sides support it.

  4. 4

    Enter the WiFi password

    Type the network password. This field is not required if Security Type is set to None.

  5. 5

    Enable hidden network (if applicable)

    If your router does not broadcast its SSID, toggle "Hidden Network" on. iOS will then actively probe for this network instead of waiting for a beacon.

  6. 6

    Confirm Auto-Join is enabled

    Keep "Auto-Join" turned on so the device connects automatically without any user action.

  7. 7

    Generate, download, and install

    Click "Generate Configuration File", tap "Download" in Safari, then open Settings to install the profile.

⚠️

Passwords are stored in plaintext inside the .mobileconfig file. Do not share the file publicly or send it over unencrypted channels.

💡

If the device does not auto-join after installation, verify the SSID matches exactly — including any spaces, capitals, or special characters.

💡

If the password changes, you must remove the old profile and install a new one. Profiles are static snapshots and do not update automatically.

WiFi parameter reference →
Intermediate⏱ 5 min

How to Configure Encrypted DNS (DoH / DoT)

Protect your browsing with DNS-over-HTTPS or DNS-over-TLS on iPhone

By default, DNS queries are sent in plain text, allowing ISPs and on-path observers to log every domain you visit. Encrypted DNS (DoH or DoT) wraps those queries in TLS so third parties cannot read or tamper with them.

  1. 1

    Open SafeClip and select the DNS tab

    Go to safeclip.online in Safari. Click the "DNS" tab at the top of the generator to open the DNS configuration panel.

  2. 2

    Choose a protocol: DoH or DoT

    From the "DNS Protocol" dropdown, select "DNS-over-HTTPS (DoH)" (port 443) or "DNS-over-TLS (DoT)" (port 853). DoH is more firewall-friendly. DoT is simpler to configure on the server side.

  3. 3

    Enter the resolver URL or hostname

    For DoH, enter the full HTTPS URL. For DoT, enter the hostname only. See the provider table below for common options.

  4. 4

    Add fallback IP addresses (recommended)

    Enter a plain-text fallback DNS IP (e.g. 1.1.1.1) in case the encrypted resolver is unreachable. This prevents a total DNS failure on poor connections.

  5. 5

    Generate, download, and install

    Click "Generate Configuration File", download in Safari, and install via Settings.

  6. 6

    Verify the DNS profile is active

    Go to Settings → General → VPN & Device Management and confirm the profile is listed. Then visit https://1.1.1.1/help in Safari to confirm your queries are encrypted.

💡

Popular DoH providers: Cloudflare → https://cloudflare-dns.com/dns-query · Google → https://dns.google/dns-query · Quad9 → https://dns.quad9.net/dns-query

💡

Popular DoT providers: Cloudflare → 1dot1dot1dot1.cloudflare-dns.com · Quad9 → dns.quad9.net · AdGuard → dns.adguard.com

⚠️

Strict ad-blocking DNS providers (NextDNS, AdGuard) may block domains some apps depend on. If an app stops working, try a less restrictive provider or remove the profile to diagnose.

💡

Requires iOS 14 / macOS 11 Big Sur or later. Older devices will ignore the DNS payload silently.

DNS parameter reference →
Intermediate⏱ 7 min

How to Set Up a VPN Profile (L2TP & IKEv2)

Configure a VPN connection on iPhone without the App Store

SafeClip supports two built-in iOS VPN protocols: L2TP/IPSec (legacy, broad router support) and IKEv2 (modern, recommended for mobile devices). The correct fields differ between protocols — read the steps carefully.

  1. 1

    Open SafeClip and select the VPN tab

    Go to safeclip.online in Safari. Click the "VPN" tab at the top of the generator to open the VPN configuration panel.

  2. 2

    Choose a VPN type: L2TP or IKEv2

    Select L2TP/IPSec if your router or server only supports the older protocol. Choose IKEv2 for better speed, stability on mobile networks, and MOBIKE support (seamless WiFi ↔ cellular handoff).

  3. 3

    Enter the Server Address

    Type the public hostname or IP address of your VPN server, e.g. vpn.example.com. For IKEv2, this should match the Common Name (CN) or Subject Alternative Name (SAN) on the server certificate.

  4. 4

    (IKEv2 only) Enter the Remote ID

    This is the identity the server presents during IKE negotiation. In most setups it is identical to the Server Address. If left blank, SafeClip defaults to the Server Address value.

  5. 5

    Enter your username and password

    These are your per-user VPN account credentials — the username and password you log in with. This is different from the Shared Secret.

  6. 6

    Enter the Shared Secret (PSK)

    The Pre-Shared Key is used for IPSec tunnel authentication. For L2TP, SafeClip Base64-encodes this value into a <data> element. For IKEv2, it is inserted as a plain string. Both methods are compliant with iOS 17+.

  7. 7

    Generate, download, and install

    Click "Generate Configuration File", download in Safari, and install via Settings.

  8. 8

    Test the connection

    Go to Settings → VPN, find your new connection, and toggle it on. If it connects, visit whatismyip.com to confirm your public IP has changed.

⚠️

IKEv2 most common failure: Remote ID does not match Server Address. Ensure both fields contain the exact same hostname, including case.

⚠️

L2TP most common failure: Shared Secret mismatch. The PSK must match exactly what is configured on the server — it is separate from your login password.

💡

Prefer IKEv2 over L2TP whenever possible. IKEv2 reconnects automatically after network changes (e.g. WiFi → 5G) without user intervention.

💡

Only one VPN connection can be active at a time on iOS. You can install multiple VPN profiles and switch between them in Settings → VPN.

VPN parameter reference →

Ready to create your profile?

SafeClip generates everything in your browser — no account needed, nothing uploaded.

Open SafeClip Generator →

Questions? Browse the FAQ · Parameter Reference