How to Share and Lock NPV Tunnel Configs Safely

If you run a server and want friends, family or customers to connect, sharing a plain config is risky: anyone can copy it and pass it on. NPV Tunnel has built-in tools to control that. This guide walks through them.

Open the export screen

In the Configs tab, open the config you want to share and choose export. You will see Export Configuration with a filename field and a few decisions to make.

Decision 1: Lock this config?

• Lock it: recipients can connect, but cannot view or edit the config details. Best for sharing with people who do not need to see your server data.
• Keep it open: recipients can view, edit and share the config further. Best for your own devices or trusted co-admins.

The secrecy meter

The screen shows a meter, from low to high, that reflects how well the config is protected given your choices. It is a quick sanity check: unlocked and delivered to everyone sits low; locked and delivered to a named person sits higher.

Decision 2: How to deliver it

Specific people (public keys)

The recipient opens More → My public key in their app and sends you that key. You paste one or more recipient public keys into the Recipient public keys box. Only those people can open the file. This is the strongest option, and it replaced the old device-ID locking on iOS in version 57.0.

Passphrase

You set a passphrase. The file can then be posted anywhere, such as a Telegram channel, and only people who know the passphrase can open it. Share the passphrase through a different channel than the file.

Share link

If you run your own server, the app can give a link. The listing notes that a link handles one config at a time.

Anyone with the app

The App Store description also lists sharing a protected config with all app users, and the latest Android release notes mention "Anyone with the app" files. This is convenient for public distribution, but anyone who has NPV Tunnel can open the file, so do not use it for configs that must stay private.

Best practices

1. Prefer public-key delivery for important configs.
2. Set an expiry date or data limit when possible, so a leaked file loses value.
3. Create a separate config per person or group so you can revoke one without breaking everyone.
4. Never send the passphrase and the file in the same message.
5. Rotate credentials on your server if a file leaks.

For recipients

Import the file (see config file guide), enter the passphrase if asked and connect. If a locked config says it is expired, ask the owner for a new one.

Sharing scenarios and the best option for each

How the public key flow works step by step

1. The recipient opens More → My public key and copies or shows the key (it has a retry option in iOS 57.2 if the screen fails to load).
2. They send it to you in any chat.
3. You open the config, choose Export, set Lock it and paste their key into Recipient public keys.
4. You send the exported file. Only the key holders can open it.

Because the file is tied to a key rather than to a hardware device ID, it survives phone upgrades: the recipient just brings their key to the new device.

Revoking access

A locked file cannot be edited by the recipient, but a copy you have already given out stays valid until the credentials inside change or expire. To revoke, change the user's UUID or password on the server, or let the expiry date pass, and issue a new file.

What recent releases changed

iOS 57.0 replaced device-ID locks with public-key sharing. iOS 57.2 fixed export ordering and connection status for locked configs, and Android 124.0.37 improved config security and lets locked V2Ray configs connect on filtered networks.

Frequently asked questions

Keep reading