Where Does Little Snitch Store Rules?
Little Snitch encrypted rules store and backups on Mac, and the Keychain key half a backup needs.
Last updated
Little Snitch keeps rules in an encrypted proprietary store: /Library/Application Support/Objective Development/Little Snitch/configuration6.xpl (number tracks major versions). Daily backups accumulate in the same folder, restorable from File, Restore from Backup.
The store alone is half a backup. Decryption needs the Little Snitch Encryption Key in the System Keychain, so Time Machine both together or export portable JSON via File, Create Backup (.lsbackup, unencrypted, no traffic history). Per user UI prefs live separately under ~/Library. CLI access needs the Terminal permission toggle plus sudo.
Where Little Snitch stores this, by platform
/Library/Application Support/Objective Development/Little Snitch/configuration6.xpl
Encrypted rules plus filter settings (6.xpl for v6, 5.xpl for v5). Daily backups and daemon components alongside. Restore needs the System Keychain encryption key too. Portable restores via .lsbackup JSON export. Mac only.
Frequently asked questions
How do I back up Little Snitch rules for a new Mac?
Use File, Create Backup for a portable .lsbackup file, or Time Machine the support folder plus the System Keychain key. Copying the .xpl alone restores nothing without its key.
Why does the littlesnitch command say access denied?
Terminal access needs enabling under Preferences, Security, Allow access via Terminal, and most commands still need sudo. Enable both before scripting rules.
Notice an outdated path? Let us know.