Tunnelblick Launches at Startup (Login)
This is related to VPN Details Windows Appears at Startup (Login).
Some users find that Tunnelblick runs when they don't expect it to or they don't want it to.
That is probably because Tunnelblick does not use the standard macOS "Open at Login" ("Login Items") mechanism to control its behavior. (See Why and How Tunnelblick Doesn't Use Login Items below.)
Instead, Tunnelblick is launched at login:
On other words:
To Stop Tunnelblick from Launching on Login
You cannot stop Tunnelblick from launching on login if it detects an active VPN on login or if it had previously disabled network access unless you uninstall Tunnelblick (see Why and How Tunnelblick Doesn't Use Login Items below for why).
However, you can stop Tunnelblick from launching at login solely because it was running when you last logged out. To do that, copy/paste the following in /Applications/Utilities/Terminal, then press the enter/return key on the keyboard:
To restore Tunnelblick's normal behavior, copy/paste the following, then press the enter/return key on the keyboard:
First, check to make sure you don't have a Tunnelblick "Login Item".
(Note that the checkbox next to the application name is for "hiding" the application after it launches -- it is not for making the application launch at login.)
Second, check that you do not have an active VPN:
If you see a process named "tunnelblick-helper", that indicates that a VPN is being connected. If you see a process named "openvpn", it means that a VPN is being connected or is connected.
If you don't have Tunnelblick login items, and you don't have a process named "tunnelblick-helper" or "openvpn", ask for help on the Tunnelblick Discussion Group. Please include the output of the following Terminal commands in your post (you can copy/paste; it all goes on one line):
Why and How Tunnelblick does not Use Login Items
Tunnelblick doesn't use "Login Items" because we think it is important that users are shown an indication that a VPN is active when they log in (if one is active, of course). The indication is that Tunnelblick launches, and that it displays a connecting or connected icon. A VPN may be active because a VPN configuration is set up to connect when the computer starts, or because a different user logs into the computer while another user has connected to a VPN, or because of a crash of Tunnelblick or one of its components, or for some other reason.
Login items also don't allow Tunnelblick to launch at login if it had previously disabled all network access. That's important so it can ask the user if network access should be reenabled.
To ensure that is done, the Tunnelblick installer sets up macOS to run a very short script once each time a user logs in. The script decides whether or not to launch Tunnelblick, does so if necessary, and then quits. The script has little impact on the time to startup or login (on a five-year-old MacBook Pro the script uses 0.293 seconds of CPU time and very little I/O).
Another reason Tunnelblick doesn't use "Login Items" is that most users don't have Tunnelblick in the Dock (where it is easy to make it a Login Item by clicking "Options" : "Open at Login"). Instead, they leave Tunnelblick running all the time to make it easy to connect a VPN. When there is no active VPN, Tunnelblick uses few computer resources.