FreeSnitch How it works Compare Source Download

See every app that talks to the internet.

A free, open-source firewall for your Mac. It shows who connects where, and asks before anything new gets out.

Download for Mac View the source

Version 1.1.0 · macOS 13 or later · Apple Silicon and Intel · Notarized by Apple

FreeSnitch Network Monitor: apps on the left, their connections on a world map, totals on the right
Discordgateway.discord.gg · allowed
Alert: Discord wants to connect to gateway.discord.gg. Allow or Deny.

Start with what you want

See who is online

Every app, where it connects, how much it sends.

Ask before apps connect

Allow or deny once, for an hour, or for good.

Block ads and trackers

Blocklists you choose, refreshed on a schedule.

Rules for every place

Stricter at the café, relaxed at home.

FreeSnitch watches every connection your Mac makes, asks before a new app reaches out, and keeps every answer on your Mac. No account, no telemetry, and every line is open source.

FreeSnitch app icon
FreeMIT licence. No account, no trial.
Alerts

Allow once, or for good.

When an app reaches somewhere new, FreeSnitch asks. Pick the host, the app or the port, and how long the answer lasts. The menu bar shows what is happening right now.

Menu bar panel: traffic graph, busiest apps, recently denied
Rules

Rules you can read.

Every rule says which app, where, and whether it is in force where you are. Pick an app from the list or drop it on the page. Blocklists and DNS over HTTPS sit next to them.

Everything it does
Rules table with app, destination, action and place
Places

Stricter at the café.

Make a place for home, work or the café, and choose how strict FreeSnitch is there. It knows where you are from the network you join, without asking for your location.

Profiles: a place, how strict it is there, and its blocklists

It fails open.

If FreeSnitch stops answering, your internet keeps working. A broken firewall never becomes an outage.

Signed and notarized.

Built with a Developer ID and checked by Apple. Updates are verified with a signature before they install.

Nothing phones home.

No analytics, no account, no licence check. It only contacts the blocklists and DNS you pick, and its update feed.

How it compares.

Between the inbound-only firewall built into macOS and the paid outbound firewalls.

FreeSnitchLittle SnitchLuLumacOS
PriceFreePaidFreeIncluded
Stops apps going outPer appPer appPer appInbound only
Live map and trafficYesYesNoNo
Rules for host, range, portYesYesSomeNo
Blocklists, DNS over HTTPSYesYesNoNo
Source codeMITClosedGPLClosed
Where it stops

Blocklists work on names

They don't stop apps that connect to a fixed address, or that look names up with their own encrypted DNS, like Chrome or Firefox with DoH on.

The map is an estimate

Locations come from offline IP data, not measurement.

Blocking is opt-in

Out of the box FreeSnitch only watches. Rules and blocklists start when you turn on Enforcement in Settings.

Install it in a minute.

Download 1.1.0 · 12.5 MB
1

Drag to Applications

Open the disk image and drag FreeSnitch into Applications.

2

Allow the helper

System Settings, General, Login Items & Extensions: allow FreeSnitch in the background.

3

Approve the filter

When macOS asks, allow the FreeSnitch system extension. It does the per-app filtering.

SHA-256 f15857e6e328936b1623cfe309c1d7a357d1150f77fbe2e24a8ed7c1650382cd