README

Zero Breach Toolkit

 Version 2 is out: now a double-click app for Windows, Mac and Linux, in 27 languages.
 Download it from the latest release.

A free, open-source check for traces of known mercenary spyware (Pegasus, Predator,
Graphite, Candiru and others) on computers, Android phones and iPhone backups.

- Read-only. It does not modify source evidence or system settings. It writes only
  temporary database snapshots and the reports you ask for.
- No network requests during a scan. It never looks up spyware addresses and has no
  upload feature. Python network calls are blocked and redirected paths are refused. This
  is not an operating-system network sandbox; see PRIVACY.md.
- States its limits. Every report says what was found, how strong the evidence is, and
  what could not be checked. A clean result is never presented as proof that you are safe.

Made by archivegenocide. Built on Zero Breach.

 If you think you are being targeted right now, get expert help first. You do not
 need to run this tool before asking. Journalists, activists, human-rights defenders and
 civil society can contact the
 Access Now Digital Security Helpline (free, 24/7,
 many languages) or Amnesty International's Security Lab.

---

 Easiest: download the program (no Python, no commands)

You do not need to know anything technical to use this. Download one file from the
latest release, open it,
and follow the window. You do not need the source code on this page, and you do not need to
type any commands.

Once it is open: choose a check, press Start check, and read the result. It tells you in
plain words whether anything was found and what to do next. You can save the report if you
want to keep it or show it to someone helping you.

Which check? Use Standard unless you have a reason not to: it covers browsers, apps,
startup items, program files and out-of-date programs (usually 15 to 20 minutes). Quick looks
at browsers only (5 to 10 minutes). Full adds web caches and more file types (30 minutes or
more). You can press Stop at any time and keep what has been checked so far. To check a
phone, choose A phone in the window; the guides there explain what you need first.

A green result is good news, not a guarantee. It means this check found none of the published
traces it looks for, in the places it could read. It cannot find spyware nobody has published
traces of, and it does not prove a device is safe. If you think you are being targeted, ask a
digital-security helpline even if the result is green.

Your antivirus may flag these programs. Antivirus products often wrongly flag new programs that are not code-signed yet, and some flag these. If you downloaded the file from the official release page, this is a false alarm and you can ignore it: the code is public, and each program has a public build record you can check. We have applied for free code signing and will report these false alarms to the antivirus companies. If the file came from anywhere else, do not run it 

Top issues

Latest release

Zero Breach Toolkit 2.0.4. Fixes from real Mac and Windows runs. Thanks to the people testing it.

If you are on 2.0.0 to 2.0.2, please update, and if the window showed a phone as green, check it again: those versions could say more than the check had done (2.0.3 fixed that).

Mac

- No more false "macOS is out of date" warning. A date in a vulnerability record was being read as a version number, so every current Mac got it. Thanks to s3ba-b for finding it.
- Safari folders that macOS refuses now give the plain privacy message, and the Full Disk Access advice is left out when access is already