Zero Breach Toolkit 2.0.0

Fixed in 2.0.1: please use 2.0.1. The 2.0.0 programs could not open an encrypted iPhone backup and could then wrongly show a clean result.

Zero Breach Toolkit 2.0.0.

Now an app you can double-click. Version 2 runs as a normal program on Windows, Mac and Linux, with a window instead of a terminal: choose a check, press Start, and read the result in plain language. It runs exactly the same check as the terminal version, offline, and nothing leaves your computer.

Download the file for your computer

Your computer	Download	The first time you open it
Windows	zero-breach-toolkit-windows-x64.exe	Windows may say it "protected your PC". Click More info, then Run anyway.
Mac with Apple silicon (M1 or newer)	zero-breach-toolkit-macos-apple-silicon.dmg	Drag Zero Breach Toolkit to Applications and open it. macOS stops it once: open System Settings → Privacy & Security, click Open Anyway, and open it again.
Mac with Intel	zero-breach-toolkit-macos-intel.dmg	As above.
Linux	zero-breach-toolkit-linux-x64.tar.gz	Extract it and run ./zero-breach-toolkit.
Any computer with Python	zero-breach-toolkit.py	The same check in one readable file, for people who want to see exactly what runs.

The warnings appear because the programs are not signed by Microsoft or Apple. Each program is built by GitHub from this release's published source, with a public build record you can check before running it (see Verify below).

What's new

• A simple window. Quick, Standard and Full checks with rough times; progress you can follow ("Step 2 of 6: Program files"); a Stop button that keeps everything already checked; and a short "What should I do now?" list after every check.
• 27 languages. The window and the report in Arabic, Chinese, Croatian, Farsi, French, German, Greek, Hebrew, Italian, Japanese, Korean, Kurdish, Malay, Polish, Portuguese, Punjabi, Romanian, Russian, Spanish, Swahili, Swedish, Tagalog, Tamil, Telugu, Turkish, Ukrainian and English. Arabic, Farsi and Hebrew read right to left. A translated report always includes the English original.
• Signs of Cellebrite. The tool now looks for traces of Cellebrite, the phone-forensics tool police and security services use to unlock seized phones: on Android, the USB devices its hardware imitates; on iPhone, its crash traces and the identifiers of a Cellebrite computer. If your phone was taken from you, for example at a border, this can show whether someone unlocked it, or tried to. A clean result cannot prove nothing happened.
• Check your phone from the window. iPhone backups (it finds them for you and takes the password for encrypted ones), Android collections and iPhone diagnostic archives, with the step-by-step guides one click away.
• Live connections. See which programs are connected to the internet right now; any address on the spyware lists is marked. Nothing is looked up or contacted.
• Out-of-date programs. Browsers, Office, Adobe Reader, Java, archive tools and more are compared with the list of security flaws attackers are using right now (CISA) and the fixed versions in the official records. Your list of programs never leaves the computer.
• iPhone management profiles. Profiles that let someone manage your phone, read your encrypted traffic, or route it through their VPN, proxy or DNS are listed, with name, issuer and date.
• More spyware covered. About 900 new fingerprints and app names for spyware used against activists, journalists and rights defenders, including Arid Viper's Android spyware used against Palestinians, the Palestinian Preventive Security Service's spyware, and campaigns against Tibetans and Uyghurs, Togolese activists, Vietnamese and Indian human-rights defenders, and NGOs hit through Chrome in 2026 (from ESET, Cisco Talos, Meta, Volexity, Unit 42, Lookout and Amnesty International). Plus about 150 more indicators for Candiru (DevilsTongue) and Intellexa (Predator), a new Windows check for DevilsTongue, and Variston's Heliconia framework on Android. Every value was copied from its publisher and checked; old web addresses were left out on purpose, because they get re-registered by ordinary sites.
• Practice mode for trainers. Four made-up examples (spyware, worth a look, clean, and a phone seized and unlocked with Cellebrite) so people can learn to read a result before they ever need to. Nothing real is read and every output is marked as a training example.
• Faster. The program-file check is about 40% quicker and the apps check about a third quicker, with identical results.

Fixes since 0.1.15

• Android: app names listed in an app's <queries> declaration are no longer mistaken for installed apps (contributed by @BEKO2210).
• One indicator list was described as NSO's Pegasus in Mexico; Citizen Lab's report is about an intrusion campaign against Chinese-language news sites (2017). Its description is corrected.

Thank you to everyone who reported problems, tested on real machines and sent fixes, and especially to @compsudev for practice mode and @BEKO2210 for the Android fix.

Full list in CHANGELOG.md.

Verify before running

zero-breach-toolkit.py SHA-256: 56d2d5186cf372365b33f467df6b34f22cbdd10b244f033bc60c40149b131dc9

Each program: gh attestation verify <file> --repo interplains/Zero-Breach-Toolkit.

Signed with key C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. See docs/VERIFYING.md.