Zero Breach Toolkit 3.0.2

Zero Breach Toolkit 3.0.2.

3.0.2 fixes what the first testers found. The window fits small laptop screens; on a Mac a folder that waits for permission no longer holds the check; the household report is saved privately and practice examples are labelled as such; a message with no link now warns never to share a login code; and more. If you have 3.0.0 or 3.0.1, use this one. Full list in the CHANGELOG.

More than a spyware check. Version 3 still looks for known spyware, and now also shows the ways in that are left open on your devices and how to close them, checks the links, emails, files and QR codes people send you, and walks you through your accounts, your home network and the trackers and hidden networks around you. Everything runs on your own computer, and nothing leaves it unless you say yes.

Download the file for your computer

Your computer	Download	The first time you open it
Windows	zero-breach-toolkit-windows-x64.exe	Windows may say it "protected your PC". Click More info, then Run anyway.
Mac with Apple silicon (M1 or newer)	zero-breach-toolkit-macos-apple-silicon.dmg	Drag Zero Breach Toolkit to Applications and open it. macOS stops it once: open System Settings → Privacy & Security, click Open Anyway, and open it again.
Mac with Intel	zero-breach-toolkit-macos-intel.dmg	As above.
Linux	zero-breach-toolkit-linux-x64.tar.gz	Extract it and run ./zero-breach-toolkit (add --gui for the window).
Any computer with Python	zero-breach-toolkit.py	The same check in one readable file, for people who want to see exactly what runs.

The warnings appear because the programs are not yet signed by Microsoft or Apple. Code signing is on its way: the project has been accepted by the SignPath Foundation and the certificate is being issued. Until then, each program is built by GitHub from this release's published source, with a public build record you can check before running it (see Verify below).

What's new

• Doors to close. Every check now lists the ways in that are left open - Remote Desktop, automatic sign-in, no disk encryption, Secure Boot off, browser extensions that can read every site, no ad blocker, an iPhone without a passcode, old Android security updates - each with why it matters and how to close it. "Close the doors found open" can switch some of them off for you, one at a time, after asking, with a way back.
• Check what you were sent. Paste a text, WhatsApp or Signal message or a link; open a saved email; choose a suspicious file or a picture of a QR code. The toolkit says what it really is and whether it matches known spyware or common tricks, without opening, running or following anything. A file can also be looked up online, only if you say yes.
• Was my phone copied? For a phone that was taken from you, for example at a border: signs that it was plugged into a phone-forensics tool such as Cellebrite. Finding nothing is not proof, and the report says so.
• Check your online accounts. A guided list of where to look - devices linked to WhatsApp, Signal, Telegram, Apple, Google and Microsoft, email forwarding, location sharing, a lock on your phone number - starting with the single best thing you can do: sign in with a physical security key. Your answers are kept until you finish.
• Your home and what is around you. Who is on your Wi-Fi and which doors their devices leave open (it asks first); hidden Wi-Fi networks nearby, what each one probably is, and on Windows and Linux a meter that follows one network's signal so you can find the device; Bluetooth trackers such as AirTags that stay near you.
• Look closer at a computer. What starts automatically, explained entry by entry; Windows' own records of hidden commands, downloads that were run and protection switched off; a network recording from a phone, with which company runs each address contacted.
• Live connections, explained. A "Who runs it" column (Google, Microsoft, Cloudflare, Meta, Apple, Amazon and more, from a list built into the program) and a right-click for the program behind each connection, when it started and what started it.
• One report for the household. Put the saved results of every computer, phone and check on one page, worst first, with a list of what has not been checked yet.
• Plain words first. Every result opens with a few lines in plain words: what was found, what it means, what to do. "Not sure where to start?" asks what happened and opens the right check. One button sends the result to someone who can help.
• Every tool in 27 languages. The results of all the smaller tools are now translated too, not only their buttons. Saved results stay in English, the record a helpline works from.
• A friendlier terminal. Choose from the menu with the arrow keys (or type the number), with one progress line and the result in colour.
• More spyware and more programs recognised. 14 mercenary spyware indicator lists built in so they work offline, 9,014 malicious browser extensions, 2,211 vulnerable or malicious drivers, 200+ remote-access programs, and better reading of iPhone backups from iOS 27.

Fixes since 2.0.7

• A "worth a look" result no longer looks like a clean one, and Windows' own built-in event-log subscription is no longer reported as an attack.
• iPhone backups from iOS 27: installed apps, newer diagnostic reports and large Shortcuts are read again (reported by Natha, #47).
• The doors tool and the report now agree on how many doors are open.
• Saving over an existing file, a damaged picture and an empty option now give a clear message instead of an error.

Thank you to everyone who reported problems and tested on real machines, especially Natha, Verchiel666 and dhruv1220.

Full list in CHANGELOG.md.

Verify before running

zero-breach-toolkit.py SHA-256: 0b6df5f02c6b13256b735bfb55c1ef0a31ff0c762550910be9f66b4f5090dafb

Each program: gh attestation verify <file> --repo interplains/Zero-Breach-Toolkit.

Checksums and signatures: import the signing key from this release's files first, then verify.

gpg --import archivegenocide-signing-key.asc
gpg --verify SHA256SUMS.txt.asc SHA256SUMS.txt

Signed with key C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. "This key is not certified with a trusted signature" is normal: it only means you have not signed the key yourself. See docs/VERIFYING.md.