PureSnitch

Network monitor for Mac

Know your
Mac’s network.

See active connections and app bandwidth. Add opt-in, host-wide firewall rules. Free, open source, built for macOS.

Download for macOS Installation guide
PureSnitch Network Monitor with an app sidebar, map view, and traffic summary
Network Monitor with demo data. Live IP geolocation and per-connection byte totals are not included in v0.2.2.
v0.2.2

Lower CPU usage. More reliable traffic rates. Safer helper cleanup.

Release notes

See the connections.
Understand the activity.

Keep an eye on your Mac’s traffic from a native SwiftUI app and its menu bar companion.

Connections, by app

Browse active connections, sort and filter the monitor, and inspect the hosts associated with each process.

Bandwidth totals are measured per process.

A glance from the menu bar

Check upload and download throughput, a five-minute traffic graph, and recent activity without keeping the monitor open.

Blocking you opt into

Enable host-wide deny rules for IPv4 addresses, CIDR ranges, and ports using macOS’s packet filter.

Rules apply across the Mac, not to individual apps.

Explore DNS filtering

The experimental local proxy supports DNS over HTTPS and built-in lists from 1Hosts, OISD, StevenBlack, and HaGeZi.

Clients need manual setup. System DNS stays unchanged.

PureSnitch Rules Manager interface with rule categories, groups, and blocklists
Rules Manager with demo data. General add, import, and export controls are not implemented in v0.2.2.

Your rules,
in one place.

Search, enable, disable, and delete stored rules. Browse active, denied, temporary, and unapproved entries.

Persistent rules can be created from alerts triggered by the manually configured DNS proxy. These prompts apply to proxy requests only.

Explore the source

Get started

Install. Approve. Observe.

One universal app for Apple Silicon and Intel Macs running macOS 13 Ventura or later.

Download the app

The signed, Apple-notarized disk image is available on GitHub Releases.

Download for macOS
  1. Move to Applications. Open the DMG and drag PureSnitch into /Applications before launching it.
  2. Approve the helper. Follow the app’s banner to System Settings, General, Login Items & Extensions, then Allow in the Background.
  3. Open Network Monitor. Traffic appears once the helper is approved. Enforcement is a separate, opt-in setting.

Use Homebrew

brew tap momenbasel/puresnitch
brew trust --tap momenbasel/puresnitch
brew install --cask puresnitch

Homebrew requires the one-time tap trust step. The cask installs the signed release.

Already installed? Update with
brew upgrade --cask puresnitch

Build from source

Unsigned builds open the interface only. Helper-backed monitoring requires the signed release or your own Developer ID signing.

Before you get started.

Permissions, privacy, and the limits of the current release.

Does PureSnitch send my network activity anywhere?

The app has no telemetry, analytics SDK, or crash reporter. It fetches enabled blocklists at helper startup and on request. DNS requests go to a DoH upstream only when a client is manually configured to use the experimental proxy. There are no live IP-geolocation requests.

Why does it need a background helper?

The privileged helper reads connection activity and manages optional packet-filter rules. macOS must approve it before traffic monitoring works. Install the app in /Applications, then follow the approval banner in the app. No relaunch is needed after approval.

Can I block one app without affecting another?

No. The shipping build’s packet-filter rules are host-wide and IPv4-only. Per-process filtering requires a Network Extension build that is not distributed. DNS-proxy rules cover only requests explicitly sent to that proxy, and passive app connections are not paused for decisions.

Does it replace my system DNS or VPN?

No. The experimental DNS proxy listens on loopback and needs manually configured clients. It does not change macOS’s system resolver. Host-wide firewall rules can interact with VPN routing or other firewall rules, so check your rules with the VPN enabled.

What if I’m upgrading from v0.1.0 or v0.2.0?

Open the app and resolve the legacy firewall prompt. Decide Later preserves legacy rules unchanged. Keep On replaces them with the current supported rule set and is unavailable when that store is empty. Turn Off deliberately removes them. Read the migration details before choosing.

How do I uninstall it cleanly?

Turn Enforcement Off and choose Remove Helper in the app first. Then remove the app or run brew uninstall --cask puresnitch. Version 0.2.2 also includes cleanup safeguards for removal without that step. The root-owned rule database remains on disk; see the release notes for legacy-state details.

Open source. Open to inspection.

MIT licensed, with the app, helper, and rule engine available on GitHub.

Explore the source