Download Little Snitch for Mac

In the edit

Little Snitch runs on any Mac with macOS 14 or later, both Intel and Apple Silicon. That covers most machines still getting system updates, so compatibility is rarely a question.

If you already use a handful of security tools on your Mac — a VPN, an ad blocker, maybe something that checks for outgoing connections — Little Snitch sits alongside them without fuss. It watches every connection attempt an app makes and asks what to do. You can allow it once, deny it for good, or set a rule that remembers your choice. The Network Monitor shows live traffic so you can see what’s phoning home and when.

Background apps caught phoning home

• Keeping an eye on background apps that talk to servers without asking
• Setting permanent rules for apps you trust (or don’t)
• Scripting firewall behaviour through the command-line tool
• Seeing traffic volume per process in real time

Experimental NAT64 and encrypted DNS updates

• Version 6.5 adds experimental NAT64 support and encrypted DNS improvements
• App bundle integrity monitoring runs while the app is active
• Inbound connections no longer use hostnames in the display
• Interface is in English or German

Why nothing happens after installing it

The most frequent hiccup with Little Snitch comes right after installation: nothing happens. You expect a flood of alerts, but the Mac stays quiet. That usually means the filtering engine hasn't been enabled properly, or the previous version left a rule set that blocks the new one. The cleanest fix is to remove the old version entirely before installing — the instructions say so for good reason. If you skipped that step, uninstall, reboot, and reinstall.

Another one: you allow an app once, then realise later that it connects far more often than you expected. The rule is already saved, so Little Snitch no longer asks. Head into the rules list, find that entry, and change it from "Allow" to "Ask" or "Deny". It takes a moment but saves you wondering what an app is up to.

People also get tripped up by Quiet Mode. They turn it on during a presentation or a screen recording, forget about it, and wonder why no alerts appear for days. Quiet Mode postpones everything — it doesn't block or allow permanently. Check the menu bar icon; if it shows a muted symbol, you're still in Quiet Mode. Switch it off and Little Snitch goes back to asking.

If the world map in the Network Monitor looks empty or only shows local addresses, check that your Mac has an active internet connection. The map needs live traffic to populate. Also, encrypted DNS handling got an improvement in version 6.5, so if you use DNS over HTTPS or DNS over TLS, the app should recognise those connections more reliably now.

Elena's font tool licensing crisis

Elena manages a small design studio with six Macs. She sets up Little Snitch on each machine to control which services can phone home. One afternoon, a licensing server for a font tool changes its IP address. Every designer suddenly gets an alert for an unknown server. Elena uses the command-line interface to update the rule across all machines remotely, without walking to each desk. The script-based support means she can push changes in minutes, not hours. For her, Little Snitch is less about curiosity and more about maintaining a predictable network environment for the team.

System admins who manage multiple Macs

Little Snitch suits anyone who wants to know what their Mac is doing when they aren't looking. But three groups tend to benefit most:

• System administrators who manage multiple Macs and need centralised control over outbound traffic. The command-line tool lets them script rules and apply them across machines.
• Privacy-conscious users who run a VPN and want to verify that no app bypasses it. Little Snitch shows every connection, so you can spot leaks quickly.
• Developers working on networked apps. They can monitor exactly which servers their software contacts during testing, and use the traffic history to debug unexpected calls.

For anyone else, it's still useful — but if you rarely install new software or only use Apple's built-in apps, you might not see many alerts. Little Snitch earns its place when you regularly add third-party tools and want to check their behaviour.

Why denying everything breaks your apps

The biggest error is denying everything out of caution. Some apps need internet access to function — think of license verification, auto-updates, or cloud sync. If you block all connections, the app may refuse to launch or silently fail. A better approach: let the connection happen once, then decide based on what the app does. If it's a photo editor checking for updates, that's fine. If a calculator app connects to an ad server, deny it.

Another common mistake is never reviewing the rules list. Over time, it fills up with temporary allowances and forgotten decisions. That list is worth scanning every few weeks. Version 6.5 fixed a bug where expired temporary rules didn't show under Suggestions > Expired, so check that section manually to clean up old entries.

Beginners also forget that Little Snitch doesn't replace a firewall. It controls outbound connections, not inbound ones. macOS has its own inbound firewall built in. Use both for full coverage.

And a small one: the label changed from traffic amount to traffic volume in version 6.5. If you're used to looking for "amount", it's now called "volume". Same data, different name.

Works alongside a VPN without conflict

Little Snitch works alongside a VPN without conflict. The VPN encrypts and routes your traffic through a remote server, while Little Snitch watches which apps initiate those connections. If an app tries to connect outside the VPN tunnel, you'll see it in the alert. That combination is useful for anyone who wants both privacy and visibility.

It also plays well with ad blockers and content blockers in your browser. Those tools filter what the browser loads. Little Snitch catches what the browser's background processes do — telemetry, update checks, analytics pings. Together, they cover different layers of the same problem.

macOS itself includes some network logging tools, like the firewall in System Settings and the Network utility. But those are either inbound-only or hard to read. Little Snitch gives you a live list of outbound connections, a world map, and an hourly traffic graph — all in one window. It doesn't replace the system firewall; it adds the outbound visibility that Apple leaves out.

For users who script their workflow, the command-line interface integrates with shell scripts, launch agents, or configuration management tools like Ansible. You can export and import rule sets, which makes setting up a new Mac faster. That's not something you get from the built-in macOS firewall.

Version 6.5 also includes experimental NAT64 support, which helps with networks that use IPv6-only and translate to IPv4. If you work in an environment with that setup — some corporate or carrier-grade networks do — Little Snitch can handle the translation layer experimentally. It's not turned on by default, but it's there if you need it.

App bundle integrity monitoring is another new addition in 6.5. While Little Snitch runs, it checks that the app bundle hasn't been modified. If something changes inside the package — maybe from a malware injection or a corrupted update — you'll get a notification. That's a layer of protection that works alongside macOS's own code signing and notarisation checks.

For photographers who use Little Snitch to keep their editing suite in check, the combination is straightforward: let Adobe or Affinity apps connect for license checks and cloud sync, block everything else. The Network Monitor shows you exactly which processes are active, so you can make informed rules instead of guessing. It's one of those tools that becomes invisible once it's set up right.

New this release

• Compatibility with macOS 27 Golden Gate
• Monitors app bundle integrity while running
• Experimental NAT64 implementation (RFC 6052)
• Improved encrypted DNS handling

Mac it needs

• macOS 14 or later
• Intel or Apple Silicon
• Interface languages: English, German
• Activation included