Little Snitch
Host-based application firewall
Install with Homebrew
brew install --cask little-snitchQuick Take: Little Snitch
Buy Little Snitch 6 if you need professional outbound visibility on macOS in August 2026: Tahoe support, hourly blocklists, biometric unlocks, and continuous integrity checks still beat free tools for serious privacy work. Pick LuLu when the ~€59 Single licence is the deal-breaker.
Best For
- •Privacy-conscious professionals
- •Security researchers and analysts
- •Developers debugging network behaviour
What is Little Snitch?
Little Snitch is a host-based application firewall and network monitor for macOS, made by Objective Development in Austria. It first shipped in 2002 and still focuses on outbound connections: what your apps try to send from the Mac to the internet, not the inbound traffic that the built-in macOS Firewall already covers. As of August 2026, Little Snitch 6.4.1 (build 7212, released 22 June 2026 as a hot fix after 6.4 on 21 June) is the current release. Version 6.3 (September 2025) added macOS 26 Tahoe support; 6.4 refined Tahoe menus, hourly blocklist updates, continuous app-bundle integrity monitoring, temporary unlock-until-quit for locked configurations, Touch ID for locked Control Center settings, biometric software-update authentication, and DNS4EU after the dns0.eu shutdown (Quad9 presets moved to unfiltered endpoints). It runs as a Universal Binary for Intel and Apple Silicon, requires macOS Sonoma 14.0 or later (including Sequoia and Tahoe 26), and installs as a system extension that intercepts each outgoing connection attempt with an alert naming the app, destination, and protocol. That lets you block telemetry, analytics, and other cloud chatter many apps start without asking. DNS encryption, curated blocklists, and an interactive Network Monitor with traffic visualisation keep it useful for journalists, security researchers, privacy advocates, and anyone who wants network activity to stay visible and under their control. Little Snitch Mini on the Mac App Store is the simpler sibling; the full Objective Development build adds the map, DNS encryption, blocklists, profiles, and advanced rule management. A Single licence is about €59 / ~$59-$65 (gift-card Single listed at 59 €; Little Snitch + Micro Snitch bundle at 63.49 €), with Family and Multi packs available, a full 30-day trial, and licences valid for both v5 and v6.
How Little Snitch fits into macOS networking
Little Snitch sits in the Network Extension path, so understanding that placement clarifies both strengths and limits. On Apple Silicon Macs, update only from Objective Development or the Homebrew cask, re-approve the Network Extension after major macOS upgrades (on Sequoia/Tahoe: Login Items & Extensions → Network Extensions), and export a rule backup after any large policy change via File → Create Backup in Network Monitor (XML exports version well in Git). Rules and alerts stay local; the product does not upload your connection log. License checks, optional update checks, and blocklist downloads are the only Little Snitch-originated network traffic most users see. Pair it with a VPN when you want app-level allow/deny plus tunnel encryption: Little Snitch evaluates before traffic enters the tunnel. Compared with LuLu (Objective-See, free, v4.5.x in 2026), you pay for the map, DNS presets including DNS4EU, hourly blocklists, biometric locks, and continuous app-bundle integrity checks added in the 6.3/6.4 line. Compared with Radio Silence, you get far more visibility and a steeper first-week learning curve. Hands Off! covers disk and network access more broadly but is less specialised as a pure outbound monitor. Proxyman remains the better pick for HTTP(S) API debugging, not for system-wide privacy firewalling. If an enterprise MDM forbids Network Extensions, neither Little Snitch nor LuLu will install cleanly, so check policy before buying. Impact on internet speed is minimal on modern Apple Silicon; closing the Network Monitor GUI leaves the lighter extension running. After high-profile reports of IDEs uploading large local trees even when AI features were unused, Mac developers on X again treated Little Snitch or free LuLu as default outbound visibility rather than optional extras.
Key Features
Connection Alerts & Rule Management
Whenever an app opens an outgoing connection, Little Snitch shows an alert with the app name, destination server, port, and protocol. You can allow or deny once, until quit, or permanently. Rules can target processes, domains, ports, or network ranges. Research mode watches silently before you decide; Silent Mode temporarily allows or denies everything without interrupting work. Rules are stored hierarchically and can be exported, imported, or synced across machines.
Network Monitor & Traffic Visualization
Network Monitor shows live activity on your Mac. The version 6 traffic chart maps where data is going geographically. The connection list groups live sessions by application, domain, or protocol, with volume transferred, duration, and status. Drill into a connection for full history, kill it on demand, or create a rule from what you see. Useful when debugging network issues or spotting odd outbound behaviour.
Integrated DNS Encryption
Little Snitch 6 encrypts DNS queries with DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) so ISPs and local network observers cannot easily read which hostnames you resolve. Pick a provider or point at your own DoH/DoT endpoint. It sits beside the firewall rules rather than replacing them.
Curated Blocklists
Version 6 adds curated blocklists you can subscribe to in one click: known malware domains, ad networks, trackers, analytics endpoints, and cryptocurrency miners. Lists update automatically and feed the same rule engine. That turns Little Snitch from pure monitoring into category-level blocking without writing a rule per domain.
Control Center & Menu Bar Integration
Control Center in the menu bar shows current activity, recent connections, bandwidth, and the active rule mode. Switch to Silent Mode, review recent alerts, or open common settings without launching the full Network Monitor. Optional sound notifications mark connection events. Designed to stay glanceable rather than noisy.
Web Application & Homebrew Support
Little Snitch 6 treats Safari Web Apps as separate entities from Safari itself, so docked websites get their own connection rules. Homebrew executable rules ignore version numbers in file paths, so package updates keep working without rewriting rules. Both changes track how Macs are actually used in 2026.
macOS Tahoe Hardening & Integrity Monitoring
Little Snitch 6.3 added first-class macOS 26 Tahoe support; 6.4 polished Tahoe menu icons, temporary unlock-until-quit for locked configurations, Touch ID changes to locked Control Center settings, biometric software-update authentication, and continuous app-bundle integrity checks while the app is running, not only at launch. Ghostty and other modern terminal bundle identifiers are recognised correctly.
Who Should Use Little Snitch?
1Privacy-Conscious Professional
A journalist working with sensitive sources blocks analytics and telemetry from everyday apps so work metadata does not leak to cloud services. New software starts in Research Mode; only essential destinations stay allowed. DNS encryption keeps ISP DNS logs from recording visited hostnames, and weekly (or hourly) blocklist updates catch newly listed trackers.
2Security Researcher
A security analyst installs a suspicious sample with Little Snitch set to alert on every connection. Network Monitor shows command-and-control hosts, exfiltration endpoints, and timing patterns. Connection logs export for forensics; temporary rules let them observe without permanently opening the network.
3Developer & DevOps Engineer
A backend developer watches which hosts a local stack reaches, catching misconfigured endpoints aimed at production instead of staging. Homebrew rules survive tool upgrades. During testing, Network Monitor confirms only expected destinations appear, so forgotten debug code that phones home is easier to spot.
How to Install Little Snitch on Mac
Little Snitch requires macOS Sonoma (14.0) or later, including Sequoia and Tahoe 26. Install via Homebrew (`brew install --cask little-snitch`) or the DMG from Objective Development. On Sequoia and Tahoe, approve the Network Extension under System Settings → Login Items & Extensions → Network Extensions; missing that pane is the most common false alarm that the install failed. Start in Research Mode for the first week, then promote silent observations into permanent allow/deny rules.
Download Little Snitch
Visit the official download page and download the latest version (6.4.1 as of June 2026), or use Homebrew: brew install --cask little-snitch
Run the Installer
Open the downloaded DMG file and double-click the Little Snitch installer. Follow the prompts to install the system extension. You will need to enter your administrator password.
Grant System Permissions
Open System Settings > Privacy & Security and approve the Little Snitch system extension under the 'System Extensions' or 'Allow' section. A restart may be required.
Pro Tips
- • Start in Research Mode during your first week to observe normal connection patterns before creating permanent rules.
- • Use the Network Monitor's 'Show in Finder' feature to identify exactly which application bundles are making connections.
- • Create a backup of your rules after initial configuration via File > Create Backup in Network Monitor.
Configuration Tips
Configure DNS Encryption
Enable DNS encryption in Network Monitor settings. Cloudflare, Quad9, and DNS4EU presets are available, or point at a custom DoH/DoT endpoint. This stops your ISP from logging the hostnames you resolve, and it replaces the retired dns0.eu preset removed in the 6.3-6.4 line.
Subscribe to Blocklists
Open Little Snitch Configuration → Blocklists and enable curated lists for tracking, malware, and ads. On high-risk research machines, prefer hourly updates; daily is enough for a typical personal Mac. Lists feed the same rule engine, so you do not write one rule per domain.
Set Up Silent Mode Profiles
Build Silent Mode profiles for different contexts: strict blocking during focused work, permissive during software installs, Research Mode when evaluating a new app. Switch from Control Center without rewriting your main rule set. Separate work and personal profiles keep one machine usable for both without merging policies.
Alternatives to Little Snitch
Little Snitch is the most complete outbound monitor on macOS. Other tools trade depth for price or simplicity.
LuLu
Free, open-source firewall from Objective-See (v4.5.x in 2026) with alerts, rules, profiles, and lists. No DNS encryption, traffic map, or Network Monitor polish. Best free alternative.
Radio Silence
Simpler set-and-forget outbound blocker without deep visualisation. Cheaper and quieter, less insight.
Hands Off!
Broader privacy tool covering disk and network access; less specialised as a pure network monitor than Little Snitch.
OpenSnitch
Popular Linux outbound firewall often compared in cross-platform discussions; not a native macOS peer product.
Proxyman
HTTP(S) debugging proxy for developers. Strong for API inspection, not a system-wide privacy firewall.
Pricing
Little Snitch 6 is a perpetual licence valid for both Little Snitch 6 and Little Snitch 5. Official tiers (August 2026): Single License (one user on multiple Macs OR multiple users on one Mac), Family License (one household, up to 5 computers, non-commercial only), and Multi-License packs (5× and 10×; seats equal the lower of computers or users). List pricing remains about €59 / ~$59-$65 USD for Single (gift-card Single listed at 59 €; Little Snitch + Micro Snitch bundle at 63.49 €). Licences purchased after 1 January 2024 include v6; earlier v5 licences upgrade at a reduced price. Full-featured 30-day trial available. After the trial, unlicensed installs fall back to restricted demo behaviour. A Single key transfers to a new Mac under the same licence terms; retire the old install when you stop using it.
Pros
- ✓Detailed real-time view of outbound connections
- ✓Per-app, per-domain, per-port rule control
- ✓Built-in DNS encryption without a second app
- ✓Curated blocklists for trackers and known-bad domains
- ✓Twenty-plus years of use among security and privacy practitioners
Cons
- ✗Costs more than free options like LuLu
- ✗Needs system extension approval that some workplaces block
- ✗First week of alerts takes patience while you learn your apps
- ✗Noisy until rules match your software set
Community & Support
Objective Development ships documentation, release notes, and email support. Users share rules on forums, Reddit (r/LittleSnitch), and Mastodon (@littlesnitch). Security researchers publish threat-model guides. The Help Center covers troubleshooting, and the Internet Access Policy database documents legitimate connections for many popular apps. There is no official Slack or Discord; the long-lived professional user base still produces solid discussion.
Frequently Asked Questions about Little Snitch
About the Author
Expert Tips for Little Snitch
After high-profile reports of IDEs uploading large local trees even when AI was unused, Mac developers on X again pushed Little Snitch or free LuLu as default outbound visibility, not optional extras.
On Sequoia/Tahoe, Network Extension approval lives under Login Items & Extensions; missing that pane is the most common 'install failed' false alarm.
Enable hourly blocklist updates on high-risk research machines; daily remains fine for typical personal Macs.
Related Technologies & Concepts
Related Topics
Sources & References
Fact-CheckedLast verified: Aug 9, 2026
Key Verified Facts
- Little Snitch 6.4.1 released 22 June 2026; 6.4 released 21 June 2026 with Tahoe menu polish and hourly blocklists.[cite-1]
- Single licence about €59 / ~$59-$65; gift-card Single 59 €; Snitch Bundle 63.49 €; Family and Multi seat packs available.[cite-2, cite-3]
- Version 6.3 added macOS 26 Tahoe support and DNS4EU after dns0.eu shutdown.[cite-1]
- Licences are valid for both Little Snitch 6 and Little Snitch 5.[cite-2]
- Little Snitch uses the macOS Network Extension framework for outbound filtering.[cite-4]
- 1
- 2Order License - Little Snitch
Accessed Aug 9, 2026
"Single/Family/Multi; gift card 59 €; bundle 63.49 €."
- 3
- 4
- 5Reddit: 6 months with Little Snitch 6
Accessed Aug 9, 2026
"User report on $59 single-device pricing experience."
- 6
- 7MacRumors forum: Little Snitch 6 release discussion
Accessed Aug 9, 2026
"Community discussion of features and pricing."
Research queries: Little Snitch 6.4.1 release notes; Little Snitch pricing 2026; Little Snitch macOS Tahoe