Little Snitch

Little Snitch is a network monitor and application firewall for macOS. It helps privacy-conscious users, developers and administrators understand which programs connect to which servers and decide whether those connections should be permitted.

Features

• Allow or deny application connections by destination, domain, port or protocol.
• Review network activity in a connection list, traffic chart and geographic map.
• Use connection alerts or Silent Mode and review new activity afterward.
• Organize rules in profiles and rule groups, including automatic profile switching.
• Subscribe to blocklists and remote rule groups, and use configured encrypted DNS.
• Inspect rule usage and manage supported settings through a command-line utility.

A map location is an estimate of a server's location, not proof of who operates it or where all processed data ultimately travels. Silent Mode can initially permit connections, so understand the chosen mode before relying on blocking.

Installation and requirements

Download the official DMG and follow the installation assistant, or use brew install --cask little-snitch. Little Snitch 6.5 requires macOS 14 Sonoma or later and supports both Intel and Apple silicon Macs as a universal binary. The official version-specific DMG is 38,377,961 bytes, confirmed by HTTP HEAD; retained traffic history and configuration require additional storage. Older macOS hosts need an appropriate legacy release rather than the current cask.

The firewall uses a macOS network system extension that must be approved. The publisher also documents an Endpoint Security extension and its relevant authorization, including Full Disk Access in applicable setups; follow the installed version's assistant and grant access to the named component rather than unrelated applications. Managed Macs may need an administrator's system-extension policy. Changing network filtering can affect VPNs, DNS tools and other network extensions, so test organizational configurations deliberately. No named cask conflict is declared, which is not a guarantee that every network utility combination is compatible.

License, accounts and connectivity

Little Snitch is proprietary commercial software activated with a license key. The official trial runs its protection in three-hour demo sessions that can be restarted, while Network Monitor expires after 30 days. Purchase and upgrade eligibility depend on the publisher's license terms. A local firewall rule does not require a hosted Little Snitch account to make each decision; licensing, software updates, geolocation updates, subscribed lists and encrypted DNS services can require network access. DNS providers and remote rule-list operators are additional parties whose policies should be considered.

Practical cautions

An overly broad deny rule can break legitimate applications or your internet connection. Keep a known recovery path, preserve rule backups and test a new profile before depending on it. Do not equate encrypted DNS with a VPN or anonymous browsing; applications can still reveal information in permitted connections. Review rule subscriptions before trusting third-party lists. Traffic inspection can expose sensitive hostnames and activity on screen.

The publisher specifically warns to install version 6.5 before upgrading to macOS 27 Golden Gate, because earlier Little Snitch versions are incompatible and could break internet connectivity. For removal, use the publisher's supported Finder/system-extension procedure; deleting only files through a generic cleanup tool may leave extensions behind.

Sources: Official features, Official downloads and trial terms, Official support and permissions, Official release notes.