What is Little Snitch?
Little Snitch watches what your Mac connects to and asks you before allowing it. When an application tries to reach the internet, the app shows a connection alert so you can allow or deny that connection, and the vendor's position is that no data leaves without your consent. Beyond the alert itself it records where connections go — server location, port, protocol and volume — groups them by app, domain or country, charts activity over up to twelve months, and lets you build rule groups and switch between profiles automatically when you join a network. It also encrypts DNS requests using DoH, DoT or DoQ. It is a paid, closed-source Mac application. It suits anyone who wants to know what their machine is saying and to whom.
Verified product facts
- Type
- firewallEditorially reviewed
- Platform
- macOS
- Apple Silicon
- Yes
- Pricing
- One-time purchaseDeveloper-stated
- Price
- USD 59(US App Store)Developer-stated
- Developer
- Objective Development Software GmbHDeveloper-stated
- Relationship to Nuanyue
- Third-party product — not published by NuanyueEditorially reviewed
- Current version
- 6.5Developer-stated
- Official website
- www.obdev.at/products/littlesnitch/index.html
Last updated . Facts marked developer-stated come from the developer and are not independently confirmed; editorially reviewed marks a Nuanyue judgement.
Key features
What Little Snitch does at a glance.
Connection alerts asking whether an app may connect out
Silent Mode
Allows new connections at first and defers the decision
Real-time view of every connection
With server location, port and protocol
Interactive traffic chart
Covering up to twelve months of history
Hierarchical grouping of connections
By app, domain or country
Rule groups, held locally or subscribed
From a remote server
Profiles
Can switch automatically when you join a network
Curated blocklists, updated daily
With support for IP-based lists
Built-in DNS encryption
Over DoH, DoT or DoQ
Identifier-based rules keyed to an app's cryptographic signature rather than its path
Command-line utility
For changing settings, exporting rules and logging events
What you can use Little Snitch for
- Finding out what an unfamiliar application sends over the network
- Blocking an app from phoning home while leaving the rest of the machine alone
- Keeping DNS queries away from the local network
- Reviewing months of connection history to spot unusual traffic
Who is Little Snitch for?
- Mac users who want to approve every outgoing connection rather than trust each app
- People who need to audit which software is contacting which servers
Who is Little Snitch not for?
- Anyone who needs an open-source firewall they can inspect — Little Snitch is closed source
- Users who want a free tool, since it is sold as a paid licence
- Windows or Linux users, as it is a Mac-only application
Limitations
- Closed source, so the firewall implementation cannot be audited
- Mac-only; there is no Windows or Linux version
- The length of the free trial is not stated in the sources Nuanyue tracks
- The minimum macOS version for the current release is not stated as a single figure; the vendor publishes a compatibility table instead
Strengths and trade-offs
What Little Snitch does well, and what to weigh before choosing it. Points marked developer-stated come from the developer’s own material and have not been independently confirmed.
Strengths
- Shows a connection alert whenever an app wants to connect, so nothing goes out without a decision.Developer-stated
- Records server location, port, protocol and data volume for each connection.Developer-stated
- Provides an interactive traffic chart covering up to twelve months of history.Developer-stated
- Encrypts DNS requests using DoH, DoT or DoQ with services such as Quad9.Developer-stated
- Identifies processes by cryptographic code signature, so rules survive an app being moved or renamed.Developer-stated
- Ships as a universal binary that runs on both Apple silicon and Intel Macs, from version 5 onward.
Trade-offs
- Costs $59 for a single licence, where some comparable Mac firewalls are free.
- Closed source, so the filtering implementation cannot be inspected.
- Version 4 does not support Apple silicon; only version 5 and later run on M-series Macs.
- Approving connections one by one is intrusive until rules have accumulated, which is why Silent Mode exists.Editorially reviewed
First-use experience
What the app asks of you when you set it up. Only established facts appear here; anything we could not confirm is left out rather than guessed at.
- Installation
- Direct download from obdev.at; the app is not distributed through the Mac App Store.
- First launch Developer-stated
- Requires installing a system extension so the firewall can filter connections; existing apps then begin raising connection alerts.
- System integration Developer-stated
- Installs a network extension and a menu bar Control Center, and can filter traffic from every process on the Mac.
- Apple Silicon
- Supported
What it does
Little Snitch answers a question macOS does not: which of the applications on your Mac are talking to the internet, and where are they talking to. It shows a connection alert the first time an app tries to connect, so the decision to allow or deny is yours rather than the developer’s. Once you have answered, rules take over and the alerts stop for that app.
Alongside the alert it keeps a record: server location, port, protocol and how much data moved, grouped by application, domain or country, with an interactive chart covering up to twelve months. That history is what turns it from a permission prompt into an auditing tool.
Rules, profiles and DNS
Rules can be organised into groups held locally or subscribed from a remote server, and profiles can switch automatically when you join a known network, so the same Mac can behave differently at home and on public Wi-Fi. Processes are identified by their cryptographic code signature rather than their file path, so a rule keeps working if an app is moved or renamed. Curated blocklists are available and update daily, including IP-based lists.
DNS is handled inside the app rather than by the system resolver: Little Snitch encrypts DNS requests using DoH, DoT or DoQ and resolves them through services such as Quad9, so the local network cannot see which sites you look up.
Licensing
Little Snitch is a paid, closed-source Mac application sold as a licence rather than a subscription. A single licence is $59 and covers one user across multiple computers or multiple users on one computer; a family licence covers up to five computers in one household for non-commercial use, and multi licences come in 5x and 10x packs. It is not distributed through the Mac App Store, and version 5 and later ship as a universal binary for both Apple silicon and Intel Macs.
Questions about Little Snitch
How much does Little Snitch cost?
A single licence costs $59. It permits one user across multiple computers, or multiple users on a single computer. A family licence covers up to 5 computers in one household for non-commercial use, and multi licences are sold in 5x and 10x packs.
Does Little Snitch run on Apple silicon Macs?
Yes. From version 5 onward Little Snitch is a universal binary that runs on both Apple silicon and Intel-based Macs. Version 4 does not support Apple silicon, because it relied on a kernel extension that Apple discontinued on those machines.
Can I try Little Snitch before buying?
The vendor offers a trial, but the length of the trial is not stated in the sources Nuanyue tracks, so it is not recorded here.Editorially reviewed
Does Little Snitch block connections or just report them?
It does both. It shows a connection alert so you can allow or deny each connection, and rules, rule groups and profiles determine what happens automatically thereafter. It also ships curated blocklists that can be activated in a few clicks.Developer-stated
Alternatives to Little Snitch
Apps that could replace this one — the same job, a different trade-off.
LuLu
Free open-source firewall for blocking outgoing connections on macOS.
Both are personal firewalls for macOS that ask before an app connects, but LuLu is free and open source while Little Snitch is a paid, closed-source product with rule groups and long-term traffic history.
Works well with
Not a replacement — apps commonly used alongside this one.
Wireshark
Open-source network protocol analyzer with deep packet inspection.
Little Snitch decides which connections the Mac may make, and Wireshark shows in detail what those connections actually carry.
Proxyman
Native macOS HTTP debugging proxy with HTTPS decryption.
Little Snitch reveals that an app is connecting and to where, while Proxyman lets you read the HTTP requests and responses behind that connection.
Links
Sources
Facts on this page are checked against the sources below. Last updated .
