The spy leaves fingerprints. This reads them — free.
Zero Breach Toolkit checks Windows, Mac, Linux, Android and iPhone backups for 13,300 known spyware traces — Pegasus, Predator, Graphite, Candiru. Offline, read-only, $0, 27 languages.
Run it in 3 moves
Grab the double-click app from releases — no Python.
Press Start check — Quick 5–10 min, Standard 15–20 min.
Read the plain-words report, then save it.
| Scan | Time | Reads |
|---|---|---|
| Quick | 5–10 min | browsers |
| Standard | 15–20 min | browsers, apps, startup, file hashes |
| Full | 30 min+ | caches and more file types |
Three free upgrades after the scan
--evidence-bundle packs the report and a SHA-256 manifest into one ZIP — ready for a helpline, lawyer or police.
296 spy domains → free blocklist for Pi-hole, a router or uBlock.
Access Now Helpline is free, 24/7, 10 languages — a real human, no account.
🧰 The free after-care kit — 68 tools, every link checked
Already inside the download
- Evidence bundle —
--evidence-bundle→ one ZIP: report + JSON + summary + SHA-256 manifest. - Phone capture —
--collect-android→ pinned AndroidQF, hash-verified. - Practice mode —
--training spyware|worth-a-look|clean|cellebrite→ a fake phone, zero risk. - Minimal summary —
--share-json→ share the alarm, not your whole life. - See every check —
--describe; read “what could not be checked”. - Blocklists — hosts · dnsmasq · adblock · STIX · MISP.
- Verify the scanner — VERIFYING.md signed builds + attestations.
Second opinions
- iMazing Spyware Analyzer — imazing.com/spyware-analyzer · free iPhone scan on Amnesty indicators.
- MVT — mvt.re · Amnesty’s deep forensic toolkit.
- TinyCheck — tiny-check.com · watches what the phone sends over Wi-Fi.
- AppXpose — appxpose.app/spyware-check · free app + certificate check.
- ESET Online Scanner — eset.com · free full-engine Windows scan + removal.
- Kaspersky KVRT — kaspersky.com · free standalone cleaner.
- Microsoft Safety Scanner — learn.microsoft.com · free one-shot Windows scan.
- SnoopSnitch — F-Droid · fake towers + patch audit.
- chkrootkit — chkrootkit.org · Linux rootkit check.
- rkhunter — rkhunter.sourceforge.net · Linux rootkit hunter.
Keep the proof
- Apple backup — support.apple.com/118426 · free local backup; encrypt it.
- libimobiledevice — libimobiledevice.org ·
idevicebackup2with no Apple software. - Android bug report — developer.android.com · logcat + dumpsys, no root.
- ADB — developer.android.com/tools/adb · pull files and logs.
- sysdiagnose — Apple guide · the iPhone logs.
- HashMyFiles — nirsoft.net · hash before and after.
- iLEAPP + ALEAPP — leapps.org · parse backups + Android extractions.
- Autopsy — autopsy.com/download · disk forensics.
- Volatility 3 — github · memory forensics.
- EFF guide — ssd.eff.org · plain English on the result.
Watch the network
- Pi-hole — pi-hole.net · per-device DNS log.
- NextDNS — nextdns.io · free 300k lookups/month.
- RethinkDNS — rethinkdns.com · app firewall on Android.
- PCAPdroid — link · phone packet capture.
- abuse.ch — URLhaus · ThreatFox · MalwareBazaar · live lookup.
- Echap indicators — github · living list.
- MISP — misp-project.org · local indicator DB.
- Suricata + ET Open — suricata.io · free rules.
- Zeek — zeek.org · per-device connection logs.
- Wireshark — wireshark.org · read one connection.
- DNS leak test — browserleaks.com/dns · confirm your logger sees the device.
Close the door
- Lockdown Mode — support.apple.com/105120.
- Advanced Data Protection — 108756.
- Apple threat notifications — 102174.
- App Privacy Report — 102188.
- Android Advanced Protection — 16339980.
- Privacy Dashboard — 13530434.
- Play Protect — 2812853.
- GrapheneOS — grapheneos.org.
- Signal — signal.org/download.
- Tor Browser — torproject.org/download.
Real help
- Access Now — accessnow.org/help.
- Digital First Aid Kit — digitalfirstaid.org.
- Amnesty Security Lab — contact-us.
- Front Line Defenders — emergency contact.
- CPJ — how to get help.
- Media Defence — case support.
- UN first-hour sheet — PDF.
- FIRST team list — first.org.
- Citizen Lab — citizenlab.ca.
- Stop Stalkerware — stopstalkerware.org.
Real-world uses
- Used laptop — Ventoy · boot, scan, shut down.
- After a reset — GrapheneOS web install · re-flash a Pixel.
- Used iPhone — libimobiledevice · backup on any PC.
- Stalkerware — Coalition · save the report first.
- A parent’s phone — DFAK · plain-language questions.
- Journalist — Freedom of the Press · before and after trips.
- Newsroom — Security in a Box.
- Free check day — Data Detox Kit.
- Before/after reset —
--jsontwice, then diff. - 27 languages — releases.
A clean report is good news, not a guarantee. The free kit is how you make it count.
!