Skip to content
Every app

No icon yet — a stand-in

macOS · Menu bar

Canary

Hear that your email turned up in a breach from your own Mac, not from a stranger's login

Source only
View sourceNotify me

About Canary

Canary is built to check, on a schedule, whether your email addresses or passwords have turned up in a known breach. Passwords go through Have I Been Pwned's k-anonymity range API, so only the first five characters of the password's hash ever leave your Mac; an email check sends the address to Have I Been Pwned (with your own API key) and to XposedOrNot. It is also meant to watch the DNS records behind your domains and flag a change, which is how a hijack usually announces itself — that part is not working yet. Passwords are held only as SHA-1 hashes inside an encrypted store, and the menu bar bird fills in when something is exposed. Findings export as a PDF report.

Who it's for

Security-conscious users who want proactive breach monitoring without cloud services.

What it does

  • Email and password breach checks via HIBP v3 API
  • Password checks by k-anonymity — only a 5-character hash prefix is sent
  • DNS change alerts for your domains (not working yet)
  • Paste site monitoring for email exposure, with your own HIBP API key
  • Passwords stored as SHA-1 hashes only
  • Encrypted result storage in SQLite
  • PDF export of all findings

Behind the build

The k-anonymity implementation was critical to get right.

For password checks, Canary SHA-1 hashes the password, sends only the first 5 hex characters to HIBP's /range endpoint, then checks whether the full hash appears in the roughly 2,000 suffixes that come back — all locally. A temporary copy of the password's bytes is zeroed after hashing, though the typed text itself stays in memory. DNS monitoring is meant to baseline records on first scan and diff every later check, but its resolver frees its buffer on the first answer and reads it again for the next, so any domain with more than one record crashes it.

The full write-upCheck a password against Have I Been Pwned without sending it

Information

Runs on
macOS · Menu bar
Status
Source only
Requires
macOS 14+
Source
Public on GitHub
Telemetry
None
Built with
Swift & SwiftUI
Stack
SwiftUIURLSessionCryptoKitSQLiteSecurity Framework

Works well with

  • Sentry

    Canary monitors breach exposure, Sentry monitors live network connections

  • Deadbolt

    Canary alerts you to compromised credentials, Deadbolt locks sensitive apps

Canary is source only, for now.

The code is public, but there's no packaged release yet. Build it from the repository today, or leave an email and hear when there's one you can double-click.

Tell me when it shipsView source

More menu bar apps

See all 30

  • Ghostmark

    macOS · Menu bar

    Share your screen with your name and today's date tiled across it, so a leaked frame points home

    Available

  • Afterburn

    macOS · Menu bar

    Start a long build and everything else steps out of the way until it has finished

    Source only

  • Aware

    macOS · Menu bar

    Glance at the menu bar and see how long you have actually been at the screen today

    Source only

  • Carbon

    macOS · Menu bar

    See which app is drawing the most power right now, and what that costs in carbon

    Source only

  • Catch

    macOS · Menu bar

    The banner slid away before you read it — Catch keeps every notification so you can go back

    Source only

  • ChimeTime

    macOS · Menu bar

    Notice it is 6pm and not 9pm — every hour arrives as a chime and a panel from the notch

    Source only

  • ClipShelf

    macOS · Menu bar

    The thing you copied three copies ago, back at your cursor without leaving the app

    Source only

  • Deadbolt

    macOS · Menu bar

    Hand someone your Mac without handing over Messages — the apps you pick ask for Touch ID

    Source only

  • Drip

    macOS · Menu bar

    Know how much hotspot data is left while you can still do something about it

    Source only

  • EchoType

    macOS · Menu bar

    Find the paragraph you typed into a box that lost it, encrypted and searchable on your own Mac

    Source only

  • ExtensionManager

    macOS · Menu bar

    See every extension and plugin quietly running on your Mac, and switch off the ones you did not ask for

    Source only

  • GitPulse

    macOS · Menu bar

    See which repos have uncommitted work before standup, without cd-ing through all of them

    Source only