Di-kairos/paranoid-tools

<div align="center"

English · Русский

<img src="assets/logo.png" alt="Paranoid Tools" width="620"

Honest privacy &amp; security tools for macOS &amp; Windows — one job each, no snake oil.

&nbsp;[](https://github.com/Di-kairos/paranoid-tools/actions/workflows/ci.yml) &nbsp; &nbsp; &nbsp; &nbsp;

Guide &nbsp;·&nbsp; Manifesto &nbsp;·&nbsp; Threat model &nbsp;·&nbsp; Tools &nbsp;·&nbsp; Install &nbsp;·&nbsp; Launcher

<img src="demo/demo.gif" alt="paranoid launcher: live status dashboard, then a read-only check, all from one menu" width="720"

</div

Five small command-line tools around the lifecycle of a secret — a seed phrase, a password, a key: write it without leaving copies, store it encrypted, guard it while it's open, hide everything instantly under threat, split it into paper shares that survive a typo. Each tool is a single auditable file — pure Bash on macOS, a PowerShell port on Windows — with zero runtime dependencies, living together in this repository. Not a password manager: a local toolkit for the few secrets whose leak you can't undo. No cloud, no telemetry, no promises it can't keep.

Install

macOS — one command installs all five tools plus the launcher into ~/.local/bin:

git clone https://github.com/Di-kairos/paranoid-tools
cd paranoid-tools
bash install.sh            # installs all 5 + the paranoid launcher

Windows (beta) — PowerShell 7 and Git once, then the same single command. Any terminal will do: cmd, the built-in Windows PowerShell, or PowerShell 7.

winget install --id Microsoft.PowerShell -e
winget install --id Git.Git -e
# open a NEW terminal window here — winget gives its PATH to new processes only
git clone https://github.com/Di-kairos/paranoid-tools
cd paranoid-tools
windows\install.cmd            # installs all 5 + the paranoid launcher

Then, on either system: open a new terminal (so PATH picks up the change) and run paranoid — one menu with the current state of everything and every action in it, so you do not have to learn five CLIs to start. Step-by-step Windows notes (installing without Git, one tool only, what to do when git is "not recognized") are in Windows below.

Each tool is pulled from its own signed release with verify-then-run: the installer checks the Ed25519 signature over SHA256SUMS, then the checksum of the tool's own install.sh, and only then runs it — which in turn verifies the binary before installing. Every artifact pulled from the network is verified before it runs. Two things are not network artifacts and are therefore not covered by that sentence: the top-level install.sh (you launch it yourself, after reading it) and the paranoid launcher, which is installed straight from the clone in front of you — both are part of the repository you can read, not downloads.

There is also a signed and notarized macOS menu-bar app, and a Windows path (PowerShell 7). Homebrew covers all five tools (brew install Di-kairos/tap/securetrash, and the same for vaultwatch, panic, ghostdraft and seedsplit).

The tools