📦 Moved: development continues in the paranoid-tools monorepo (securetrash/ directory, full history preserved). This repository is archived: its published releases stay downloadable and the installers keep working, but new issues, PRs and releases happen in the monorepo.
English · Русский
SecureTrash
Honest secure file deletion for macOS — no SSD snake oil.
The problem
When you delete a file and empty the Trash, macOS just marks the space as free. The data itself stays on disk until something overwrites it. Free tools like Disk Drill or PhotoRec happily recover these "deleted" files. The Trash isn't deletion — it's "out of sight."
⚠️ The honest truth about SSDs
On modern drives, the classic advice to "overwrite the file N times" (rm -P, the old srm, "Secure Empty Trash") does not guarantee that your data is gone. The SSD controller decides which physical cells to write to: wear leveling spreads writes across the drive, copy-on-write in APFS writes new versions elsewhere, and TRIM frees blocks in the background on its own schedule. A command to "overwrite this file" never reaches the cells where your bytes actually lived. That's exactly why Apple removed srm and "Secure Empty Trash" back in OS X 10.11 El Capitan — they created a false sense of security. Most "secure shredders" stay quiet about this and sell overwriting as a guarantee. We don't.
What actually protects you
- FileVault — full-disk encryption. The foundation for everything. If the
drive is encrypted, "deleted" blocks are just ciphertext with no key. This is your primary, mandatory layer.
- Crypto-shred via vault — keep secrets inside an encrypted container
(AES-256) from the very start, then destroy the container along with its key. With a strong password and no surviving copies/backups/snapshots, the data is effectively gone no matter where its blocks physically sit on the SSD.
The vault is preventive: it only protects what you create or place inside the container. It cannot retroactively erase plaintext that already lived on disk unencrypted — that's what FileVault is for.
Install
Recommended — Homebrew (the formula pins a release tag and verifies its SHA256):
brew install Di-kairos/tap/securetrash