Seed phrases, checked properly
Twelve to twenty-four recovery words, however they're numbered or laid out, and only when their built-in checksum holds, which is what stops ordinary writing being flagged.
[ pixellabs presents ]
secretsweep
Find what a thief would find on your Mac, before they do.
Seed phrases in a text file, the passwords you exported once, keys in a settings file, a screenshot of your recovery words, a photo of your passport: the first things information-stealing malware looks for. SecretSweep finds them on your Mac, without ever showing or keeping the secrets, and helps you lock them away.
download · MacFree. macOS 14 or later, Apple silicon or Intel. See installing, below.
01
Sweep
Desktop, Documents, Downloads and iCloud Drive, and the text in your screenshots and photos, read here on your Mac.
02
See what's lying around
Each find says what it is and where, without showing the secret: "A 24-word seed phrase", "Card ending 4242".
03
Put it somewhere safe
Keep it in an encrypted vault, move it to the Bin, or say it's fine. Leave out folders full of things you know about.
[ what it finds ]
Exported passwords
The CSV files Chrome, Safari, Firefox, Edge, 1Password and Bitwarden write when you export, which are easy to forget in Downloads and hold every password at once.
Keys and tokens
Crypto private keys, SSH keys with no password, settings files such as .env, and API keys with tell-tale shapes: AWS, GitHub, Stripe, OpenAI, Anthropic, Slack and Google.
Pictures, read on your Mac
Screenshots of seed phrases, photos of bank cards and passport pages, found with macOS's own text recognition. Optionally the whole Photos library too.
Passwords written down
"Wi-Fi password: …" in a note, a Word document or a PDF, when what follows really looks like a password rather than a sentence.
An encrypted vault
Keep in vault moves a find into an encrypted disk image in Documents (AES-256, made by macOS), opened with a password you choose, by double-clicking it in Finder.
Never shows the secret
Only what each find is and where. A card is "Card ending 4242"; a key is "AWS access key (AKIA…)". Nothing SecretSweep shows, keeps or saves contains the secret itself.
Nothing leaves your Mac
The only connection SecretSweep makes is a once-a-day check for updates, and only if you say yes when it asks; it sends nothing about you or what it found. Files and photos kept only in iCloud aren't downloaded to check them.
[ what it can't do ]
SecretSweep finds what's lying around on this Mac. It can't undo where it has already been:
It can't reach the copies
Moving a file doesn't touch its copies in Time Machine backups, iCloud's Recently Deleted, email, chat apps or other computers. A seed phrase that has been sitting in a file is safest treated as seen: move the funds to a new wallet.
Known shapes, not every secret
It finds the kinds of secret listed above. A password written as an ordinary word, or a secret in a format it doesn't know, can be missed, and something harmless can now and then be flagged: say it's fine and it won't be again.
Locked and cloud files stay unread
It can't see inside password-protected or encrypted files, and doesn't download files kept only in the cloud. It says how many of each it skipped.
It isn't signed by Apple yet
It is signed without a paid Apple Developer certificate, so macOS can't vouch for it and asks you to allow it the first time. See installing, below.
[ in the app ]
[ installing ]
The first time only, macOS needs telling that SecretSweep is allowed, and where it may look.
01
Drag it to Applications
Open SecretSweep.dmg and drag SecretSweep onto the Applications folder beside it.
02
Open it once, and say Done
Double-click SecretSweep in Applications. macOS says it can't check it for malicious software, because it isn't signed with a paid Apple certificate. Choose Done, not Move to Bin.
03
Allow it in System Settings
System Settings → Privacy & Security, scroll down to Security, and click Open Anyway beside SecretSweep. Confirm with Touch ID or your password, then Open.
04
Let it look
On the first sweep, macOS asks whether SecretSweep may see your Desktop, Documents and Downloads, and Photos if you include it. Allow each one, or it can't look there.
Or, if you're happy in the Terminal, this does steps 2 and 3 in one go:
xattr -dr com.apple.quarantine /Applications/SecretSweep.app
[ questions ]
Is it really free?
Yes. No account, no trial, no subscription.
Why trust an app with my secrets?
Because it never keeps them: it reads each file on your Mac, notes what kind of secret is in it and where, and lets the text go. Nothing it shows or saves contains a secret, and it makes no network connections at all. It reads only the folders you tick and only after macOS asks you.
What's the vault, and how do I open it later?
An encrypted disk image called SecretSweep Vault in your Documents folder, made with macOS's own encryption. Double-click it in Finder and type its password to open it; SecretSweep doesn't need to be installed. There is no way in without the password, so keep it somewhere safe, such as a password manager.
It found something I know about. What now?
Choose It's fine and it won't be listed again unless the file changes. If a whole folder is full of things you know about, such as a work project, choose Leave out a folder and it's skipped from then on.
Will it find things in my Photos library?
If you tick it. It reads every photo on your Mac, newest first, with on-device text recognition, so a large library can take a long time; stop whenever you like. Photos kept only in iCloud aren't downloaded. Deleting one moves it to Recently Deleted in Photos, after macOS asks.
Why does macOS say it can't be opened?
Because it isn't signed and notarised with a paid Apple Developer certificate yet. Follow the steps under Installing; it's only needed the first time. On macOS 14 Sonoma, right-clicking the app and choosing Open does the same.
How do I remove it?
Quit it from the broom in the menu bar, drag SecretSweep from Applications to the Bin, and delete the folder dev.pixel-labs.secretsweep from ~/Library/Application Support. Your vault stays in Documents until you delete it.
Which Macs does it run on?
macOS 14 Sonoma and later, on Apple silicon or Intel. One download covers both.
Have it.
It is free because it was written for one Mac and there is no reason it should not run on yours. If it finds something you'd rather nobody had seen, there is a coffee button at the top of the page.