Every program that reaches for your wallets has to get past antitheft.
Your passwords, browser logins and wallets open for their own app. On Linux every other program is refused before the file opens, unless it is one antitheft trusts by design; on Windows and macOS, one that touches them is stopped. Your developer keys and SSH keys: you see which programs read them.
curl -fsSL https://antitheft.pro/antitheft.sh | bash
Built for one reader: the app that owns it.
Password managers, browser logins and cookies, wallets, messengers, 2FA apps and keyrings are storage like any other, kept for the one app that's supposed to touch them.
No blocklist to maintain, no signature to match. On Linux, once kernel protection is on, a process that isn't the vault's owner is refused before the file opens. On Windows and macOS, one that touches it is stopped.
Install now
Linux x86-64, AppImage
Your wallets answer to their own app.
Desktop wallets and wallet browser extensions are kept for the app that owns them, and the browser's saved passwords and cookies for the browser: locked on Linux, and on Windows and macOS any other program that touches them is stopped. Every wallet app, hardware wallet companions included, is checked against its signed release: a replaced copy is marked Hijacked and kept from the wallet, and on Linux a debugger reaching into a protected wallet is refused.
Hardware wallet apps, identity-checked
Ledger Wallet
Trezor Suite
BitBoxApp
Keystone, OneKey, GridPlus Lattice1 and more
Desktop and extension wallets, locked
MetaMask
Phantom
Rabby
Coinbase Wallet
Exodus
Trust Wallet
Electrum and more
Browsers: passwords, cookies and cards, locked
Chrome
Firefox
Brave
Edge
Opera
Vivaldi
LibreWolf, Waterfox and more
Your bank and exchange logins
No add-on per site: your saved passwords and signed-in cookies for every site live in the browser’s files, and only the browser opens them.
Kraken, Bybit, Uniswap and every other site you sign in to
State-of-the-art, file-level defense.
Stops programs that reach for your wallets, passwords and browser data. One licence per computer.
Every update included. Add computers to your account any time. For a business licence, write to us.
Business licenceWallets, password managers, browsers, messengers, 2FA apps and cloud storage logins. Dev keys on the record.
See what it coversWhere malware settles in, watched.
Startup entries, systemd units, cron jobs and shell profiles are where malware settles in to stay. On Linux, a package install that tries to add one is refused at the file, and other changes show up for you to look at.
- On Linux, a package install that adds a start-up entry is refused at the file.
- 79 rules watch the start-up places on Linux, from systemd units to shell profiles.
- A change made outside an install lands under Needs a look.
Your dev secrets: who read them, and when.
SSH keys, cloud credentials, .env files and registry tokens sit in plain files that every program you run can read. See which program read each one, and when.
- SSH keys, AWS and cloud credentials, kubeconfig.
- .env files, git credentials, npm and PyPI tokens.
- Turn on SSH hardening to lock your private SSH keys.
Cloud and infrastructure
AWS
Google Cloud
Azure
Docker, Podman
kubectl, Helm
Terraform, Pulumi
Vault
Vercel, Netlify, Fly.io, Cloudflare and more
Keys, repos and databases
OpenSSH, PuTTY
GnuPG, pass
Git, GitHub, GitLab
.env files
PostgreSQL
MySQL
MongoDB
CI runners and more
Package installs, on the record.
An install runs code. On Linux its scripts are refused your locked vaults and your start-up places; on Windows and macOS, one that touches a locked vault is stopped. You see each package install and whether anything it ran raised an alert.
- npm, pip and cargo installs, including their build scripts.
- An install that was refused something is flagged.
- Clean packages install without a word.
Language package managers
npm, pnpm, Yarn
pip, uv, Poetry, conda
Cargo
Go modules
gem, Bundler
Composer
Maven, Gradle
NuGet, dotnet
Perl, Lua, R and more
Don't wait until it's stolen.
Install antitheft in one command.
One layer, described honestly. antitheft guards files. It doesn't watch your network, see inside browser extensions, or stop you from typing a recovery phrase into a fake site. What it can and can't do