How can we help?

How do I install iKnowMyMac?#

Download the disk image, open it, drag iKnowMyMac into your Applications folder, then open it from Applications.

1. Get the download from the page you see right after buying, or from Get your download link with the license key from your purchase email. The download is about 4 MB.
2. Open the downloaded .dmg file.
3. Drag iKnowMyMac onto the Applications folder in the window that appears.
4. Eject the disk image, then open iKnowMyMac from your Applications folder.

iKnowMyMac is signed with our Developer ID and notarized by Apple, so macOS opens it after its usual check for apps downloaded from the internet.

What happens the first time I open it?#

A short setup: a few welcome screens, a choice of how the menu bar item looks, optional alerts, the optional helper, and then your license key.

Every step that involves a permission is optional and only asks when you press its button. You can change all of these choices later in Settings.

Does it run on Intel Macs?#

No. iKnowMyMac needs a Mac with Apple silicon (M1 or later) and macOS 15 Sequoia or later.

Why isn't iKnowMyMac on the Mac App Store?#

The App Store sandbox stops apps from reading other processes, which is the heart of what iKnowMyMac does. So we sell it directly, signed and notarized.

How do I activate iKnowMyMac?#

Paste the license key from your purchase email into the activation screen and choose Activate this Mac.

Your key is emailed by Dodo Payments, who handle our checkout. Copying and pasting is easiest; spaces and line breaks picked up from the email are removed for you. Until a key is activated, the app shows a live preview with simulated figures behind the activation screen.

To activate later, or with a different key, open Settings→ then License.

What does activation send?#

Your license key and your Mac's name. Nothing about the apps you run or how you use your Mac leaves it.

The license server replies with a random instance ID for this Mac. iKnowMyMac keeps the key and that ID in your Keychain, and later checks send only the key and the instance ID. The Mac's name is the one set in System Settings→ then General→ then Sharing; it helps you recognise your Macs if you ever move a license.

The app checks the license when it opens and then every 7 days. If it can't reach the server, everything keeps working for 30 days. Every request the app makes is listed on the privacy page.

My key isn't accepted. What now?#

The message under the key field says why. Most often the key was copied incompletely, or it's already active on all the Macs it covers.

• “That key wasn't recognised.” Copy the key again from your purchase email and paste it.
• “This key is already active on all the Macs it covers.” Free a seat in the customer portal linked from your purchase email (Deactivate next to a Mac you no longer use, or this Mac's old entry), then try again.
• “This key has been deactivated.” This usually follows a refund. If you didn't ask for one, write to support@iknowmymac.com.
• “You appear to be offline.” Activation needs a moment online. Connect and try again.

I bought a license for several Macs. How do I use it?#

Activate the same key on each Mac. A key for 5 Macs can be active on 5 Macs at once.

I can't find my license key.#

Search your email for the receipt from Dodo Payments; the key is in it. If you still can't find it, write to us from the email address you used to buy.

Why does iKnowMyMac ask to send notifications?#

For alerts about misbehaving apps and the weekly digest. macOS asks only when you choose Allow notifications during setup.

If you skip it or say no, monitoring works exactly the same; you just won't get alerts. You can change your mind in System Settings→ then Notifications→ then iKnowMyMac, and choose which alerts fire in iKnowMyMac Settings→ then Alerts.

Does it need Full Disk Access, the microphone or anything else?#

No Full Disk Access, screen recording or microphone. A few features ask for one permission the first time you use them, and only for that feature: Tidy for your Desktop, Downloads and Documents folders, browser tabs to read tab names from your browser, per-app volume for audio, the Wi-Fi name for Location, App Inspector, Your other Macs and the internet check for Local Network, and Keep Awake's Away option for Accessibility.

The only other approvals are for the optional helper, the optional network filter for Traffic, and Open at login if you turn it on; all of them appear in macOS's Login Items settings.

How do I turn on Traffic’s network filter?#

It's optional for Traffic, and Blocking needs it. In iKnowMyMac, click Open System Settings in Traffic's setup (or Turn On… in Settings › Traffic), then turn on iKnowMyMac under Network Extensions in System Settings.

The network filter gives Traffic real host names and the data amounts of system processes, and Blocking needs it. It only watches until you turn on Blocking; then it stops only what your rules, the blocklists you set to Block and your guards say.

1. In iKnowMyMac, click Open System Settings in step 2 of Traffic's setup, or Turn On… in Settings→ then Traffic. System Settings opens at General→ then Login Items (called Login Items & Extensions before macOS 27).
2. Scroll down to Extensions. If you see By App and By Category, click By Category.
3. Click the ⓘ button next to Network Extensions.
4. Turn on iKnowMyMac (it says iKnowMyMac Traffic under its name), enter your Mac's password if asked, then click Done.
5. If macOS asks whether iKnowMyMac may filter network content, click Allow.
6. Back in iKnowMyMac, Traffic switches to real host names by itself.

iKnowMyMac only appears under Network Extensions after you click the button in step 1. Turning the filter on or off, or updating it, briefly drops open connections, such as SSH sessions, downloads and calls.

How do I turn the network filter off again?#

In iKnowMyMac, open Settings → Traffic and click Turn Off… next to Network filter. Traffic keeps recording, with host names as guesses.

You can also turn off iKnowMyMac in System Settings→ then General→ then Login Items→ then Extensions→ then Network Extensions. macOS asks for your password, and may list the filter as waiting to be removed until your Mac restarts. You can turn it on again at any time.

What can the helper do?#

It answers four read-only questions, and only for iKnowMyMac.

• Read CPU, memory and disk use of system processes that apps can't read on their own.
• Take a powermetrics snapshot for per-process energy.
• Read the sleep and wake log (pmset).
• Read your SSD's health (SMART) data.

What can't the helper do?#

It can't take commands, change anything or use the network.

• It can't quit, change, move or delete anything, and it can't run commands for you or for any other app.
• It can't open your files or documents.
• It can't use the network, so it can't send anything anywhere.
• It doesn't keep running: it quits a few seconds after iKnowMyMac stops asking it questions.

How do I install and approve the helper?#

Choose Install helper during setup, or Install… in Settings → Helper, then allow iKnowMyMac in System Settings → General → Login Items.

1. In iKnowMyMac, open Settings→ then Helper and choose Install… (or choose Install helper during setup).
2. macOS asks for your approval. Open System Settings→ then General→ then Login Items (called Login Items & Extensions on newer macOS) and turn on iKnowMyMac. The app has an Open Login Items button that takes you there.
3. Back in iKnowMyMac, system processes appear on the next refresh.

How do I remove the helper?#

Open Settings → Helper in iKnowMyMac and choose Uninstall…. System processes are hidden again; everything else keeps working.

You can also turn it off in System Settings→ then General→ then Login Items. If you plan to delete the app, remove the helper first (see Uninstall).

How do I move my license to a new Mac?#

On the old Mac, open Settings → License → Move License to Another Mac…, confirm, then activate the same key on the new Mac.

1. On the old Mac, open iKnowMyMac Settings→ then License.
2. Choose Move License to Another Mac…, then Deactivate This Mac. This frees one of your license's seats.
3. On the new Mac, install iKnowMyMac and paste the same key.

Your history on the old Mac isn't deleted; that copy of iKnowMyMac returns to the activation screen.

“This key is already active on all the Macs it covers.” How do I free a seat myself?#

In the customer portal linked from your purchase email: find your key, press Deactivate next to the Mac to free, then activate again.

1. Open your purchase email from Dodo Payments and follow its link to the customer portal.
2. Find your license key. The portal lists every Mac it is active on, by name.
3. Press Deactivate next to a Mac you no longer use. If iKnowMyMac on this Mac asks to be activated again (it lost its activation, say after a reinstall), deactivate this Mac's own old entry.
4. Back in iKnowMyMac, press Activate this Mac.

iKnowMyMac shows these same steps under the message. Deactivating never deletes anything on any Mac.

My old Mac is gone, wiped or broken. How do I free its seat?#

Deactivate it in the customer portal linked from your purchase email (see above). Can't find the email? Write to support@iknowmymac.com from the address you bought with, and we'll free the seat for you.

When you write, include your license key or order number, and the name of the Mac to free if you know it. Once the seat is free, activate on your new Mac as usual. This also applies if you reinstalled macOS without deactivating first.

How does iKnowMyMac update?#

Through Sparkle, the standard Mac update framework. With automatic checks on, the app checks once a day and offers each new version.

The switch is in Settings→ then General→ then Updates, next to Check for Updates… for a check right now. Updates are signed, and iKnowMyMac verifies the signature before installing. The update check sends nothing about your Mac.

Updates are free. See what changed in the changelog.

How do I change iKnowMyMac's language?#

iKnowMyMac follows your Mac's language. To pick another one for iKnowMyMac alone, open Settings › General, choose it under Language, then click Relaunch Now.

1. In iKnowMyMac, open Settings→ then General.
2. Click the pop-up menu next to Language and choose a language. Each one is written in its own name, such as Deutsch or 日本語. Same as macOS follows your Mac's language again.
3. A line under it says, for example, “iKnowMyMac will show Deutsch after it relaunches.” Click Relaunch Now: iKnowMyMac quits and opens again, with every screen in the new language. If you don't, the new language shows the next time iKnowMyMac opens.

The same choice can be made in System Settings, which changes the same setting. These steps are also in iKnowMyMac, under Do the same in System Settings:

1. Open System Settings→ then General→ then Language & Region.
2. Under Applications, click the Add button (+).
3. Choose iKnowMyMac, then the language, and click Add.
4. If iKnowMyMac is open, quit it and open it again to see the new language.

iKnowMyMac comes in English, Deutsch, Français, Español, 日本語, Português (Brasil), 简体中文, 한국어, Italiano and Polski. Sizes, numbers, dates and times are written the way your region writes them, as set in System Settings→ then General→ then Language & Region, in English too. Feature names stay in English, and support answers in English.

If something reads oddly, click Suggest a Better Translation… under the Language pop-up menu: the feedback form opens with a title such as “Better translation (Deutsch): ” already begun. Nothing is sent until you click Send.

How does iKnowMyMac check my Node.js, PHP, Go and Java?#

In Package Watch, the Runtimes tab lists every Node.js, PHP, Go and Java on your Mac and checks each one against the latest security releases. Every row that needs a security update has an action: Fix… for a copy that is behind, Move to a supported line for one that no longer gets security fixes, and Remove… for an old version.

It looks in the folders of Homebrew, nvm, Volta, fnm, mise, asdf, Laravel Herd, MAMP and the installers from nodejs.org and go.dev, and reads each version from there. It never searches your whole home folder and never runs your shell profile; only Herd's PHP, which keeps no version on disk, is asked for its version.

For Java it reads each JDK's own release file: in /Library/Java and ~/Library/Java, Homebrew, SDKMAN, asdf and mise, the Java that IntelliJ IDEA and Android Studio bring with them, Gradle's toolchains, and any java that is running. When a JDK's vendor has not published its fixed build yet, its steps say so first. Move to a supported line suggests Java 25, the newest long-term support line.

• Fix… and Move to… show the exact command before it runs, such as brew upgrade node or nvm install 26.12.1, and run it only after you press its button. The old version stays installed beside the new one until you choose Remove…: Homebrew runs with HOMEBREW_NO_INSTALL_CLEANUP=1.
• Move to a supported line suggests the line your projects pin if it still gets security fixes, else the newest line that does: for Node.js, the newest even-numbered line, such as Node.js 26.
• A row says Used by 2 projects when projects pin its line, in .nvmrc, .node-version, .tool-versions, package.json (engines.node and volta.node), composer.json, go.mod or mise.toml.
• After a fix, Package Watch checks again: the row says Fixed, and the incident card, the Needs you row and the menu bar line update.
• nvm, Laravel Herd, the official installers and Java have their own answers below.
• Search anything finds the rows and the incident cards: type node, php, go, java, emudhra, php2shell or certifi.

The check is on by default and follows Package Watch's schedule. To turn it off, open Settings→ then Package Watch and turn off Check Node.js, PHP, Go and Java versions and certificate bundles.

How do I fix everything at once?#

Press Fix All… at the top of Package Watch › Runtimes, or on one incident card for just that incident. One sheet lists every step in order with its exact commands; untick what you don't want, then press Run.

1. Open iKnowMyMac, choose Package Watch in the sidebar, then the Runtimes tab.
2. Press Fix All… next to the summary at the top, or Fix All… on one incident card.
3. Read the list under Runs here: each step has a checkbox and its exact commands. Fixes are ticked; removing an old version and changing a project's pin never are.
4. Press Run, which names the number of ticked steps, such as Run 12 Steps. They run one at a time, in this order: Homebrew, then the version managers and installers, the Java JDKs, Composer and certifi, then the pins, and last the removals.

• It stops at the first step that fails and shows its output word for word; the steps after it do not run.
• Under Needs you, steps that need an administrator's password or Terminal each have their own button, such as Do It for Me….
• Steps done in another app, such as Herd's or MAMP's window, are named at the bottom: Fix… on their row shows the steps.

When it is done, Package Watch checks everything again, and each row it fixed says Fixed.

How do I remove an old Node.js, PHP or Go?#

Press Remove… on its row in Package Watch › Runtimes. iKnowMyMac first lists the projects that still use that version and what happens to them, then runs the installer's own command, such as brew uninstall node@20, only after you press Remove.

1. In Package Watch→ then Runtimes, find the old version. Remove… is on rows that no longer get security fixes, on an older copy beside a newer one from the same installer, and on rows Fix fixed.
2. Press Remove…. The sheet shows the exact command and, under Projects that use it, each project that pins that version.
3. To move a project to the new line, tick its pin. Each change is one line, shown as a diff, such as .nvmrc from 20 to 26.
4. Press Remove.

• Homebrew: brew uninstall node@20, or brew cleanup when a newer version of the same formula is installed. When another formula still needs it, Homebrew refuses, its message is shown word for word, and nothing is removed.
• nvm: nvm uninstall 20.3.1, in Terminal, here or copied, as for nvm's updates. Once it is removed, nvm use in a project that asks for it says it is not installed.
• fnm, mise and asdf: their own uninstall command. Volta has none, so the steps show its folder in the Finder to move to the Trash.
• The version nvm, fnm, mise or asdf uses as its default can't be removed: make another version the default first.
• Removing is not undone by iKnowMyMac: installing the version again brings it back. A pin change can be put back with Undo in History.

How do I update a Node.js that nvm installed?#

Press Fix… (or Move to… on a version that no longer gets security fixes) on its row and choose how: In Terminal, where you watch it run; Here, in a shell that loads only nvm's own script, never your shell profile; or Copy, to paste the commands into Terminal yourself.

1. In Package Watch→ then Runtimes, press Fix… on the nvm row, or Move to 26… on a version that no longer gets security fixes.
2. Choose In Terminal, Here or Copy at the top of the sheet. Each shows exactly what will run: the file Terminal opens, the script that runs here, or the commands to copy.
3. Press Run in Terminal, Run Here or Copy.

• In Terminal: iKnowMyMac writes a file in its own folder, ~/Library/Application Support/iKnowMyMac/Fix, holding only the commands shown, and Terminal opens and runs it. The file is deleted after a day. When Terminal says Finished, press Check Again.
• Here: the commands run in /bin/bash --noprofile --norc, which loads nvm's own nvm.sh and nothing else, and the output appears in the sheet.
• Copy: open Terminal (in Applications→ then Utilities), paste the command, such as nvm install 24.22.1, press Return and wait until the prompt comes back.

The old version stays installed. An update leaves nvm's default alone: to make new Terminal windows use the new one, run nvm alias default 24.22.1. Move to a supported line also runs nvm alias default when the old version was the default.

How do I update PHP in Laravel Herd?#

Press Fix… on Herd's PHP row and choose how: Herd's own command, herd php:update 8.4, in Terminal or here, or Copy, which also shows the steps in Herd's window.

In Herd's window, without iKnowMyMac:

1. Click the Herd icon in the menu bar and choose Open Herd.
2. Choose PHP in the sidebar.
3. Next to the PHP line iKnowMyMac marks, such as PHP 8.4, click Update. Herd installs the fixed version (8.4.27 on 21 October 2026) or later.
4. When it is done, Herd restarts PHP for your sites.

Herd's command asks Herd to fetch the same version or later, as its window does, and Herd keeps each PHP version it installed. PHP 8.1 and older no longer get security fixes from the PHP project: in Herd's window, click Install next to a supported line and choose it for your sites.

How do I update PHP in MAMP?#

MAMP brings its own PHP, so a newer PHP comes with a newer MAMP: install the newest MAMP, then choose the fixed PHP version in its PHP settings.

1. Open MAMP's download page, mamp.info.
2. Download the newest MAMP. It should list the fixed PHP version iKnowMyMac names, or later.
3. Quit MAMP, then open the downloaded file and follow the installer.
4. Open MAMP, and in its PHP settings choose that version or later for your sites.

MAMP keeps your sites and databases when it is updated; its older PHP versions stay in /Applications/MAMP/bin/php.

How do I update a Node.js or Go from the official installer?#

Download the installer for the fixed version, open it and follow the installer. It replaces the Node.js in /usr/local or the Go in /usr/local/go. For a version that no longer gets security fixes, Move to… can install the newer installer for you once you have downloaded it.

1. Download the installer for the version iKnowMyMac names: for Node.js, node-v24.22.1.pkg from nodejs.org; for Go, go1.26.10.darwin-arm64.pkg from go.dev/dl. Fix… has a button that downloads the right one.
2. Open the downloaded file and follow the installer. You will be asked for your Mac's password.
3. Check it: open Terminal and run /usr/local/bin/node --version (it shows v24.22.1) or /usr/local/go/bin/go version (it shows go1.26.10).

For a version that no longer gets security fixes, such as Node.js 16, press Move to 26…, download the newer installer with the sheet's button (it goes to your Downloads folder), then choose Do it for me: iKnowMyMac checks the installer's signature with pkgutil and installs it with installer after macOS asks for an administrator's password with its own prompt. The password goes to macOS, never to iKnowMyMac. Or choose Steps and open the installer yourself.

Node.js and Go from nvm, Homebrew, ~/sdk and the others are not touched.

How do I remove the eMudhra certificates from a Java JDK?#

Press Fix… on the JDK in Package Watch › Runtimes. For a JDK from Homebrew or in your ~/Library/Java, iKnowMyMac removes them itself, without a password, and keeps a copy for Undo. For a JDK in /Library/Java, choose Do it for me, which uses the standard macOS administrator prompt, or follow the steps below.

No JDK update removes them yet. The certificates are emSign ECC Root CA - G3 and, in some JDKs, AAA Certificate Services, Sectigo's, which cross-signed the eMudhra certificates. iKnowMyMac names the JDK and the certificates it found.

For a JDK from Homebrew or in ~/Library/Java, the sheet shows each command, then Remove 2 Certificates:

1. It keeps a copy of the JDK's cacerts file as cacerts.before-emudhra beside it.
2. It lists the certificates with that JDK's own keytool -list -v and finds the eMudhra ones by their SHA-256 fingerprint, never by name.
3. It removes each one with keytool -delete.
4. It reads the file again with Package Watch's own check. If a certificate is still there, or anything is unexpected, it puts the copy back and shows the steps instead.

Undo puts the copy back. Quit and reopen any Java app or server that was running.

A JDK in /Library/Java belongs to the system, so changing it needs an administrator's password. Choose Do it for me: macOS asks for the password with its own prompt and runs the script the sheet shows, which keeps the same copy and removes the same certificates. The password goes to macOS, never to iKnowMyMac, and nothing is kept. Undo asks again and puts the copy back. Or choose Steps and do it yourself in Terminal; the example is a JDK in /Library/Java:

1. Open Terminal (in Applications→ then Utilities).
2. Find the name this JDK gives each certificate: paste this and press Return. It prints a line such as Alias name: emsigneccrootcag3 [jdk] for each.

   /Library/Java/JavaVirtualMachines/temurin-17.jdk/Contents/Home/bin/keytool -list -v -keystore /Library/Java/JavaVirtualMachines/temurin-17.jdk/Contents/Home/lib/security/cacerts -storepass changeit | awk '/^Alias name:/ {name=$0} /86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B|D7:A7:A0:FB:5D:7E:27:31:D7:71:E9:48:4E:BC:DE:F7:1D:5F:0C:3E:0A:29:48:78:2B:C8:3E:E0:EA:69:9E:F4/ {print name}'

3. For each line, paste this, put what follows Alias name: in place of NAME (keep the quotes), and press Return. Type your Mac's password when asked.

   sudo /Library/Java/JavaVirtualMachines/temurin-17.jdk/Contents/Home/bin/keytool -delete -keystore /Library/Java/JavaVirtualMachines/temurin-17.jdk/Contents/Home/lib/security/cacerts -storepass changeit -alias 'NAME'

4. Quit and reopen any Java app or server that was running.

• sudo is needed only for a JDK in /Library/Java. For a JDK in your own ~/Library/Java or from Homebrew, leave it out.
• changeit is the password every JDK's cacerts comes with. If yours was changed, use that one.
• Java 8 keeps the file at jre/lib/security/cacerts inside the JDK's Home folder.
• A JDK update replaces this file: iKnowMyMac checks it again after one.

Where can I see what iKnowMyMac ran?#

In Settings › Package Watch, under History: every fix, move, removal and pin change run from Package Watch › Runtimes, newest first, with the commands exactly as they were shown, how it ran and how it ended.

1. Open Settings→ then Package Watch.
2. Scroll to History.

• How it ran: Ran here; Ran here, loading only its own script; Opened in Terminal; With the administrator prompt; Done by iKnowMyMac; or Pins changed.
• How it ended: Finished; Stopped, with the reason, such as the step that failed and its status; Cancelled; or, for Terminal, How it ended is shown there.
• Undo is on the entries that can be put back: a JDK's cacerts file and a project's pins.

The history is kept on your Mac, in ~/Library/Application Support/iKnowMyMac/Fix. It never holds a password and is not sent anywhere.

How do I turn on Blocking?#

Blocking is off until you turn it on, and it needs Traffic with its network filter. Click Blocking off in Traffic's header, or turn on Blocking in Settings › Traffic › Blocking, choose the guards to start with, keep or untick Block malware, Block trackers and Open iKnowMyMac at login, then click Turn on Blocking.

1. Turn on Traffic if it is off, and its network filter: see how to turn on the network filter.
2. If Traffic says “Update the network filter to use Blocking.”, click Update… and confirm. Updating the filter closes open connections once, such as SSH sessions and downloads.
3. In Network→ then Traffic, click Blocking off in the header. Or open Settings→ then Traffic→ then Blocking and turn on Blocking.
4. The first time, a sheet says what changes. Under Start with these guards, Install Guard and Agent Guard are ticked; tick or untick any of the four.
5. Under Start with these blocklists, Block malware (HaGeZi Threat Intelligence Feeds) and Block trackers (EasyPrivacy) are ticked, set to Block; untick either one. Nothing is downloaded before the next step.
6. Open iKnowMyMac at login is ticked too, so Blocking starts every time you log in; untick it to leave Open at login off. If iKnowMyMac already opens at login, the sheet says so instead.
7. Click Turn on Blocking. The ticked lists are downloaded, then checked once a day. The shield in the menu bar is filled, and Traffic's header says Blocking on, with the number of rules and guards.

More lists, NoCoin among them, are in Settings→ then Traffic→ then Blocklists, with lists you add by their address.

Nothing is blocked unless a rule, a blocklist you set to Block or a guard says so: everything else is still allowed. To turn Blocking off, turn off Blocking in Settings→ then Traffic or in Traffic Control; your rules and guards are kept for next time.

If anything goes wrong, click Allow everything 10 min in Traffic Control. If the network filter stops responding, everything is allowed, and Traffic says “Network filter not responding · everything is allowed”.

How do I block an app, a domain or an address?#

With Blocking on, right-click the connection in Network › Traffic › Log and choose Block…. Choose what to block, for how long and where, then click Block.

1. Open Network→ then Traffic→ then Log.
2. Right-click the connection and choose Block…. The Block connections sheet opens.
3. Under What, choose the process (This process, All processes from its app, or Any process) and the destination (This host, This domain and its subdomains, This IP or Any destination). A port, TCP or UDP and the direction are optional.
4. Under When, choose 5 min, 1 hour, Until logout or Always. Under Where, choose Everywhere or Only on untrusted networks.
5. If you like, add a condition: only when it was started by an install, such as npm install, inside an AI agent session, or working in a project folder.
6. The sheet says how many connections the rule would have blocked in the last 7 days. Click Block.

A rule for always closes the open connections it covers, and Traffic says how many. Every rule is in Network→ then Traffic→ then Rules, where you can switch it off, edit it or delete it. A blocked connection's details say what blocked it, with Allow for 5 min, Edit Rule…, Disable and Delete…. In Traffic Control, Block… on a recent connection offers Block for 5 minutes and Block always.

For Only on untrusted networks, mark the networks you trust in Settings→ then Traffic→ then Blocking: Trusted networks, Edit…. The first time you trust a Wi-Fi network, iKnowMyMac asks macOS for Location, to read the Wi-Fi name; nothing else. If Location is off for iKnowMyMac, every Wi-Fi network counts as untrusted (wired networks you trust still count). To turn it on:

1. Open System Settings→ then Privacy & Security→ then Location Services, or click Open Location Services in Trusted networks.
2. If Location Services is off, turn it on.
3. In the list, turn on iKnowMyMac.
4. Come back to Trusted networks. The Wi-Fi name appears within a few seconds.

What do Install Guard and Agent Guard do?#

They hold a connection and ask you, only where it matters: Install Guard when an install reaches anything outside its registries, Agent Guard when an AI agent session contacts a domain no agent has used before. If nobody answers, a guard allows the connection after 60 seconds, or does what you set. Over a full-screen app, the question arrives as a notification with Allow once and Block once.

A held connection waits at the notch (at the top of the screen on a Mac without one) with the process chain, the project and package, where it goes and Explain's answer. Choose Block always, Block once, Allow once or Allow always; an “always” answer makes a rule. With more than one waiting, +2 waiting shows the next, and Apply to all held connections from this install answers them together.

Over a full-screen app, the question arrives as a macOS notification instead, with Allow once and Block once; it goes away once you answer, or when the guard's time runs out. With a Focus or quiet hours on, it arrives without a sound, in Notification Center. If notifications are off for iKnowMyMac, the held connection waits in Traffic Control, which gives the steps to turn them on:

1. Open System Settings→ then Notifications.
2. Under Application Notifications, click iKnowMyMac.
3. Turn on Allow notifications.

A connection never waits forever. If nobody answers, a guard allows it after 60 seconds; in Settings→ then Traffic→ then Blocking, each guard can allow or block after 15, 60 or 180 seconds. While the Mac is locked, a guard decides at once. What guards decided while you were away is in Traffic Control: Review shows each one, with Allow always and Block always to make a rule. Connections that match no guard are never held.

How do I let every connection through for a while?#

Click the shield in the menu bar (or press ⌃⌥⌘T), then click Allow everything 10 min. For 10 minutes every connection is allowed; your rules and guards stay as they are and apply again afterwards.

1. Click the shield in the menu bar, or press ⌃⌥⌘T in any app, to open Traffic Control.
2. Click Allow everything 10 min. There is no question: every connection is allowed at once, and the time left shows beside the shield.
3. To end it early, click Stop allowing in Traffic Control. Your rules and guards apply again.

The same switch is Allow Everything in Settings→ then Traffic→ then Blocking, and Allow everything for 10 minutes in the palette (⌥⌘K). It is there while Blocking is on. If the shield is not in the menu bar, turn on Show Traffic Control in the menu bar in Settings→ then Traffic→ then Traffic Control; ⌃⌥⌘T opens it either way.

Does Blocking work when iKnowMyMac isn't running?#

No. Blocking works while iKnowMyMac is running. When it quits, connections are allowed again within seconds, and Blocking starts again when iKnowMyMac opens. Turning on Blocking also turns on Open at login, so it starts every time you log in. If iKnowMyMac quit while Blocking was on, it says so the next time it opens.

Blocking runs in iKnowMyMac. When iKnowMyMac quits, the network filter lets every connection through again within seconds, so a Mac is never cut off by an app that isn't running; Blocking starts again when iKnowMyMac opens.

Turning on Blocking also turns on Open at login, so Blocking starts every time you log in: the sheet has Open iKnowMyMac at login ticked, and you can untick it there. To change it later, use Open at login in Settings→ then General. If macOS asks for approval, turn on iKnowMyMac in System Settings→ then General→ then Login Items (called Login Items & Extensions before macOS 27).

If iKnowMyMac quit or stopped while Blocking was on, the next time it opens Traffic Control says so, for example “Blocking was paused while iKnowMyMac wasn't running, from 18:23 until it opened again. It is on again now.” Click OK to dismiss it. Logging out or shutting down doesn't count.

Where do Explain's answers come from?#

From Apple's on-device model, on your Mac: nothing about a connection is sent anywhere. When Apple Intelligence is off or not available, Explain answers from its built-in list of domains and its own rules, and says so.

• Where: right-click a connection in Network→ then Traffic→ then Log and choose Explain, or use Explain in its details, in a guard's alert, on an app in Traffic › Apps (right-click) and on a domain in the By domain view.
• What it says: what the connection is, why the app is likely connecting, what blocking it would change, and a recommendation, Allow, Block or Watch. Facts used lists everything it was given.
• On your Mac: Apple's on-device model answers, on macOS 26 or later with Apple Intelligence on. The question is put together on your Mac, and nothing about a connection is sent to us or to anyone else. Explain never acts by itself.
• Without Apple Intelligence: Explain answers from its built-in list of over 2,700 domains and its own rules, and says so.
• Kept: answers stay on your Mac for 24 hours.

Settings→ then Traffic→ then Explain says where answers come from on this Mac, with the System Settings steps when Apple Intelligence is off, and Edit… lets you add, change or hide entries in the domain list.

How do I import my Little Snitch or LuLu rules?#

Export them first: in Little Snitch, select the rules and choose File › Export Selected Rules…; in LuLu, choose Rules › Export… from its menu bar icon. Then in iKnowMyMac choose File › Import Rules…, pick the file, check the preview and click Import.

From Little Snitch (version 6 or 7):

1. Open Little Snitch's rules window and select the rules you want.
2. Choose File→ then Export Selected Rules…. Little Snitch saves them as an .lsrules file.

From LuLu:

1. Click LuLu's icon in the menu bar.
2. Choose Rules→ then Export…, then click Save. LuLu saves rules.json on your Desktop.

Then in iKnowMyMac, with Traffic on:

1. Choose File→ then Import Rules…, or click Import… in Network→ then Traffic→ then Rules.
2. Choose the file and click Preview.
3. The preview lists what will be imported, what is already in your rules and what is skipped, with the reason. Click Import, which says how many rules.

Imported rules go to the Imported group in Rules, where each can be switched off or deleted, and apply while Blocking is on. Open connections are left as they are. Rules set to ask aren't imported, because iKnowMyMac asks only through its guards. LuLu's own rules file can't be read directly: export the rules from LuLu first. The switching guide lists everything that is imported, merged or skipped.

How do I turn on encrypted DNS?#

In Network › Traffic › DNS, turn on Encrypted DNS and choose a provider. Then allow iKnowMyMac DNS in System Settings › Network › Filters. iKnowMyMac uses macOS's own setting and doesn't run a resolver.

1. Open Network→ then Traffic→ then DNS.
2. Choose your providers: Quad9 (Switzerland), Cloudflare 1.1.1.1 (United States), AdGuard DNS (Cyprus), NextDNS (United States, with your configuration ID) or Custom… for your own DoH address or DoT host. Use as Primary and Use as Fallback set which answers first. Quad9, with Cloudflare as the fallback, is the start.
3. Turn on Encrypted DNS.
4. If macOS asks whether iKnowMyMac may add DNS configurations, click Allow.
5. Open System Settings→ then Network, then click Filters.
6. Under Filters & Proxies, find iKnowMyMac DNS. Its type is DNS Settings.
7. Set it to Enabled, and enter your Mac's password if asked.
8. Come back to iKnowMyMac: Traffic › DNS shows the resolver in use by itself.

iKnowMyMac doesn't run a resolver: it uses macOS's own encrypted DNS setting. While encrypted DNS is on and iKnowMyMac is running, it checks each resolver you chose every 5 minutes and when the network changes, and uses the fallback while the first one fails. On a VPN or a managed Mac, the VPN's or the profile's DNS can take its place, and Traffic › DNS says so. To go back to your network's own DNS, turn off Encrypted DNS.

If Traffic › DNS shows Save Profile instead, this copy of iKnowMyMac can't change the setting itself: follow the numbered steps it shows to install a configuration profile in System Settings→ then General→ then Device Management.

How do I get a refund?#

Within 14 days of buying, write to support@iknowmymac.com from the email address you bought with. You don't need to give a reason.

Dodo Payments, our Merchant of Record, returns the money to the way you paid. When the refund goes through, the key is deactivated and the app becomes read-only at its next license check (see License inactive). Your data on your Mac is never deleted.

The details are in the refund policy. If you posted about iKnowMyMac, you may be able to get money back through the post-for-refund program.

What does “License inactive” mean?#

The license server reports the key as no longer active, usually after a refund or a chargeback. iKnowMyMac switches to read-only mode.

Nothing is ever deleted. To restore everything, choose Reactivate… in the banner and enter an active key.

What does “License needs a check” mean?#

iKnowMyMac couldn't reach the license server for more than 30 days. Connect to the internet and choose Validate now.

Monitoring keeps working meanwhile; actions and alerts are paused until one check succeeds.

My license shows as inactive, but I didn't ask for a refund.#

Write to support@iknowmymac.com with your order email and we'll sort it out.

How do I uninstall iKnowMyMac completely?#

Remove the helper in Settings first, quit the app, then drag it from Applications to the Trash. Optionally delete its data folder.

1. If you installed the helper: Settings→ then Helper→ then Uninstall….
2. If you might use your license on another Mac: Settings→ then License→ then Move License to Another Mac… to free the seat.
3. Quit iKnowMyMac (⌘ Q).
4. Drag iKnowMyMac from your Applications folder to the Trash.
5. Optional: delete ~/Library/Application Support/iKnowMyMac, which holds your 30-day history database and battery health samples.

To remove every trace, you can also delete ~/Library/Preferences/com.gs.iknowmymac.plist (your settings) and the iKnowMyMac license item in Keychain Access. If you turned on Open at login, check that it's gone from System Settings→ then General→ then Login Items.

What do I need to run iKnowMyMac?#

A Mac with Apple silicon (M1 or later) running macOS 15 Sequoia or later.

• About 4 MB to download. History takes about 94 MB for 30 days of 80 apps on our test Mac.
• An internet connection to activate, for the weekly license check and for updates. Monitoring itself works offline.
• CPU and GPU temperatures and fan speeds are validated on M1 Pro; on other chips the app shows the thermal state.
• On macOS 26 and later, an on-device Apple model phrases the diagnosis summary. On macOS 15, the same diagnosis is shown without it.

How do I reach you?#

Email support@iknowmymac.com. We read every message.

It helps to include your Mac model, your macOS version, the iKnowMyMac version (in the About window) and what you expected to happen. For license questions, write from the email address you bought with. Please never send us passwords.

Buying and updates

Safety and permissions

Features