Know what's on your network.
Keep your stuff on yours.
ShadowCypher is a Linux desktop app that watches your network, flags new and suspicious devices and checks what you run against known CVEs. The same account gives you mail at you@shadowcypher.site, chat, file storage and an AI assistant. Run it on our servers or your own. No telemetry.
One account, four ways in.
The desktop app does the work that has to happen on your machine. The web app holds your account services. Both talk to the same API, which you can run yourself.
Desktop app
A native app with a background daemon. Everything that touches your network runs locally.
- Guardian: devices on your LAN and new-device incidents
- Network scans with nmap, arp-scan and tcpdump
- Threat intel: recent CVEs from NVD and a package audit
- Counter-intel: ARP spoofing, DNS leaks, rogue DHCP, TLS interception
- OSINT and vulnerability tools for targets you're authorized to test
- AI assistant on a local Ollama model
- Ghost mode: Tor with a kill-switch
Web app
Your account services, at shadowcypher.site/app.
- Mail at your own handle@shadowcypher.site address
- Mail between ShadowCypher users never leaves the platform
- Chat rooms and direct messages
- Drive for your files
- Office: documents, spreadsheets and slides
- Guardian dashboard and push alerts
- Shadow AI assistant
Android apps
Two apps, installed from the APKs on GitHub.
- ShadowCypher Guardian: the web dashboard as an Android app, with push alerts
- Shadow AI: a voice assistant you can set as your phone's default
ShadowOS
A hardened Arch-based live ISO with the desktop app built in. More below.
What we protect, and what we don't yet.
Security tools shouldn't oversell. Here is exactly where your data goes and what is encrypted today.
| Area | Status | Details |
|---|---|---|
| Telemetry | None | The apps send no usage data. Syncing scan results to your account is off until you turn it on. |
| Chat | End-to-end | Messages are encrypted in your browser with AES-GCM while your chat vault is unlocked. The key stays in memory and never reaches the server. |
| Password | Split | New web accounts stretch the password with Argon2id on your device. The server gets a derived login secret; the other half unlocks your OpenPGP key, which only unlocks on your device. |
| Not end-to-end yet | Stored on the server as received. Mail between ShadowCypher users stays on the platform and never goes through an outside mail provider. | |
| Drive | Not end-to-end yet | Files are stored on the server as uploaded. |
| Self-hosting | Supported | Run the API, database and storage yourself. Self-hosting guide |
Ghost mode
Routes your traffic through Tor and adds an iptables kill-switch, so nothing goes out in the clear if Tor drops. It's the only part of the app that needs root, and it asks through your system's normal password prompt.
Tor is slower than a normal connection. It's built for anonymity, not streaming or gaming.
Counter-intel checks
Looks for the signs of someone interfering with your network: ARP spoofing, interfaces in promiscuous mode, DNS leaks, rogue DHCP servers, TLS interception and unusual traffic.
A hardened Linux with ShadowCypher built in.
An Arch-based live ISO with Hyprland, the hardened kernel, nftables, AppArmor, Tor and dnscrypt-proxy. One command switches the firewall, Tor routing and services between modes. There's no download yet: you build the ISO yourself.
Modes
shadow-mode normal
shadow-mode privacy
shadow-mode ghost
shadow-mode dev
shadow-mode gaming
Build it
cd shadowos
sudo bash build.sh # Arch host
bash build-docker.sh # any host with Docker
bash qemu-test.sh # boot it in QEMU
ShadowOS on GitHub →
Get ShadowCypher.
The web app needs nothing installed. The desktop app is built from source; there's no packaged release yet.
Desktop app
Needs CMake, Ninja, a C++17 compiler, OpenSSL and Qt 6.4 or newer.
git clone https://github.com/jakes1345/ShadowCypher
cd ShadowCypher
cmake -S shadowcypher-qt -B build -G Ninja
cmake --build build
Sign in from the app: it opens your browser to approve the device.
Android apps
Install the APK directly. You may need to allow installs from your browser.
Web app
Create an account with a handle and you get your mail address, chat, drive and dashboard right away.
Open the web appFree to use. Pay for more monitoring.
The desktop app and self-hosting are free. Paid plans on the hosted service raise the Guardian limits and add alerts. New accounts get 14 days of Guardian Pro.
- Desktop app, all local features
- Mail, chat, drive and office
- 1 Guardian agent
- 7 days of scan history
- Shadow AI with your own Anthropic key
- Everything in Community
- 10 Guardian agents
- 90 days of scan history
- Email and push alerts
- Hosted Shadow AI
- Webhooks to Slack, Discord and Teams
- Everything in Guardian Pro
- Unlimited agents and history
- Teams
- Remote missions on your agents
ShadowCypher includes offensive security tools. Use them only on systems you own or have written permission to test; anything else is illegal. Released under the MIT License.