Every program that reaches for your wallets has to get past antitheft.
Infostealer protection for crypto wallets, saved passwords, browser logins and cookies, messengers and 2FA apps.
Windows now. macOS and Linux are coming: join the waitlist.
Website · Install · What it protects · FAQ · Releases · Support
Malware that steals from your computer doesn't break in through the front door. It is a cracked game, a "test task" from a recruiter, a browser extension, a package a tool installed for you. Once it runs, it goes straight for the same few files on every computer: your wallet, your browser's saved passwords and cookies, your Discord login.
antitheft keeps those files for the one app that owns them. Your wallet opens for your wallet app. Chrome's passwords open for Chrome. Anything else that reaches for them is stopped, and you see what it was, where it came from and what it tried to touch.
A program that touches a protected file is stopped, and you get an alert.
No blocklist to keep up to date and no virus signatures to match: antitheft doesn't need to know the malware. It knows your apps.
| Crypto wallets | Desktop wallets (Exodus, Electrum, Atomic, Ledger Wallet's data, Sparrow, Wasabi and more) and wallet browser extensions (MetaMask, Phantom, Rabby, Trust Wallet, Coinbase Wallet and any other wallet extension) |
| Browsers | Saved passwords, signed-in cookies, saved cards and autofill in Chrome, Edge, Brave, Firefox, Opera, Vivaldi, LibreWolf, Waterfox and more |
| Your bank and exchange logins | No add-on per site: the passwords and signed-in sessions for every site live in your browser's files, and only your browser opens them |
| Password managers | 1Password, Bitwarden, Keeper, Enpass, NordPass, Proton Pass and more |
| Messengers | Discord, Slack, Signal, Element |
| 2FA apps | Authy, Ente Auth, Proton Authenticator and authenticator browser extensions |
| Cloud storage logins | Dropbox, MEGA, Nextcloud, pCloud, Syncthing, rclone |
| Wallet apps' identity | Every wallet app, hardware wallet companions included (Ledger Wallet, Trezor Suite, BitBoxApp...), is checked against its signed release. A replaced copy is marked Hijacked and kept away from the wallet |
| Supply chain | antitheft doesn't judge a package, it stops what a bad one does: a malicious npm, pip or cargo package that reaches for your wallets or passwords is stopped, and a start-up entry it adds to stay on your computer is flagged. Every package install is on the record with what it touched |
Developer keys (SSH keys, AWS and other cloud credentials, .env files, git and registry tokens) are on the record: you
see which program read each one, and when. The full list, per system: docs/what-it-protects.md.
 |
 |
| The alert. Which program it was, what started it and what it reached for. | Your vaults. Every wallet, password store and browser antitheft found on the computer. |
 |
 |
| Activity. Who opened each vault, and when. | AI agents. Claude Code, Codex and Cursor keep out of your vaults by themselves. |
The screenshots use made-up data.
Windows 10 and 11: download the signed installer, antitheft-windows-x86_64-setup.exe (always the latest release), and run it.
macOS and Linux: not available yet. Join the waitlist on antitheft.pro and we will email you when they are.
Step by step, and how to uninstall: docs/install.md.
antitheft updates itself. Every release is signed with the antitheft release key, and an installed copy checks that signature and every file's SHA-256 before it installs anything. An update that doesn't start properly is rolled back by itself. More: docs/updates.md.
Each release lists the SHA-256 of every file and carries manifest.token, the release signed with the antitheft
release key. scripts/verify-release.sh checks both with plain openssl:
scripts/verify-release.sh manifest.token antitheft-0.1.1-windows-x86_64-setup.exeOn Windows, scripts/verify-release.ps1 does the same. Every release is also checked this way in public as soon as it is published (Verify release). How it works and how to do it by hand: docs/verify.md.
$100 a year, one price for all your computers (fair use). Renews yearly, cancel any time, money back within 14 days. Without a subscription antitheft runs in watching-only mode: it shows everything that reaches for your files, and stops nothing. For a company, or more computers than fair use covers, write to business@antitheft.pro.
Is it an antivirus? No. An antivirus looks for known malware. antitheft doesn't need to recognize the malware: it guards the files malware goes for, and lets only their own apps in. It works next to your antivirus.
Something I trust was stopped. Every alert names the program and where it came from. Mark it as not a threat from the alert. If antitheft keeps getting one of your apps wrong, tell us.
Why is the source code not here? This repository holds antitheft's releases, documentation and issue tracker. The source code is not public. You are welcome to examine antitheft itself on your own computer: see SECURITY.md.
More in the FAQ.
- Questions and help: SUPPORT.md, or support@antitheft.pro
- Something wrong: open an issue
- An app you want protected: request it
- A security problem: SECURITY.md, never a public issue
| Releases | Every version: installers, manifest.json and the signed manifest.token |
| docs/ | Install, updates, what it protects, checking a download, FAQ |
| install/ | The scripts behind the one-line installs |
| scripts/ | Release checkers for macOS, Linux and Windows |
| .github/workflows/ | Public checks: every release verified, install scripts compared with antitheft.pro |
| CHANGELOG.md | What changed in each version |
antitheft is licensed, not sold, under the Terms. See also the Privacy policy and LICENSE.
antitheft by kinnector. Wallet, browser and app names belong to their owners and are used only to say what antitheft protects.