“Zero telemetry” is a claim. Here’s how to check it.

1. The installer is the installer we published

We publish the SHA-256 hash of every release next to the download link. Before you run the installer, open PowerShell and check it matches:

Get-FileHash .\Ferrite_{version}_x64-setup.exe -Algorithm SHA256

Compare the output against the hash on the download page. If they don’t match — for whatever reason, including a corrupted download — don’t run it. This is the same step the download page’s own SmartScreen guidance walks through.

2. Updates are signed, not just downloaded over HTTPS

Auto-updates are verified with minisign — an update has to carry a valid signature from our bundled public key before Ferrite will install it, independent of whether the connection itself was secure. That means a compromised or spoofed update server can’t push a malicious update; it would need our private signing key, which we never ship and never publish.

3. Nothing about your connections leaves your machine

This is the one you don’t have to take our word for — it’s directly observable. With Ferrite running:

• Watch it with your own network monitor. Resource Monitor (built into Windows — resmon.exe → Network tab) or Wireshark will show you every connection Ferrite’s own programs make (the app and its background service). There are six kinds, and the app lists the same six in Settings ▸ Data & storage ▸ What goes over the network:
  • The secure-DNS resolver you picked. Your lookups go there; that is what DNS is. If you keep your system’s own resolver, Ferrite forwards nothing extra.
  • The update check: a plain request for one small file at ferritesec.com/updates/stable/latest.json. The comparison with your version happens on your PC, and the installer it points to is signed.
  • Public blocklists, about every six hours: plain downloads of public files from raw.githubusercontent.com (the ads, trackers and malware list, and any category you switch on) and urlhaus.abuse.ch (only if you switch on that category). No query, no address of yours.
  • Public threat lists from abuse.ch (feodotracker.abuse.ch), the same way, and ThreatFox (threatfox-api.abuse.ch) only if you add your own abuse.ch key, which goes to abuse.ch and nowhere else. Settings ▸ Engine & service ▸ Download threat lists switches these off.
  • Pro only: a license check with api.polar.sh when you activate a key and once when the app starts, carrying the key and, at activation, your computer’s name. No Polar key, no call; Free and the trial never contact it.
  • A webhook, only if you add one, to the address you gave.
  Nothing else, and none of it carries your connections, your DNS lookups, your rules or your files: no analytics endpoint, no crash-reporting service, no background phone-home.
• Compare it with the app. The list in Settings ▸ Data & storage ▸ What goes over the network says the same thing in plain words. If your monitor shows a connection Ferrite makes that is not on it, that is a bug, and we want to hear about it at admin@ferritesec.com.
• Check what leaves the website, separately. ferritesec.com itself runs no analytics scripts and sets no cookies — see the privacy policy for the complete, short accounting. The app and the website are different things, deliberately kept to different promises, so neither claim has to lean on the other.

What “zero telemetry” does not mean

It doesn’t mean Ferrite is offline. It makes the six kinds of connection in step 3 on its own, and no others, and each one is visible in the same network monitor. Two of them, the blocklists and the threat lists, are downloads that send nothing about you, and they are on by default (the threat lists have a switch). The others happen because you chose a DNS provider, because the app looks for a new version, because you activated Pro, or because you added a webhook, which is something you turned on and pointed somewhere you chose, not a hidden default.

Download Ferrite free Read the privacy policy