← All posts
Guide

Is Mechvibes Safe? What It Reads, What It Sends

4 min readBy Mechvibes
Is Mechvibes Safe? What It Reads, What It Sends
Photo by Corinne Kutz on Unsplash

Mechvibes has to know when you press a key in order to play a sound for it. That is the same access a keylogger would need, so it is fair to ask whether the app is safe, especially when Windows or an antivirus shows a warning. This post explains what Mechvibes reads, what it sends, why those warnings appear, and how you can check for yourself.

What Mechvibes reads

Mechvibes listens for key presses and mouse clicks so it can play the matching sound straight away. It uses each event to choose a sound and then discards it. It does not record what you type, and the keys you press are never written to its logs: they show as ***.

How it listens depends on the system:

  • Windows: standard Windows input events for your user account.
  • macOS: the Accessibility and Input Monitoring permissions, which you grant yourself and can revoke at any time in System Settings.
  • Linux: the input devices in /dev/input, which is why your account needs the input group. Being in that group lets any program you run read input devices, not only Mechvibes, so it is a real choice to make. On X11, Mechvibes works without it.

What Mechvibes sends

Two things, and neither contains anything you type:

  • One anonymous ping each time it starts, with your operating system and its version, the app version, your system language, and a random ID created for that launch and never stored. It goes to Aptabase, an open-source analytics service. Turn it off in Settings > Privacy > Share anonymous usage stats.
  • A daily check for a new version on GitHub, which sends nothing about you.

Keystrokes, clicks, the packs you use, file paths and personal details are never sent. Logs stay on your computer until you export them yourself from Settings > Debug, and the export hides your user name.

Why Windows or your antivirus warns about it

Mechvibes is not code-signed yet. On Windows this has two effects:

  • SmartScreen shows "Windows protected your PC" the first time you run the installer. Click More info, then Run anyway.
  • Some antivirus products flag unsigned programs that listen to the keyboard, because that pattern looks like a keylogger to an automatic scan. These are false positives, and they come and go between antivirus updates.

On macOS, the app is not notarized for the same reason, so the first launch needs one extra step, explained in Mechvibes not working on Mac.

How to check for yourself

You do not have to take our word for any of this.

  1. Download only from the official places: the download page on mechvibes.com or the GitHub releases. Copies on other download sites may be old or modified.
  2. Compare the checksum. Every release includes SHA256SUMS.txt. On Windows, run Get-FileHash on the installer in PowerShell; on macOS or Linux, run shasum -a 256 or sha256sum. The result should match the line in that file.
  3. Scan it. Upload the installer to VirusTotal to see what dozens of scanners say, rather than one.
  4. Read the code. Mechvibes is open source under the MIT license. Everything above can be checked in the source code, and you can build the app from it yourself.

Mechvibes has been around since 2019 and the original version was downloaded more than 4.6 million times. If you ever find something that looks wrong, please open an issue or write to [email protected].