HARD docs.

Before you start

HARD is one app for your Mac and iPhone, and an extension for your browser. You need:

• A Mac on macOS 14 Sonoma or later.
• An iPhone on iOS 17 or later.
• Chrome or Brave, version 116 or later, for the extension.

Install HARD for Mac

1. Download HARD for Mac from the link in your early access email.
2. Move HARD to your Applications folder, then open it.
3. Allow notifications when macOS asks, so HARD can tell you when something needs you.
4. HARD sits in your menu bar and opens a window with everything it watches. Its first check of your Mac starts straight away.

HARD keeps everything it learns about your Mac in ~/Library/Application Support/HARD/. The first time it opens, it also registers itself with Chrome, Brave and other Chromium browsers, so the extension can report to it.

Turn on the firewall

HARD’s firewall sees every new connection from every app, by name, before any data goes out. It’s a network filter, the same kind Little Snitch and LuLu use, so macOS asks you to allow it once.

1. In HARD, open Firewall and DNS and choose Turn on the firewall.
2. macOS asks you to approve HARD’s system extension in System Settings. HARD shows Waiting for you in System Settings and an Open System Settings button.
3. Go to General → Login Items & Extensions, find Network Extensions, and allow HARD. You may need your Mac’s password.
4. macOS asks whether HARD may filter network content. Choose Allow.
5. Back in HARD, the firewall shows On.

Whatever mode you choose, HARD always blocks more than 392,000 known phishing sites (from Phishing.Database, refreshed every 12 hours) and networks run by criminals (Spamhaus DROP and abuse.ch). The Connections list shows the newest first; turn on Only show blocked to see what was stopped and why. To pause the firewall, choose Turn off.

Watch, Ask me, Lock down

Choose how strict the firewall is under How strict:

Watch

The default. Allows everything except known-bad sites, and keeps a record of every connection. No questions.

Ask me

The first time an app connects somewhere new, HARD asks. Allow or block it just this once, always for that address, always for anything on that domain, or always anywhere. If you don’t answer within 60 seconds, the connection is allowed.

Lock down

Blocks every new connection unless you’ve allowed it. Apple’s own services keep working.

Your answers become rules, listed under Your rules. Delete one with the bin button beside it.

Secure DNS

DNS is how your Mac turns names like commbank.com.au into addresses. Normally it isn’t encrypted, so the Wi-Fi you’re on can watch it, or quietly send you to a fake site. Secure DNS encrypts it for the whole Mac, using Cloudflare. Pick one in Firewall and DNS:

1. Choose an option. HARD saves it as a DNS setting called HARD.
2. If HARD says One more step, choose Open Network settings, go to System Settings → Network → Filters, and switch HARD on.

To stop, choose Turn off. A VPN uses its own DNS while it’s connected. With Secure DNS on, your lookups go to Cloudflare; see the privacy policy.

Live

Live shows every program on your Mac that’s using the internet: what it is, who made it, how much it sent and received in the last ten minutes, and every server it’s talking to, by owner and country. It updates every ten seconds.

HARD flags a program that’s talking to a known criminal network, that sends more than it should, or that isn’t signed. Connections are encrypted, so HARD sees who a program talks to and how much, never what it says.

Wi-Fi checks and Local Network

Wi-Fi devices scans your home network from the Mac: it names each device (router, TV, printer, cameras, phones), looks for open doors such as Telnet, Remote Desktop or open camera streams, and checks the router’s model and firmware against published flaws. It looks again when you rejoin a network, and notices new devices.

The first scan asks for the Local Network permission. Choose Allow. If you said no, names still work but open ports and the router check don’t:

1. Open System Settings → Privacy & Security → Local Network.
2. Turn on HARD.
3. In HARD, scan again.

To check the router, HARD sends its model name to the US government’s National Vulnerability Database (NVD). Nothing else about your network leaves the Mac.

Is this legit?

Paste a text, email or link into Is this legit? on the Mac or iPhone, or choose I’m on a call and answer yes-or-no questions about the call you’re on. HARD gives a verdict, its reasons and what to do. On the Mac, you can also select text in any app and choose Services → Check with HARD.

HARD checks every link and sender domain: lookalikes of known brands, reported phishing, and how recently the domain was registered (it asks the public registry, rdap.org, for the date). It also looks for the tricks scams use: urgency, secrecy, “safe accounts”, gift cards and codes.

On the Mac, Also ask Claude for a second opinion sends the text to Anthropic for a short second view. It’s off unless you tick it. HARD’s own checks run on your Mac either way.

Checks and updates

HARD checks your Mac when it opens, every 30 minutes, whenever the network changes, and when something new lands in Applications or the folders where programs set themselves to run in the background. The first check learns what’s normal; after that, anything new is reported as a change.

• This Mac: FileVault, System Integrity Protection, Gatekeeper, the built-in firewall, automatic security responses, screen lock and device management.
• Updates: macOS against Apple’s feed, Chrome-family browsers against Google’s releases, and apps against NVD and CISA’s list of flaws being used in attacks. Each warning links to a plain-English advisory.
• Apps: signatures, notarisation and tampering, and an alert when an update changes who signed an app.
• Background items: launch agents and daemons, system extensions and anything new.
• Browser extensions: every Chromium browser and profile on the Mac.
• Network: extra trusted certificates, a live test for someone intercepting your connections, proxies, DNS servers and open Wi-Fi.

Without an administrator account, HARD can’t see other users’ programs. Those show as unknown, never as unsigned.

The browser extension

The HARD extension works in Chrome and Brave on your Mac.

What it does

• Lookalikes: stops addresses like g00gle.com, letters from other alphabets, and brand names wearing someone else’s domain, before the page loads.
• Reported phishing: more than 392,000 sites, refreshed every 12 hours.
• New domains: blocks a suspicious address registered in the last 60 days.
• Copied sign-in pages: a Google or Microsoft sign-in form on a domain the brand doesn’t own. A “Sign in with Google” button is not a copy.
• Password alert: if your Google, Microsoft, Apple or similar password is typed on the wrong site, HARD clears it and stops the form.
• Payment pause: on banks, payment apps and crypto exchanges, a payment at or over your threshold, a new payee, a crypto address or a withdrawal waits while HARD asks the questions scammers hope you won’t. Wait 10 minutes, don’t send it, or continue.
• Remote-control warning: if AnyDesk, TeamViewer, Quick Assist or similar is open beside your bank, the pause always runs its full 10 minutes.
• Password-only sign-ins: after two sign-ins with no code, approval or passkey, a small card suggests turning on 2-step verification.
• Extension audit: known-malicious extensions, sideloads, updates from outside the store, and risky permissions.

The panel

Click HARD in the toolbar to see this site’s verdict, your extensions, what was stopped, and the payment pause. Set Pause payments of to the amount you want (2,000 by default, in whatever currency the site uses). On a site HARD doesn’t know as a bank, choose This is my bank: watch payments here.

With HARD for Mac

Open HARD for Mac once and the extension’s warnings appear in HARD’s activity on the Mac. It sends only the site’s name, HARD’s own wording, a rough size range for a paused payment, and what you chose. Never what you typed, the amount, a payee, an account number or the page.

HARD for iPhone

HARD for iPhone has Is this legit?, HARD codes and a scam-text filter. Install it from the link in your early access email.

Turn on the scam-text filter

1. Open the iPhone’s Settings, then Apps → Messages.
2. Choose Unknown & Spam → SMS Filtering, then HARD.

Only texts from numbers that aren’t in your contacts are checked, on the phone. Scams go to Junk; everything else is left alone. Nothing leaves your phone.

HARD codes

A voice can be cloned and a number can be faked. A HARD code can’t be guessed. Two people pair once, in person, and then each sees the same six-digit code for the other, changing every 30 seconds (the same standard authenticator apps use, RFC 6238).

Pair with someone

1. Be in the same room.
2. One of you shows a code: Show mine on iPhone, or Pair with someone in HARD for Mac.
3. The other taps Scan someone’s code on their iPhone and scans it.
4. Each of you names the other, and you’re paired.

When someone calls asking for money

1. Ask for their HARD code.
2. Tap their name and type what they read out. On iPhone, HARD asks for Face ID, Touch ID or your passcode before it shows codes.
3. Match: it’s them. Doesn’t match, or they can’t open the app: hang up and call them back on the number you already have.

Codes are kept only on the two devices, in the Keychain: never synced to a server, never in backups. HARD never sends a code anywhere. To remove a pair on iPhone, press and hold their name.

Family and managed accounts

On the Family plan, up to six people each have their own HARD. Organisers can add people, manage someone else’s HARD, and get their alerts. Everyone else just gets protected.

A managed account is for someone you look after, like a parent. Set HARD up on their Mac and iPhone together, once. After that, you hear about what matters (a transfer HARD paused, a fake site it stopped, an update attackers are using) and see what needs fixing on their devices. You don’t see their messages, their browsing or their bank balance.

Only set up a managed account with the person’s agreement. See the terms.

Operator chat and HARD Operator

The Operator chat

Open Operator in HARD for Mac. HARD’s agent answers straight away. Send a screenshot of anything odd (a message, a pop-up, a payment request, a sign-in page) or describe the call you’re on. It knows what HARD has found on your Mac that needs attention.

HARD’s agent uses Claude, so your messages, the recent conversation, screenshots you attach and a summary of what HARD found go to Anthropic. Never send passwords or one-time codes. The conversation is kept on your Mac.

Starting HARD Operator

1. Introduction. A short, private call, under NDA if you like. The scope is agreed. Request one.
2. Discovery. Two weeks on your accounts, devices, homes and people.
3. Report. Written, ranked by real-world risk, and yours to keep.
4. Fix. Critical findings in 72 hours, the rest by week six.
5. Membership. HARD on every device, every home’s network secured, and your engineer, at any hour. Everything is checked again every year.

The hard command

HARD for Mac includes a command-line tool that prints the same report as the app. It lives inside the app; to call it hard, add this line to your shell profile (~/.zshrc):

alias hard=/Applications/HARD.app/Contents/MacOS/hard-bridge

From Terminal, macOS may limit what hard lan can reach until Terminal has the Local Network permission too.

MCP server

AI assistants that speak the Model Context Protocol, such as Claude, can use HARD’s checks. Add HARD to Claude Code:

claude mcp add hard -- /Applications/HARD.app/Contents/MacOS/hard-bridge mcp

Or to Claude Desktop, in its configuration file:

{
  "mcpServers": {
    "hard": {
      "command": "/Applications/HARD.app/Contents/MacOS/hard-bridge",
      "args": ["mcp"]
    }
  }
}

The tools it offers:

check_message

Is this legit? for a text, email or pasted text.

check_website

One address: lookalike, reported phishing, domain age.

check_call

Is the person on the phone a scam, from yes-or-no answers.

security_report

HARD’s latest full check of this Mac.

live_traffic

Programs using the internet now, and who they talk to. Takes about 12 seconds.

firewall_log

Recent connections seen by the firewall, allowed or blocked.

explain_program

What a program is, who made it, and whether its signature is valid.

What a tool returns goes to the assistant you’re using, under that assistant’s own terms.

Uninstalling

HARD for Mac

1. In HARD, open Firewall and DNS. Choose Turn off for the firewall, and Turn off for Secure DNS.
2. Quit HARD from the menu bar.
3. Move HARD from Applications to the Bin. If macOS asks to remove HARD’s network extension, allow it.
4. To remove what HARD learned about your Mac, delete ~/Library/Application Support/HARD/.
5. To remove the browser link, delete fyi.hard.mac.json from the NativeMessagingHosts folder in each browser’s folder under ~/Library/Application Support/.

HARD codes on the Mac are kept in your login keychain. Remove a pair in HARD before uninstalling, or delete it in Keychain Access.

The extension

Open chrome://extensions (or brave://extensions) and choose Remove on HARD. Its settings, its log and its password hashes go with it.

HARD for iPhone

In Settings, set Apps → Messages → Unknown & Spam → SMS Filtering back to none, then delete the app. To be sure no HARD code is left on the phone, remove your pairs in the app first.

To remove your email from our lists, or anything you’ve sent us, use the support form.