Little Snitch 6 Review (2026): Features, Pricing & Honest Take

Installation is straightforward: download Little Snitch from obdev.at, drag it into the main Applications folder (not the one in your home folder), start it, allow it to filter network content when macOS asks, and approve the system extension under System Settings > Privacy & Security. Objective Development's installation guide does not mention a restart.

Little Snitch 6.5 runs on macOS 27 and is also compatible with Tahoe, Sequoia and Sonoma. If your Mac is still on macOS 13 Ventura or older, Objective Development offers compatible older versions on its legacy download page.

On first launch Little Snitch asks two questions that shape the first days: whether to enable pre-configured rule groups (for macOS services, iCloud services and Apple's own apps) and whether to use silent mode. With the rule groups on, the system's own background traffic is covered from the start. Objective Development recommends silent allow mode for getting started: connections go through, and the Network Monitor records where a rule is still missing, so you can decide later.

Alert mode is the classic Little Snitch experience. When no rule matches, a connection alert asks what to do, and you choose how long the answer holds: once, until the app quits, or forever. Where the app's developer supplies an Internet Access Policy, the alert can show what the connection is for, which makes the decision easier. A silent deny mode exists as well, but Objective Development does not recommend it for most practical purposes.

Whichever mode you pick, the principle stays the same: Little Snitch gives you precise control, and the rules come from your decisions. Every new app you install, and every new server an existing app starts to use, is a new decision, either as an alert or as an entry to review in the Network Monitor. For people who want that level of control, that is the point. For people who mainly want trackers gone, it is, in our view, a lot of homework.

The centre of Little Snitch is the Network Monitor. It shows network activity in real time and can group it by app, by domain or by country, so you see which app talks to whom and where. Select a connection for the details: process, server, port, protocol and how much data went through. A traffic chart reaches back up to twelve months, which helps you spot a pattern that only shows up once a week.

The map plots the servers your Mac connects to around the world. It is more of a sanity check than a daily tool, but it is a quick way to notice an app talking to a region you did not expect.

A note for anyone reading older reviews: the Research Assistant that explained unknown processes belonged to Little Snitch 4 and 5. It is not part of Little Snitch 6. What version 6 shows instead, where the app's developer provides one, is the Internet Access Policy: the developer's own explanation of what a connection is for.

Blocklists are the part that comes closest to tracker blocking. Little Snitch offers a preconfigured set of blocklists sorted by topic (tracking, ads, malware and more). The lists themselves are maintained by third parties; Little Snitch downloads them, integrates them into your rules and keeps them updated (since 6.4 as often as hourly). You can also add any list by URL, including IP-based lists. None of this is on by default: you pick the lists and switch them on yourself.

Some specific features of Little Snitch:

Rule granularity. A rule can name the process (identified by its code signature), the server (domain, host name, IP address, local network and more), a port or port range, a protocol (TCP, UDP, ICMP), the direction (incoming, outgoing or both) and the profile it applies to. Something like "allow Firefox to reach mozilla.org on port 443, deny everything else from Firefox, but only in my café profile" is possible. The rule editor is dense, and it rewards people who know what a port is.

Profiles per network. Join a new Wi-Fi, choose a profile, and Little Snitch switches to it automatically the next time you connect to that network.

More than 20 years of development. Objective Development keeps Little Snitch current with macOS: 6.1 added Sequoia support, 6.3 Tahoe, and 6.5 (8 September 2026) macOS 27, together with app bundle integrity monitoring and NAT64 support.

DNS encryption. Since version 6.0 (21 May 2024), Little Snitch can encrypt your Mac's DNS lookups system-wide using DNS over HTTPS, TLS or QUIC (DoH, DoT, DoQ), so your provider and the network you are on cannot read them.

Demo mode. Without a licence key, Little Snitch runs as a demo with the same protection as the full version. The filter switches off after three hours and can be restarted as often as you like; the Network Monitor works for the first 30 days. That is a fair way to test it properly before buying.

The learning curve. The documentation assumes you are comfortable with hosts, ports and processes. The first days are spent answering alerts or reviewing the Network Monitor and turning what you see into rules.

Tracker blocking is something you set up. Little Snitch shows you that an app contacted `firebase-analytics.googleapis.com`. Whether that is a tracker is for you to judge, or for a blocklist you have chosen to switch on. That matches what Little Snitch is built for: showing you everything and letting you decide. NetMute takes the other route. Tracker Shield comes with a curated list of 300+ tracker domains and blocks matches without asking, and App X-Ray gives each app a privacy grade from what it actually contacts.

Licensing. Little Snitch is sold directly by Objective Development on obdev.at, not in the Mac App Store, as a perpetual licence with no subscription. A single licence covers one user on several Macs, or several users on one Mac. A family licence covers up to five Macs in one household for non-commercial use. There are multi licences for teams, reduced upgrade pricing when a new major version comes out, and a student discount. Current prices are on obdev.at.

Little Snitch Mini is a different product. Mini is a separate app, launched in March 2023 and sold only in the Mac App Store. Its network monitor (live connection list, traffic diagrams, map) is free; blocking, longer history and advanced filters need a monthly or yearly subscription, with no one-time option. If you only want to look at your traffic, Mini is an easy first step. If you want to block, weigh that subscription against a one-time purchase.

Ongoing decisions. New apps, and new features in existing apps, bring new connections, so the rule set is never quite finished.

Little Snitch is, in our view, the right choice if you want to see and control every single connection, write precise rules by port, protocol and direction, encrypt your DNS, and rely on a tool with more than 20 years of track record. NetMute is newer and has less accumulated mileage.

NetMute is built for a different job: getting trackers out of your apps without a decision per connection. Tracker Shield blocks known tracker domains as soon as it is on, in apps and in browsers. (In browsers that resolve names on their own, such as Brave, name-based blocking needs one extra setting, and the app's "Where NetMute protects" check measures where blocking works.) App X-Ray grades each app's privacy from what it actually contacts. Quiet Mode records new connections instead of popping them up, and you decide the backlog in one pass. Every rule shows how often it fired, and rules that provably cannot fire are named.

A concrete example from the developer's own Mac (7 to 22 September 2026): GeForce NOW contacted 59 domains. Two of them were tracking endpoints (feedbacks.telemetry.data.nvidia.com and events.telemetry.data.nvidia.com), and NetMute blocked both without a single prompt. Over 30 days the same Mac had 2,701 tracker requests stopped, from 64 companies across 33 apps.

NetMute is free to download with no time limit: per-app firewall, live traffic per app, and Tracker Shield for the 50 most active tracker domains. Pro is a one-time purchase that adds the full list of 300+ tracker domains, App X-Ray, per-app data limits, profiles, schedules and reports. No subscription, no account, and nothing leaves your Mac by default. It is available in the Mac App Store or as a direct download with a licence key. It is closed source and Mac only.

LuLu from Objective-See is free and open source; it alerts on unknown outbound connections and saves your answer as a rule. Radio Silence keeps a list of blocked apps, shows no pop-ups and includes a real-time network monitor. The macOS Application Firewall controls incoming connections.

The short version: if you want full control and enjoy building rules, Little Snitch is excellent at that. If you want trackers blocked and a clear answer to "what is this app doing?", download NetMute free and look at what your apps connect to.