KnockKnock
KnockKnock: A free, open-source utility for inspecting Mac persistence—not full antivirus protection. Ranked #38 of 42 in Antivirus for Mac by our editors (5.6/10); pricing: Free plan; best for forensic inspection of Mac persistence.
At a glance
- Editor score5.6 / 10
- PricingFree plan
- Best forForensic inspection of Mac persistence
- Free planYes
- Paid fromFree
- Facts checked22 Sep 2026
Where it wins
- Scans startup, login, browser-extension, and other persistence locations
- Queries VirusTotal with file hashes and displays signing information
- Saves JSON results, compares scans, and supports command-line use
Where it doesn't
- Does not independently classify every detected item as malware
- No verified real-time protection
- Available only for macOS
Our verdict on KnockKnock
KnockKnock is a free, open-source macOS utility for examining software configured to run persistently at startup, login, or when other applications launch. It is intended for people investigating Mac persistence, reviewing unfamiliar software, or building repeatable inspection workflows. The utility scans startup items, login items, browser extensions, and other persistence locations, then presents file paths, code-signing details, and related file information. It can also reveal detected items in Finder and inspect property lists.
Its strongest capability is investigative depth rather than continuous defense. KnockKnock can query VirusTotal using file hashes, save scan results as JSON, and compare current results with previous scans. A command-line interface supports scripted or scheduled scans, while optional automatic launch and scanning at login can make recurring checks easier to run. These features suit technical users who want visibility into changes over time or need results in a format suitable for further review.
KnockKnock should not be treated as a complete antivirus replacement. The vendor describes it as a persistence-enumeration utility and states that it does not independently determine whether every detected item is malware; VirusTotal can flag known malware results. It also lacks verified real-time protection and is limited to macOS. Choose KnockKnock for focused forensic inspection and persistence auditing. Choose a different type of security product when continuous, independently classified malware protection is the primary requirement.
Your product? Our editors can test KnockKnock in depth and publish a review, labelled as paid · from $149/mo →
KnockKnock pricing
KnockKnock fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Ransomware protection | Not verified |
| Phishing protection | Not verified |
| Real-time protection | Not verified |
| Coverage scope | Mac-only |
| Devices included | Not verified |
| VPN included | Not verified |
| Password manager | Not verified |
| Deployment | Desktop |
| Platforms | macOS |
| Support | Email, Docs |
| Built for | Solo, Small business, Enterprise (editorial estimate) |
| Integrations | 1 integrations: VirusTotal |
| Pricing | Free plan |
| Website | objective-see.org |
| Facts checked | 22 Sep 2026 |
KnockKnock integrations
KnockKnock lists 1 integrations on its own site.
- VirusTotal
Alternatives to KnockKnock
- Avast OneBroad multi-device protection with a free entry plan and layered paid features.9.3
- Bitdefender Antivirus for MacFocused Mac protection with ransomware coverage, web defenses, and a 30-day trial.9.2
- Avira Free SecurityA free Mac security package combining malware protection with privacy and performance tools.9.1
See all KnockKnock alternatives →
Used KnockKnock? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used KnockKnock for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
KnockKnock is listed in our Antivirus for Mac directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/knockknock/"><img src="https://www.itechguides.com/best/badge/knockknock.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update