How to Verify Comoji Never Sends Your Keystrokes Anywhere

Step 3: read the hostnames out of the app you downloaded

A process can only connect somewhere it knows about, and hostnames have to be stored in the binary. strings pulls readable text out of a compiled file, so you can list them without any source code:

strings -a /Applications/Comoji.app/Contents/MacOS/Comoji \
  | grep -Eo 'https?://[A-Za-z0-9._-]+' | sort -u

/usr/libexec/PlistBuddy -c 'Print :SUFeedURL' \
  /Applications/Comoji.app/Contents/Info.plist

What comes back is Google’s sticker artwork CDN (fonts.gstatic.com), the update feed in Firebase Storage (storage.googleapis.com), and a handful of comoji.io and other-project addresses that only ever get handed to your browser when you click a link in the app.

Two honest caveats, so this matches what you actually see rather than a tidied-up version. api.giphy.com is assembled from its hostname in code rather than stored as a full URL, so it will not show up in that first list; search for it directly with strings -a … | grep -Eo '[a-z0-9.-]*giphy\.com', a pattern that matches hostnames only so it will not print the API key that also ships in the bundle. And the bundled Sparkle update framework carries its own documentation URLs (sparkle-project.org, andymatuschak.org) inside Contents/Frameworks, which are strings in a third-party library rather than hosts Comoji contacts.

Step 4: block it and see what breaks

This is the strongest test, because it does not depend on trusting any output. Install an outbound firewall: LuLu is free and open source, and Little Snitch is the long-standing commercial option. Set it to alert on every outbound connection, then deny everything from Comoji, permanently.

Emoji autocomplete keeps working exactly as it did, indefinitely, because it never needed the network in the first place. The only things that stop working are the update check and downloading sticker or GIF artwork you have not already cached. If the local claim were false, this is where it would fall apart, loudly.

Step 5: confirm the app is genuinely ours

All of the above tests the copy on your disk. It is worth confirming that copy is the one Apple notarized and that nobody has modified it since:

codesign -dv --verbose=4 /Applications/Comoji.app
spctl -a -vvv -t exec /Applications/Comoji.app
codesign -d --entitlements - /Applications/Comoji.app

codesign prints the Developer ID the app is signed with, spctl should answer accepted with source=Notarized Developer ID, and the entitlements dump shows what the app is permitted to do at all.

What we do on our side

Verification you can perform is worth more than a promise, but the promise should also be enforced somewhere. Two things run on every build of the app:

• The complete list of hosts Comoji may contact is a declaration in the source, published as the network surface and shown in the app under Preferences → Privacy. An automated test fails the build if the app can reach a host that list does not disclose.
• A second test scans the code that actually handles keystrokes, the event tap, the token buffer, the matcher, and the inserter, and fails the build if any networking API or any remote URL appears in it. The part of Comoji that sees what you type contains no networking whatsoever, and cannot quietly acquire any.

That same page also records what we have decided *not* to do and why, including open-sourcing the input path and commissioning a paid third-party review, so you can weigh the reasoning instead of guessing at it.

If you run any of this and find something that contradicts what we publish, mail support@comoji.io. We would rather correct the page or the app than have the claim quietly be wrong.

For what the app actually does with those permissions, the features page covers every app and site Comoji works in and the per-app and per-website disable lists that keep it quiet where you would rather it not run at all.