Get from question to evidence.

Install Exitglass

Open the signed Exitglass disk image and drag Exitglass to the Applications folder. Launch it from Applications and complete the short onboarding flow. Exitglass requires macOS 14 or later.

Downloads come from exitglass.app/download. TODO(owner): confirm the signing and notarization statement once the first Exitglass DMG is published.

Run a check

Open Check-up and choose Run Check-up. Exitglass looks up the public IP your Mac presents and reports four areas, each with a status, a plain sentence, and how many sources answered: Identity & location, Reputation (hosting, residential-proxy, VPN, and Tor evidence, blocklists, BGP and RPKI), Leak tests (DNS, WebRTC/STUN, IPv6, proxy and TUN state, egress consistency), and Services (whether ChatGPT, Claude, and Gemini are reachable and which region they see; Netflix, YouTube Premium, and Disney+ with Pro). Each area also has its own page. Run a check-up once before and once after changing a VPN, proxy, or DNS profile.

The sidebar also has Monitor (Pro) and History, plus the advanced diagnostics: DNS, TLS Inspector, Ping & Traceroute, HTTP Inspector, Port Tools, Whois & GeoIP, and Speed Test. Developer tools (API Debugger, HAR & Diff, Utilities, Batch Diagnostics, and Privacy Audit) are hidden until you turn on Show developer tools in settings.

You can also paste a domain, IP address, URL, host and port, or other value; Smart Paste recognizes it and proposes the relevant workspace. Press ⌘K anywhere to open the command palette.

Permissions and network access

Exitglass runs its checks directly from your Mac and needs normal outbound network access. Local-port process ownership can require macOS authorization depending on the process being inspected. Notifications are optional and are used for exit-change alerts in Monitor (Pro), certificate and domain reminders, and diagnostics you explicitly choose to monitor.

Results, Monitor, history, and export

Each finding shows a status (normal, attention, problem, or unknown), a plain sentence, and the sources behind it. There is no single overall score. Sources that could not be reached are shown as Not covered, never as a pass.

Monitor (Pro) re-checks your exit in the background and records a timeline entry when the exit IP, country, network, or a leak result changes; events stay on your Mac for 30 days. The free tier still shows your exit in the menu bar, without change alerts.

Completed check-ups and leak tests appear in History. The free tier keeps your last 5 check-ups; Pro keeps the full history, adds Compare for two check-ups, and exports PDF, CSV, or JSON reports.

Trial and license

The free tier has no time limit. When you are ready to evaluate Pro, you can explicitly start one 14-day full-featured trial from the app. No payment method is required to start it.

Exitglass Pro is a one-time $19.99 purchase that includes all 2.x updates. To activate, open Exitglass settings, choose License, paste the key from your purchase email, and select Activate Pro. Deactivating returns that device seat to your license. See how activation works. TODO(owner): state the number of devices one license can activate.

Troubleshooting

The identity check says a source is unavailable

Some public sources are rate-limited or temporarily down. Exitglass shows these as gaps and does not count them as clean. Run the check again in a few minutes.

My IP shows as a hosting network

Hosting networks are normal for servers and many VPN services. It is context, not a verdict. If you expected a home or mobile connection, check whether a VPN or proxy is active.

WebRTC shows a different address than the web

A VPN or proxy may cover web requests but not the UDP exchange WebRTC uses, or the tunnel may carry only IPv4. Check the tool's leak-protection setting and IPv6 support, then run the check again.

A query times out

Try the same target with a different resolver or transport. A corporate VPN, firewall, proxy, captive portal, or filtered network can block ICMP, DNS, TLS, or HTTP independently.

Ping works but HTTP does not

Reachability only proves a route to the host. Inspect DNS, TLS, redirects, proxy settings, and the destination port separately.

Traceroute shows asterisks

Many routers intentionally ignore or rate-limit traceroute probes. A missing intermediate reply is not automatically packet loss at the destination.

The app closes unexpectedly

Reopen Exitglass, note the workspace and target that were active, and send the macOS version plus the crash time to support. Never include secrets, private API headers, or client-certificate passwords.

Privacy

Diagnostic targets and results stay on your Mac by default. Selected resolvers and endpoints necessarily receive the requests you ask Exitglass to make. Public-IP, GeoIP, RDAP, speed-test, update, and licensing services are contacted only for their respective features. Read the full privacy policy.

Still need help?

Email support@exitglass.app with your macOS version, Exitglass version, workspace, expected result, and the exact error message. Redact credentials and private data first.