Skip to content
Product, ScanForge

Find the bugs before they do

A desktop web-application security scanner: 46 detectors, Scope, Intruder, Repeater and Proxy, the Scout interactive browser, AI-assisted triage, live finding verification, scan-over-scan diffing, scheduled scans, CI integration and six report formats. It runs entirely on your machine and your scan data never leaves it.

What you get

Everything unlocked, offline

No per-scan metering, no cloud dependency, and no scan data leaving your machine. The licence is the only thing that talks to a server.

01

46 detectors

OWASP Top 10 plus auth abuse, JWT tampering, IDOR walks, mass assignment, SSRF, SSTI and more, all running in parallel.

02

Scope and Intruder

An allow-list gates every scan and attack, and Intruder fires Sniper, Battering Ram, Pitchfork or Cluster Bomb payloads with processing rules.

03

Scout

Drive a real browser from inside the app: navigate, click, type and scroll through logins and JavaScript apps while every request and response is captured. Hold and edit traffic in flight, then hand any request to Intruder or Repeater.

04

Repeater, Proxy and site map

Edit and resend any request by hand, or race copies of it within a millisecond. Capture traffic from an outside browser or phone through an HTTPS proxy, and see every URL you have touched in one site map.

05

AI triage

Bring any OpenAI-compatible provider, cloud or fully local, and get plain-English explanations, exploitability analysis and remediation guidance per finding. Analyses are stored: generate once, read forever.

06

Sees the real app

A real browser crawls your single-page app, captures screenshot evidence, and can log in like a user: capture the session once, then scan behind authentication.

07

Verify, diff and trend

Re-confirm any finding live with a real request, diff any two scans for regressions, and watch posture improve scan over scan. Findings carry a confidence score, status, an owner and notes.

08

Built for pipelines

Scheduled re-scans, scoped API tokens, baselines and severity-gated exit codes for CI, plus HTML, JSON, SARIF, Markdown, CSV and JSONL reports.

09

Fully offline

Bundled engine, embedded database, offline licensing. Your scan data never leaves your machine, and you can purge a target on demand.

10

Self-managing

Memory guards, retention policies and every engine setting controlled from the app. Scans checkpoint as they run, so an unexpected exit never loses findings.

Downloads

Get ScanForge

Every release that has shipped, newest first. Older versions stay listed and stay downloadable, so a pinned version does not stop working when a new one lands.

IDReleasePlatformVersionDateSizeStatusDownload
SF-2.0.8-MAC-ARM64
ScanForge for macOS
  • Signed with a Developer ID and notarized by Apple.
  • Fixed: in Intruder, a result row's Response and Preview tabs showed their content squeezed into the bottom of the panel; it now fills from the top.
  • Carries the 2.0.6 and 2.0.7 features: themes, captured cookies into Intruder and Repeater, and JSON pretty-print plus find in the request and response views.
  • Downloads its scanning engine on first launch, which needs a connection once. A dropped connection resumes where it left off.
Requires macOS 11 Big Sur or later, Apple silicon
Verify this download
Compare against shasum -a 256 ScanForge-2.0.8-arm64.dmg
ef162e251fdc0ecdc1febf4d06ac7802db7267b21f1f8be8699d916d52d547d5
macOSarm642.0.812 Oct 2026128 MBAvailableDownload
SF-2.0.8-WIN-X64
ScanForge for Windows
  • Includes the scanning engine, so it works offline from the first launch.
  • Fixed: in Intruder, a result row's Response and Preview tabs showed their content squeezed into the bottom of the panel; it now fills from the top.
  • Carries the 2.0.6 and 2.0.7 features: themes, captured cookies into Intruder and Repeater, and JSON pretty-print plus find in the request and response views.
  • Not yet signed with an Authenticode certificate, so Windows SmartScreen warns about an unknown publisher on first run.
Requires Windows 10 or later, 64-bit
Verify this download
Compare against shasum -a 256 ScanForge-2.0.8-Setup.exe
f21eea55f682998e13bfdf02f2c71db578e329241f70acb38131cdde0460150c
Windowsx642.0.812 Oct 2026376 MBAvailableDownload
SF-2.0.7-MAC-ARM64
ScanForge for macOS
  • Signed with a Developer ID and notarized by Apple.
  • Superseded by 2.0.8, which fixes the Intruder Response and Preview tab layout. This build is fine to run.
  • New: the Intruder and Repeater request editors have a find bar (Cmd+F) that highlights and steps through matches, so a large request is searchable.
  • Carries over 2.0.6: themes, captured cookies into Intruder and Repeater, and JSON pretty-print plus search in the response viewers.
  • Downloads its scanning engine on first launch, which needs a connection once. A dropped connection resumes where it left off.
Requires macOS 11 Big Sur or later, Apple silicon
Verify this download
Compare against shasum -a 256 ScanForge-2.0.7-arm64.dmg
84c18aee5853856c20a3f55f40436a9e4f2e35e1417849553426c150686b30ba
macOSarm642.0.711 Oct 2026128 MBAvailableDownload
SF-2.0.7-WIN-X64
ScanForge for Windows
  • Includes the scanning engine, so it works offline from the first launch.
  • Superseded by 2.0.8, which fixes the Intruder Response and Preview tab layout. This build is fine to run.
  • New: the Intruder and Repeater request editors have a find bar (Ctrl+F) that highlights and steps through matches, so a large request is searchable.
  • Carries over 2.0.6: themes, captured cookies into Intruder and Repeater, and JSON pretty-print plus search in the response viewers.
  • Not yet signed with an Authenticode certificate, so Windows SmartScreen warns about an unknown publisher on first run.
Requires Windows 10 or later, 64-bit
Verify this download
Compare against shasum -a 256 ScanForge-2.0.7-Setup.exe
8ce43f141dcfc4ae45845d594d7f49ceefe3fd82596a5d15e4b84934d3cd6d4f
Windowsx642.0.711 Oct 2026376 MBAvailableDownload
SF-2.0.6-MAC-ARM64
ScanForge for macOS
  • Signed with a Developer ID and notarized by Apple.
  • Superseded by 2.0.7, which adds a find bar to the request editors. This build is fine to run.
  • New: themes. Pick from eight built-in themes under Settings, Appearance, including a light one. The choice is remembered and applies with no flicker.
  • Fixed: a request captured in Scout now carries its cookies and full headers into Intruder and Repeater, so replaying an authenticated request works instead of being turned away.
  • The Intruder and Repeater viewers can pretty-print a JSON body and search within it.
  • Downloads its scanning engine on first launch, which needs a connection once. A dropped connection resumes where it left off.
Requires macOS 11 Big Sur or later, Apple silicon
Verify this download
Compare against shasum -a 256 ScanForge-2.0.6-arm64.dmg
76bd65930502d68b1f4e52dd0e5ac54d31e9271bcaa25b7637dfdf4ed7a6ac73
macOSarm642.0.611 Oct 2026128 MBAvailableDownload
SF-2.0.6-WIN-X64
ScanForge for Windows
  • Includes the scanning engine, so it works offline from the first launch.
  • Superseded by 2.0.7, which adds a find bar to the request editors. This build is fine to run.
  • New: themes. Pick from eight built-in themes under Settings, Appearance, including a light one. The choice is remembered and applies with no flicker.
  • Fixed: a request captured in Scout now carries its cookies and full headers into Intruder and Repeater, so replaying an authenticated request works instead of being turned away.
  • The Intruder and Repeater viewers can pretty-print a JSON body and search within it.
  • Not yet signed with an Authenticode certificate, so Windows SmartScreen warns about an unknown publisher on first run.
Requires Windows 10 or later, 64-bit
Verify this download
Compare against shasum -a 256 ScanForge-2.0.6-Setup.exe
4bf05eeffb6956474310eb653660d997e5a968c9eb383c0a7ed2bd1dee075ccd
Windowsx642.0.611 Oct 2026376 MBAvailableDownload
SF-2.0.5-MAC-ARM64
ScanForge for macOS
  • Signed with a Developer ID and notarized by Apple.
  • Superseded by 2.0.6, which adds themes and carries captured cookies into Intruder and Repeater. This build is fine to run.
  • Fixed: HTTPS sites opened through the proxy no longer show as not trusted on an iPhone or Mac. The certificates the proxy makes for each site broke two Apple rules (more than 825 days, and not marked for server use), so Apple rejected them even with the CA fully trusted. A device that already trusts the ScanForge CA needs no changes.
  • The copy buttons on the Proxy page now sit next to the addresses they copy.
  • Downloads its scanning engine on first launch, which needs a connection once. A dropped connection resumes where it left off.
Requires macOS 11 Big Sur or later, Apple silicon
Verify this download
Compare against shasum -a 256 ScanForge-2.0.5-arm64.dmg
fd3bf7a3d04cb8cc631cfec7ed39a9ce1cf7612c136611b0322c075071304bcf
macOSarm642.0.511 Oct 2026128 MBAvailableDownload
SF-2.0.5-WIN-X64
ScanForge for Windows
  • Includes the scanning engine, so it works offline from the first launch.
  • Superseded by 2.0.6, which adds themes and carries captured cookies into Intruder and Repeater. This build is fine to run.
  • Fixed: HTTPS sites opened through the proxy no longer show as not trusted on an iPhone or Mac. The certificates the proxy makes for each site broke two Apple rules (more than 825 days, and not marked for server use), so Apple rejected them even with the CA fully trusted. A device that already trusts the ScanForge CA needs no changes.
  • The copy buttons on the Proxy page now sit next to the addresses they copy.
  • Not yet signed with an Authenticode certificate, so Windows SmartScreen warns about an unknown publisher on first run.
Requires Windows 10 or later, 64-bit
Verify this download
Compare against shasum -a 256 ScanForge-2.0.5-Setup.exe
95b266aef1c445b60ffd844ed75e9daf7a0d2a4f54f10a8654790e0b58bd6192
Windowsx642.0.511 Oct 2026376 MBAvailableDownload
SF-2.0.4-MAC-ARM64
ScanForge for macOS
  • Signed with a Developer ID and notarized by Apple.
  • Superseded by 2.0.5, which fixes HTTPS sites showing as not trusted on an iPhone that uses the proxy. This build is fine to run.
  • Fixed: a scan no longer shows twice in the Scans list when it finishes. While a scan was still writing its reports, the app could take them for a scan run outside it. Opening this version also removes the extra Activity entry this left behind.
  • Downloads its scanning engine on first launch, which needs a connection once. A dropped connection resumes where it left off.
Requires macOS 11 Big Sur or later, Apple silicon
Verify this download
Compare against shasum -a 256 ScanForge-2.0.4-arm64.dmg
166b4618131b878b4aef76903922c7112530d00efb672779958a4e6174f4353b
macOSarm642.0.411 Oct 2026128 MBAvailableDownload
SF-2.0.4-WIN-X64
ScanForge for Windows
  • Superseded by 2.0.5, which fixes HTTPS sites showing as not trusted on an iPhone that uses the proxy. This build is fine to run.
  • Includes the scanning engine, so it works offline from the first launch.
  • Fixed: a scan no longer shows twice in the Scans list when it finishes. While a scan was still writing its reports, the app could take them for a scan run outside it. Opening this version also removes the extra Activity entry this left behind.
  • Not yet signed with an Authenticode certificate, so Windows SmartScreen warns about an unknown publisher on first run.
Requires Windows 10 or later, 64-bit
Verify this download
Compare against shasum -a 256 ScanForge-2.0.4-Setup.exe
6a1e2b05cf2f48de2afba92fe873d7e4145f38d0859dc6cf3f73b0b46996f40a
Windowsx642.0.411 Oct 2026376 MBAvailableDownload
SF-2.0.3-MAC-ARM64
ScanForge for macOS
  • Signed with a Developer ID and notarized by Apple.
  • Superseded by 2.0.4, which stops a finished scan from showing twice in the Scans list. This build is fine to run.
  • Fixed: every Copy button in the app works. In earlier versions they showed Copy failed, because the app's lockdown of system permissions also blocked writing to the clipboard.
  • Fixed: the CA certificate button on the Proxy page saves the certificate as scanforge-proxy-ca.pem. It used to offer an error file named ca.json instead.
  • Downloads its scanning engine on first launch, which needs a connection once. A dropped connection resumes where it left off.
Requires macOS 11 Big Sur or later, Apple silicon
Verify this download
Compare against shasum -a 256 ScanForge-2.0.3-arm64.dmg
084f21c0a09ee26e5ac678b8d94050e022fd998c11abec7577462f54721a70f9
macOSarm642.0.311 Oct 2026128 MBAvailableDownload
SF-2.0.3-WIN-X64
ScanForge for Windows
  • Superseded by 2.0.4, which stops a finished scan from showing twice in the Scans list. This build is fine to run.
  • Includes the scanning engine, so it works offline from the first launch.
  • Fixed: every Copy button in the app works. In earlier versions they showed Copy failed, because the app's lockdown of system permissions also blocked writing to the clipboard.
  • Fixed: the CA certificate button on the Proxy page saves the certificate as scanforge-proxy-ca.pem. It used to offer an error file named ca.json instead.
  • Not yet signed with an Authenticode certificate, so Windows SmartScreen warns about an unknown publisher on first run.
Requires Windows 10 or later, 64-bit
Verify this download
Compare against shasum -a 256 ScanForge-2.0.3-Setup.exe
15506918361fca34de6cf7f8bf277f600a3922224e4c29e02d50342bb27cf032
Windowsx642.0.311 Oct 2026376 MBAvailableDownload
SF-2.0.2-MAC-ARM64
ScanForge for macOS
  • Signed with a Developer ID and notarized by Apple.
  • Superseded by 2.0.3, which fixes the Copy buttons and the CA certificate download. This build is fine to run.
  • Proxy works for phones on the same network: it lists this computer's network addresses, and the iPhone setup page now opens on the address it is actually served from.
  • Reports say what the scan observed instead of guessing: a CVE matched only from a version banner is marked unconfirmed, confidence shows as High, Medium or Low, and the report states whether the scan was signed in and where it hit a limit.
  • Demo mode can run the Standard profile, scan one real target a day, and export reports with a watermark.
  • Scans run from the command line now appear in the app, and New Scan has optional Operator and Authorization fields that go into the report.
  • The assistant finds or asks for the real target instead of trying guessed URLs, and AI triage no longer adds CVE numbers or versions that are not in the finding.
  • Fixed: scans with more than 1,000 findings no longer lose the earliest ones, Intruder no longer sends the same payload twice, payload lists keep entries that start with #, and a bad TLS certificate is reported as a certificate problem instead of an unreachable target.
  • Downloads its scanning engine on first launch, which needs a connection once. A dropped connection resumes where it left off.
Requires macOS 11 Big Sur or later, Apple silicon
Verify this download
Compare against shasum -a 256 ScanForge-2.0.2-arm64.dmg
d5deae1a3dd00c2b98720317f74042f589d811b0bec3a81748dfdc0c19b72c4a
macOSarm642.0.211 Oct 2026128 MBAvailableDownload
SF-2.0.2-WIN-X64
ScanForge for Windows
  • Superseded by 2.0.3, which fixes the Copy buttons and the CA certificate download. This build is fine to run.
  • Includes the scanning engine, so it works offline from the first launch.
  • Proxy works for phones on the same network: it lists this computer's network addresses, and the iPhone setup page now opens on the address it is actually served from.
  • Reports say what the scan observed instead of guessing: a CVE matched only from a version banner is marked unconfirmed, confidence shows as High, Medium or Low, and the report states whether the scan was signed in and where it hit a limit.
  • Demo mode can run the Standard profile, scan one real target a day, and export reports with a watermark.
  • Scans run from the command line now appear in the app, and New Scan has optional Operator and Authorization fields that go into the report.
  • The assistant finds or asks for the real target instead of trying guessed URLs, and AI triage no longer adds CVE numbers or versions that are not in the finding.
  • Fixed: scans with more than 1,000 findings no longer lose the earliest ones, Intruder no longer sends the same payload twice, payload lists keep entries that start with #, and a bad TLS certificate is reported as a certificate problem instead of an unreachable target.
  • Not yet signed with an Authenticode certificate, so Windows SmartScreen warns about an unknown publisher on first run.
Requires Windows 10 or later, 64-bit
Verify this download
Compare against shasum -a 256 ScanForge-2.0.2-Setup.exe
59ce87bc2a3a0300a7399349561bac6efe5f2e1821986f883aae67c9e367e977
Windowsx642.0.211 Oct 2026376 MBAvailableDownload
SF-2.0.1-MAC-ARM64
ScanForge for macOS
  • Signed with a Developer ID and notarized by Apple.
  • Superseded by 2.0.2, which fixes lost findings on very large scans and lets phones use the proxy. This build is fine to run.
  • Demo targets: every link and form now opens a working page, including sign-in, sign-up, cart and dashboard pages, and the six sites have a plainer design. Scans of the React and Next.js demos now confirm their planted open redirect.
  • Proxy shows its listening address plainly, with copy, stop and the certificate download beside it. Notices across the app read as plain text, and the new tools use the same readable type as the rest of the app.
  • Help covers Repeater, Proxy, the site map and the demo targets.
  • Downloads its scanning engine on first launch, which needs a connection once. A dropped connection resumes where it left off.
Requires macOS 11 Big Sur or later, Apple silicon
Verify this download
Compare against shasum -a 256 ScanForge-2.0.1-arm64.dmg
d5bdca456765e5469f773da29edf828cb481fbbcd6e62eb15a62d55417ff3a5b
macOSarm642.0.17 Oct 2026128 MBAvailableDownload
SF-2.0.1-WIN-X64
ScanForge for Windows
  • Superseded by 2.0.2, which fixes lost findings on very large scans and lets phones use the proxy. This build is fine to run.
  • Includes the scanning engine, so it works offline from the first launch.
  • Demo targets: every link and form now opens a working page, including sign-in, sign-up, cart and dashboard pages, and the six sites have a plainer design. Scans of the React and Next.js demos now confirm their planted open redirect.
  • Proxy shows its listening address plainly, with copy, stop and the certificate download beside it. Notices across the app read as plain text, and the new tools use the same readable type as the rest of the app.
  • Help covers Repeater, Proxy, the site map and the demo targets.
  • Not yet signed with an Authenticode certificate, so Windows SmartScreen warns about an unknown publisher on first run.
Requires Windows 10 or later, 64-bit
Verify this download
Compare against shasum -a 256 ScanForge-2.0.1-Setup.exe
81c831d560192b8526582bc726fdb4bc44c130ce297697216d38cc0fcfa1704a
Windowsx642.0.17 Oct 2026376 MBAvailableDownload
SF-2.0.0-MAC-ARM64
ScanForge for macOS
  • Signed with a Developer ID and notarized by Apple.
  • Superseded by 2.0.1, which fixes dead links in the demo targets and tidies the new tools. This build is fine to run.
  • New tools: Repeater edits and resends a request by hand and can race up to 50 copies of it within a millisecond or two. Proxy captures traffic from an outside browser or phone, HTTPS included, through a certificate it makes on your computer. The site map lists every URL that scans, Intruder and Scout have seen, with findings attached.
  • Scout keeps each response with its request, can hold and edit requests and responses in flight, rewrites traffic with match-and-replace rules, records WebSocket frames, and follows popups and file uploads.
  • The scanner adds an insecure-deserialization detector and now catches GraphQL query batching, SSRF payloads that encode the cloud metadata address, and JWT "none" written in any letter case.
  • Redesigned interface: plain status labels in place of badges, larger and higher-contrast text, and settings that use the full window width.
  • Fixed: the trial no longer reports as ended on a computer that still has days left, the scan list says when it cannot reach the engine instead of showing no scans, and the Payloads footer no longer prints [object Object].
  • Downloads its scanning engine on first launch, which needs a connection once. A dropped connection resumes where it left off.
Requires macOS 11 Big Sur or later, Apple silicon
Verify this download
Compare against shasum -a 256 ScanForge-2.0.0-arm64.dmg
65a9e713e0353dcac07735fb7072e0167444f814e5e46a17e2ad849b0110472a
macOSarm642.0.06 Oct 2026128 MBAvailableDownload
SF-2.0.0-WIN-X64
ScanForge for Windows
  • Superseded by 2.0.1, which fixes dead links in the demo targets and tidies the new tools. This build is fine to run.
  • Includes the scanning engine, so it works offline from the first launch.
  • New tools: Repeater edits and resends a request by hand and can race up to 50 copies of it within a millisecond or two. Proxy captures traffic from an outside browser or phone, HTTPS included, through a certificate it makes on your computer. The site map lists every URL that scans, Intruder and Scout have seen, with findings attached.
  • Scout keeps each response with its request, can hold and edit requests and responses in flight, rewrites traffic with match-and-replace rules, records WebSocket frames, and follows popups and file uploads.
  • The scanner adds an insecure-deserialization detector and now catches GraphQL query batching, SSRF payloads that encode the cloud metadata address, and JWT "none" written in any letter case.
  • Redesigned interface: plain status labels in place of badges, larger and higher-contrast text, and settings that use the full window width.
  • Fixed: the trial no longer reports as ended on a computer that still has days left, the scan list says when it cannot reach the engine instead of showing no scans, and the Payloads footer no longer prints [object Object].
  • Not yet signed with an Authenticode certificate, so Windows SmartScreen warns about an unknown publisher on first run.
Requires Windows 10 or later, 64-bit
Verify this download
Compare against shasum -a 256 ScanForge-2.0.0-Setup.exe
d9de4ca5b9066813aa4f157462305ffa07157c2d27e7587e16f789420b7baad9
Windowsx642.0.06 Oct 2026376 MBAvailableDownload
SF-1.1.2-MAC-ARM64
ScanForge for macOS
  • This version is no longer supported and its download has been removed. Install the latest release instead.
  • Signed with a Developer ID and notarized by Apple.
  • Superseded by 2.0.0, which adds Repeater, Proxy and the site map. This build is fine to run.
  • Fixes Intruder marker placement: marking a value in a request captured from Scout put the markers a few characters off, further off the lower down the request you went. Point and selection marking now land where you click.
  • Downloads its scanning engine on first launch, which needs a connection once. A dropped connection resumes where it left off.
Requires macOS 11 Big Sur or later, Apple silicon
Verify this download
Compare against shasum -a 256 ScanForge-1.1.2-arm64.dmg
3ffb03b55e3e9e09143cbc8ae676124f5a9914ce1d36f7ecbb169b8c9b77992c
macOSarm641.1.21 Oct 2026128 MBDegradedNo longer available
SF-1.1.2-WIN-X64
ScanForge for Windows
  • This version is no longer supported and its download has been removed. Install the latest release instead.
  • Superseded by 2.0.0, which adds Repeater, Proxy and the site map. This build is fine to run.
  • Includes the scanning engine, so it works offline from the first launch.
  • Fixes Intruder marker placement for requests captured from Scout.
  • Not yet signed with an Authenticode certificate, so Windows SmartScreen warns about an unknown publisher on first run.
Requires Windows 10 or later, 64-bit
Verify this download
Compare against shasum -a 256 ScanForge-1.1.2-Setup.exe
480b6b9e4415cb1822f2e0eb06edf265952767dc5479bf94980e2cd6c3008335
Windowsx641.1.21 Oct 2026375 MBDegradedNo longer available
SF-1.1.1-MAC-ARM64
ScanForge for macOS
  • This version is no longer supported and its download has been removed. Install the latest release instead.
  • Signed with a Developer ID and notarized by Apple.
  • Superseded by 1.1.2 (Intruder marker-placement fix). This build is fine to run; 1.1.2 just marks captured requests correctly.
  • The first macOS build whose in-app updater works. Every earlier one shipped without the file electron-updater reads on each check, so it could only ever answer that it could not check. Updating from 1.1.0 or earlier means downloading this installer once; after that the app updates itself.
  • Downloads its scanning engine on first launch, which needs a connection once. A dropped connection now resumes where it left off instead of starting again.
  • Licence holders can see the devices using their seats and remove one, from the app or from the website.
  • New signing key. Licences issued before 20 September 2026 do not work with this version and are reissued on request.
Requires macOS 11 Big Sur or later, Apple silicon
Verify this download
Compare against shasum -a 256 ScanForge-1.1.1-arm64.dmg
163170ce8ae6557c2b28c4099e7173bebcdd290d31ee8d7a1092fe96d6b0f3c2
macOSarm641.1.120 Sept 2026128 MBDegradedNo longer available
SF-1.1.0-MAC-ARM64
ScanForge for macOS
  • This version is no longer supported and its download has been removed. Install the latest release instead.
  • Signed with a Developer ID and notarized by Apple.
  • Superseded by 1.1.1, which is the first macOS build that can check for updates. This one installs and runs, but always reports that it could not check.
  • Downloads its scanning engine on first launch, which needs a connection once. A dropped connection now resumes where it left off instead of starting again.
  • Licence holders can see the devices using their seats and remove one, from the app or from the website.
  • New signing key. Licences issued before 20 September 2026 do not work with this version and are reissued on request.
Requires macOS 11 Big Sur or later, Apple silicon
Verify this download
Compare against shasum -a 256 ScanForge-1.1.0-arm64.dmg
12ec3b04dfa84d3cd7f1fdde1ed674b90f861d79ad36ab84cd7eb195184b2113
macOSarm641.1.020 Sept 2026128 MBDegradedNo longer available
SF-1.1.0-WIN-X64
ScanForge for Windows
  • This version is no longer supported and its download has been removed. Install the latest release instead.
  • Includes the scanning engine, so it works offline from the first launch.
  • Not yet signed with an Authenticode certificate, so Windows SmartScreen warns about an unknown publisher on first run.
  • New signing key. Licences issued before 20 September 2026 do not work with this version and are reissued on request.
Requires Windows 10 or later, 64-bit
Verify this download
Compare against shasum -a 256 ScanForge-1.1.0-Setup.exe
f31fcf81f8941d42c5d454dc9f87260aa20a948829b496d658c10bd26bfcb16f
Windowsx641.1.020 Sept 2026375 MBDegradedNo longer available
SF-1.0.0-WIN-X64
ScanForge for Windows
  • This version is no longer supported and its download has been removed. Install the latest release instead.
  • Includes the scanning engine, so it works offline from the first launch.
  • Not yet signed with an Authenticode certificate, so Windows SmartScreen warns about an unknown publisher on first run.
  • Superseded by 1.1.0. This build verifies against the previous signing key, so it cannot activate a current licence. Install 1.1.0 instead.
Requires Windows 10 or later, 64-bit
Verify this download
Compare against shasum -a 256 ScanForge-1.0.0-Setup.exe
382c4a14a441315e1abe44bdd39d3c935cc58f4df30002f9737821d17a63f370
Windowsx641.0.019 Sept 2026375 MBDegradedNo longer available
SF-1.0.0-MAC-ARM64
ScanForge for macOS
  • This version is no longer supported and its download has been removed. Install the latest release instead.
  • Signed with a Developer ID and notarized by Apple.
  • Downloads its scanning engine on first launch, which needs a connection once.
  • Superseded by 1.1.0. This build verifies against the previous signing key, so it cannot activate a current licence and can no longer fetch its engine. Install 1.1.0 instead.
Requires macOS 11 Big Sur or later, Apple silicon
Verify this download
Compare against shasum -a 256 ScanForge-1.0.0-arm64.dmg
d926affd2bd4b5400bb747a74356640282a505b5ae5949d6ead840d2c54afb07
macOSarm641.0.018 Sept 2026128 MBDegradedNo longer available

The app updates itself once installed, so this page is for the first install and for anyone who needs a specific version. On first launch it downloads its scanning engine, about 154MB, which needs a connection once. Scanning itself never does.

Pricing

One licence, device bound

Billing period

All prices in Nigerian naira. Charged through Paystack.

Free Trial

₦014 days

Full Pro capabilities for two weeks. No payment required.

  • All 46 detectors
  • All scan profiles
  • Scout, Repeater, Proxy and AI triage
  • Intruder and reports
  • 1 seat

Pro

₦720,000per year

For the individual pentester. One seat, everything unlocked.

  • All 46 detectors, all scan profiles
  • Unlimited scans and Intruder
  • Scout browser, Repeater and Proxy
  • AI triage with your own provider
  • Verify, diff and finding triage
  • Authenticated scans via browser login
  • 3 scheduled scans, 2 API tokens
  • All 6 report formats
  • 1 seat, email support
Most popular

Team

₦2,864,000per year

For small security teams, with five device-bound seats.

  • Everything in Pro
  • Up to 5 device-bound seats
  • Priority email support

Enterprise

₦9,584,000per year

For larger teams: volume seats, procurement and onboarding.

  • Everything in Team
  • Unlimited scheduled scans and API tokens
  • 25 seats
  • Invoicing and purchase orders
  • Onboarding and an SLA
Get your license key

A key in seconds.

Get a key here, then in ScanForge open the license badge, choose Activate, and paste it. The free trial unlocks full Pro features for 14 days.

A licence is bound to the devices it is activated on, so it is yours rather than shareable. You can release a seat from the app when you move to a new machine.

Your key is emailed here as well as shown on screen.

Start here

Questions before you buy?

Tell us what you are scanning and we will tell you honestly whether ScanForge is the right tool for it. Email [email protected].