Play local files, direct URLs, or video handed off from the built-in browser. Save what you are streaming, encrypt it with a password if you want to, and caption it live through a service you run yourself. AVFoundation and WKWebView, nothing else.
macOS 15 or later (Apple silicon) · iOS and iPadOS 18 or later.
Version 1.6.7 (build 32) · 14 MB · Apple silicon
Direct download for macOS. Includes the shhh-cli command-line tool, which the App Store build cannot ship because a terminal tool that takes arbitrary file paths cannot be sandboxed.
Not notarised yet: on first launch macOS blocks it, and you allow it once in System Settings → Privacy & Security. The documentation walks through it.
SHA-256: cccb0e0a591c2cab28810ef2f265e323a9aa1408f2504ba49261d21b13b5a943
Read the documentation →A small set of things, each done properly.
Playback history, resume points, the recent-files list and the thumbnail cache are not written unless you turn them on. One switch controls all of it, and turning it back off clears what was recorded.
Turn any local video into an encrypted .shhh file — chunked ChaCha20-Poly1305 with PBKDF2 and HKDF key derivation. Playback decrypts in memory as it streams, with normal seeking; the unprotected video is never written back to disk.
Playing a direct URL or a video handed off from the built-in browser? Save it to any folder from the control bar, and tick one box to encrypt it as it downloads. HLS streams are saved by joining their segments into a single playable file, and every request carries the same headers as playback, so sources that check them still work.
Short audio windows go to a Caption Service you configure — your own endpoint, your own model. No speech model ships inside the app, and the service only ever receives audio and timing, never the media URL, cookies or browser headers.
Browse in a neutral window with an ad and tracker content blocker, then hand a video to the player. Media candidates are found generically by scoring what the page exposes; no site-specific scrapers ship with the app.
AVFoundation and AVPlayer for playback, WKWebView for browsing. No libmpv, no FFmpeg, no third-party copyleft engine. Hardware-accelerated decoding and Retina rendering on Apple silicon.
Three steps, and the download keeps up with what you are watching
Open a direct media URL, or hand a video off from the built-in browser. The save control appears in the control bar as soon as the source is network media.
Choose where it goes, and tick Encrypt this download if you want a password on it. Progressive files and HLS both work; the download carries the same request headers as playback.
Playback is unaffected while the file is written. Hover the control to see how much has landed and how fast, and the finished copy plays back from disk.
Five things worth knowing on day one
Drop a file onto the window, or use Open File. On iPhone and iPad, Open File reads from the Files app. Multiple files open in their own windows on Mac — there is no shared playlist to leak what you queued.
Open URL takes a direct media link such as an .mp4 or .m3u8. Nothing is recorded, and the address is not kept after playback ends.
Open Web, navigate normally, then pick a detected video. ShhhPlay carries the page's Referer and User-Agent into playback, which is what makes sources that check them work.
While a network video plays, press Save in the control bar, choose a folder, and tick Encrypt this download. Pick a password of at least 12 characters. The result is a .shhh file that only opens with that password — and it is encrypted as it downloads, so the plain video never touches the disk.
Captions need a Caption Service you supply — any endpoint compatible with the OpenAI audio transcription API, including one running on your own machine. Enter its address in Caption Service, then turn captions on during playback.
Encrypt and restore from the terminal
The direct download bundles a command-line tool for the same encrypted format the app reads. It prompts for the password with no echo; automation can pipe one in with --password-stdin, and there is deliberately no plaintext --password flag. The App Store build cannot include it, because a terminal tool that accepts arbitrary paths cannot be sandboxed.
shhh-cli encrypt video.mp4 shhh-cli play video.mp4.shhh shhh-cli decrypt video.mp4.shhh
Native playback, encrypted media, and saving that keeps up with what you are watching.
Download on the App Store