Czkawka (Polish for hiccup) is a set of tools for clearing out a disk. It finds exact duplicates by name, size or hash, similar images even after resizing or watermarking, similar videos and music, empty files and folders, big files, broken files, invalid symlinks and files whose extension does not match their contents. It is written in Rust, runs scans across all your cores, and caches results so the second scan is much faster than the first.
The project now has a new face. Krokiet is the current desktop app, built with Slint, and the older GTK app called Czkawka has had its last release at 12.0; both share the same core, and a command-line version and an Android app called Cedinia use it too. The README is explicit that none of them has access to the internet or collects statistics.
It shows you what it found and lets you choose what to delete, so the usual care applies: check before you remove. The similar videos tool needs FFmpeg installed, and some image formats such as HEIF and RAW only work in builds compiled with those features.
- Repository: github.com/qarmin/czkawka
- Licence: custom (Other)
- Language: Fluent. Stars: 34.5K. Forks: 1,232. Last push: Sep 16, 2026.
- Scan: safe, Oct 26, 2026, commit eb8b91d
Who it is for
Anyone whose drive or photo library has filled up with copies and leftovers, and people who want a duplicate finder that works the same on Linux, Windows and macOS.
Getting started
1. Easiest: download Krokiet for Windows, macOS or Linux from the releases page. Or build it with Rust:
cargo install krokiet --locked2. Command line: list duplicate files in a folder by hash and save the results
czkawka_cli dup -d ~/Pictures -s hash -f results.txtFor the similar videos tool, install FFmpeg first (brew install ffmpeg on macOS, sudo apt install ffmpeg on Ubuntu).
Safety scan
We cloned qarmin/czkawka at commit eb8b91d on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no committed binaries and no bare-IP URLs. The network list is short and almost all github.com, which fits the README's claim that the apps never go online.
- The one pattern hit is misc/docker/Dockerfile running the official rustup installer to set up a build image.
- misc/install_scripts/install_linux.sh asks to be run as root because it installs the packages needed to compile the project; it is a developer convenience, not part of the apps. Four build.rs files are ordinary Rust build steps.
- Five known advisories in Cargo.lock plus 13 unrated. The critical one is in the zip crate's extract functions, which apply Unix permissions through symlinks; it matters for unpacking untrusted archives.
- Five workflows, none using pull_request_target; none of the 9 third-party actions is pinned to a commit. OpenSSF Scorecard rates it 4.1 out of 10, mostly for missing branch protection and token permissions. No security policy, Dependabot or CodeQL.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | 1 pattern hit found and read; every one is listed under the raw findings. |
| Install-time code | 4 Cargo build scripts. 3 installer scripts (one can call sudo) |
| Committed binaries | None. |
| CI workflows | 5 workflows. None use pull_request_target. 9 of 9 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 10 distinct hosts referenced from source; most often github.com, raw.githubusercontent.com, ffmpeg.org, fftrac-bg.ffmpeg.org. No URLs to bare IP addresses. |
| Known vulnerabilities | 18 advisories across 983 pinned packages: 1 critical, 4 high, 0 moderate, 0 low, 13 unrated. Cargo.lock: 983 packages, 18 advisories. |
| Project hygiene | Has none of the usual files. Missing security policy, automated dependency updates, CodeQL, licence file, contributing guide. |
| OpenSSF Scorecard | 4.1 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Pattern hits (1)
| Where | Rule | Match |
|---|---|---|
| misc/docker/Dockerfile:9 | download-piped-to-shell | RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y # Download the latest stable Rust |
Installer scripts (3)
- misc/install_scripts/install_linux.sh, 73 lines, uses sudo
- misc/install_scripts/install_macos.sh, 32 lines; talks to raw.githubusercontent.com
- misc/run_checks.sh, 31 lines
Worst known vulnerabilities (18 of 18)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-4684-h2q9-2vcp | critical | zip@8.6.0 | ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the targe… |
| RUSTSEC-2026-0194 | high | quick-xml@0.37.5 | Quadratic run time when checking a start tag for duplicate attribute names |
| RUSTSEC-2026-0195 | high | quick-xml@0.37.5 | Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service |
| RUSTSEC-2026-0344 | high | ruzstd@0.8.3 | Decompression bomb in `ruzstd`: a tiny input can exhaust memory (OOM) |
| GHSA-vv5m-jxxh-4627 | high | zip@8.6.0 | Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation |
| RUSTSEC-2026-0374 | unknown | basic-toml@0.1.10 | `basic-toml` is unmaintained |
| RUSTSEC-2025-0141 | unknown | bincode@1.3.3 | Bincode is unmaintained |
| RUSTSEC-2025-0141 | unknown | bincode@2.0.1 | Bincode is unmaintained |
| RUSTSEC-2026-0385 | unknown | ctutils@0.4.2 | Non-constant-time mask generation and `u128` comparisons |
| RUSTSEC-2026-0221 | unknown | event-listener@5.4.1 | `event-listener` allows `!Send` tags to cross thread boundaries via `StackSlot` |
| RUSTSEC-2024-0436 | unknown | paste@1.0.15 | paste - no longer maintained |
| RUSTSEC-2026-0206 | unknown | rustybuzz@0.20.1 | `rustybuzz` is unmaintained |
| RUSTSEC-2026-0192 | unknown | ttf-parser@0.25.1 | `ttf-parser` is unmaintained |
| GHSA-2ph8-5cr8-hr33 | unknown | webbrowser@1.2.1 | Unix `BROWSER` handling allows browser argument injection |
| RUSTSEC-2026-0371 | unknown | zbus_names@4.3.4 | `zbus_names` is unmaintained |
| GHSA-4v9h-p7m9-rh26 | unknown | zip@8.6.0 | zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination director… |
| RUSTSEC-2026-0370 | unknown | zvariant@5.13.1 | `zvariant` is unmaintained |
| RUSTSEC-2026-0372 | unknown | zvariant_derive@5.13.1 | `zvariant_derive` is unmaintained |
By the numbers
| Stars | 34.5K |
|---|---|
| Forks | 1,232 |
| Contributors | 96 |
| Commits | 743 |
| Open issues | 332 |
| Open pull requests | 22 |
| Releases | 43 |
| Latest release | 12.0.2 |
| Licence | custom |
| Main language | Fluent |
| Project age | 6 years |
| Last push | Sep 16, 2026 |
| Tracked files | 675 |
| Lines of code | 76.4K |
| Checkout size | 11 MB |
Lines by language: Rust 64.1K, Markdown 6,364, Python 2,712, YAML 1,029, TOML 840, Java 798.
Questions
Is Czkawka free?
Yes, and without ads. The core library, the CLI and the GTK app are MIT; Krokiet and the Android app Cedinia are GPL-3.0, and the icons are CC BY 4.0.
What is the difference between Czkawka and Krokiet?
Krokiet is the newer desktop app built with Slint and is the one to install now. Czkawka's GTK app had its last release at 12.0 and no new builds are planned. Both use the same scanning core, so results are the same.
Will Czkawka delete files on its own?
No. It lists what it found and you choose what to delete, move or hard-link. Review the selection before confirming, especially with similar-image results, where near matches are not always copies you want gone.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.