Ghostty is a terminal emulator that refuses the usual trade-off. Fast terminals tend to look foreign on your desktop, and native ones tend to be slow; Ghostty draws with the GPU and still uses the platform's own interface, a Swift app on macOS and GTK on Linux, so tabs, splits, windows and settings behave the way the rest of your computer does. It works well with no configuration at all, and when you want to change something there is one plain text file.
It was started by Mitchell Hashimoto, a co-founder of HashiCorp, and has grown to about 63,000 stars and 693 contributors. Version 1.4.0 is current. It supports the modern terminal features that tools now lean on, including the Kitty graphics protocol for images in the terminal, and the same engine ships as libghostty, a C and Zig library other apps can embed. There is no Windows build.
- Repository: github.com/ghostty-org/ghostty
- Licence: MIT (MIT License)
- Language: Zig. Stars: 63.3K. Forks: 3,813. Last push: Nov 3, 2026.
- Scan: safe, Nov 3, 2026, commit 091beb9
Who it is for
Developers who live in the terminal on a Mac or Linux machine, people running coding agents in several panes at once, and anyone who has tried iTerm2 or the stock Terminal and wants something faster.
Getting started
1. macOS: download the universal app (macOS 13 or later), or use Homebrew
brew install --cask ghostty2. Linux: pick your distribution's package on the download page
https://ghostty.org/download3. Optional: open the config file to change fonts, themes and keys
ghostty +show-config --default --docsGhostty runs on macOS and Linux only. The defaults are good; most people change nothing more than a font or a theme.
Safety scan
We cloned ghostty-org/ghostty at commit 091beb9 on Nov 3, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secret hits and no pattern hits across 5,932 files. No binaries committed, and no install scripts or build hooks that run on your machine when you download the app.
- No lockfiles the scanner can check: Zig dependencies are pinned by hash in build.zig.zon, so there is nothing for an advisory database to match.
- 15 workflows, with 213 of 218 third-party action uses pinned to commits. Two use pull_request_target, for milestones and for the project's contributor vouching check, and neither checks out the pull request's code. Dependabot and a licence are present; no security policy file.
- Network hosts in the code are documentation links and Ghostty's own release and update hosts (release.files.ghostty.org, tip.files.ghostty.org). Nothing reports usage.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 15 workflows. 2 use pull_request_target, none check out the pull request head. 5 of 218 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 33 distinct hosts referenced from source; most often github.com, ghostty.org, developer.apple.com, lists.gnu.org. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has automated dependency updates, licence file, contributing guide. Missing security policy, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Workflows worth a look
- .github/workflows/milestone.yml: pull_request_target
- .github/workflows/vouch-check-pr.yml: pull_request_target
By the numbers
| Stars | 63.3K |
|---|---|
| Forks | 3,813 |
| Contributors | 693 |
| Commits | 18.6K |
| Open issues | 136 |
| Open pull requests | 125 |
| Releases | 1 |
| Latest release | none tagged |
| Licence | MIT |
| Main language | Zig |
| Project age | 4 years |
| Last push | Nov 3, 2026 |
| Tracked files | 5,932 |
| Lines of code | 120.4K |
| Checkout size | 93 MB |
Lines by language: C/C++ header 49.6K, Swift 38.6K, Python 12K, YAML 5,204, Markdown 3,352, C 3,341.
Questions
Is Ghostty free?
Yes. It is MIT-licensed open source with no paid tier, no account and no sign-in.
Does Ghostty work on Windows?
No. It runs on macOS 13 or later and on Linux. On Windows, Windows Terminal or WezTerm are the closest options.
Ghostty or iTerm2?
iTerm2 has more features built over many years. Ghostty is faster, starts instantly, needs almost no setup and runs on Linux too. Many people switch for the speed and the cleaner defaults.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.