Oh My Zsh is the first thing many developers install on a new Mac or Linux machine. It manages your zsh configuration and adds a library of plugins and themes, so the terminal shows your git branch and status in the prompt, completes commands more helpfully and gives you short aliases for tools you use all day. macOS has used zsh as its default shell since 2019, so it fits straight in.
Turning things on is one line in your ~/.zshrc: pick a theme by name and list the plugins you want, such as git, docker, node, python or macos. It ships with more than 300 plugins and 140 themes, many of them small sets of aliases and completions, and it checks for updates itself every two weeks by default, which you can switch to automatic, reminder-only or off.
The project started in 2009, is MIT-licensed and community-driven, with about 191,000 stars and more than 2,900 contributors. It was started by the team at Planet Argon, a web development agency, and the README links official merchandise.
- Repository: github.com/ohmyzsh/ohmyzsh
- Licence: MIT (MIT License)
- Language: Shell. Stars: 190.6K. Forks: 27.3K. Last push: Nov 9, 2026.
- Scan: safe, Nov 13, 2026, commit 6010fb6
Who it is for
Developers, students and anyone who spends time in a Mac or Linux terminal and wants it friendlier without writing shell config by hand. On Windows it runs inside WSL.
Getting started
1. Install zsh and git first if you do not have them (macOS already has zsh)
zsh --version && git --version2. Run the installer. Read it first if you prefer: it is the same file on GitHub
sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"3. Pick a theme and plugins by editing your config, then open a new terminal
nano ~/.zshrc4. Update whenever you like
omz updateThe installer renames your existing ~/.zshrc to ~/.zshrc.pre-oh-my-zsh and may ask to make zsh your default shell. Too many plugins slow down terminal start-up, so turn on only the ones you use.
Safety scan
We cloned ohmyzsh/ohmyzsh at commit 6010fb6 on Nov 13, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- The one secret hit is not a secret: the dotenv plugin's README shows the words BEGIN RSA PRIVATE KEY to explain multi-line values. No committed binaries across 1,178 files and about 88,000 lines, mostly shell scripts.
- 8 pattern hits, all in opt-in plugins. Six are the transfer plugin, whose purpose is to upload a file you name to transfer.sh, optionally encrypted with gpg first; it only runs when you enable it and call it. Two are the pow plugin restarting the Pow development server through launchctl.
- tools/install.sh is about 600 lines. It clones the repository into ~/.oh-my-zsh, writes a new ~/.zshrc after backing up yours, and offers to change your default shell, using sudo only when chsh needs it. Updates come from the same GitHub repository with git.
- No advisories: the only lockfile is the maintainers' Python helper for checking dependencies. The hosts are GitHub, zsh documentation and links inside plugin docs; we found no analytics service.
- Five workflows and all 7 third-party actions are pinned to commits. One uses pull_request_target to add new pull requests to a project board, with no permissions by default and without checking out the pull request's code. A security policy, Dependabot, CodeQL, contributing guide and code of conduct are present. OpenSSF Scorecard gives it 8.3 out of 10.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | 1 candidate found and read; see the notes above. |
| Suspicious code | 8 pattern hits found and read; every one is listed under the raw findings. |
| Install-time code | 3 installer scripts (one edits your shell profile; one can call sudo) |
| Committed binaries | None. |
| CI workflows | 5 workflows. 1 uses pull_request_target, none check out the pull request head. 0 of 7 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, zdharma-continuum.github.io, zsh.sourceforge.net, www.zsh.org. No URLs to bare IP addresses. |
| Known vulnerabilities | 0 advisories across 7 pinned packages: 0 critical, 0 high, 0 moderate, 0 low. .github/workflows/dependencies/requirements.txt: 7 packages, 0 advisories. |
| Project hygiene | Has security policy, automated dependency updates, CodeQL, licence file, contributing guide. |
| OpenSSF Scorecard | 8.3 out of 10, as of Nov 10, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Secret candidates (1, redacted)
| Where | Rule | Match |
|---|---|---|
| plugins/dotenv/README.md:40 | private-key | -----B…--- (31 chars) |
Pattern hits (8)
| Where | Rule | Match |
|---|---|---|
| plugins/pow/pow.plugin.zsh:79 | persistence | launchctl unload ~/Library/LaunchAgents/cx.pow.powd.plist |
| plugins/pow/pow.plugin.zsh:80 | persistence | launchctl load ~/Library/LaunchAgents/cx.pow.powd.plist |
| plugins/transfer/transfer.plugin.zsh:53 | exfil-host | gpg -aco - | curl -X PUT --progress-bar -T - "https://transfer.sh/$item" >> $tmpfile |
| plugins/transfer/transfer.plugin.zsh:55 | exfil-host | curl --progress-bar --upload-file - "https://transfer.sh/$item" >> $tmpfile |
| plugins/transfer/transfer.plugin.zsh:75 | exfil-host | gpg -cao - "$tarfile" | curl --progress-bar -T "-" "https://transfer.sh/$basename.tar.gz.gpg" >> $tmpfile |
| plugins/transfer/transfer.plugin.zsh:77 | exfil-host | curl --progress-bar --upload-file "$tarfile" "https://transfer.sh/$basename.tar.gz" >> $tmpfile |
| plugins/transfer/transfer.plugin.zsh:83 | exfil-host | gpg -cao - "$item" | curl --progress-bar -T "-" "https://transfer.sh/$basename.gpg" >> $tmpfile |
| plugins/transfer/transfer.plugin.zsh:85 | exfil-host | curl --progress-bar --upload-file "$item" "https://transfer.sh/$basename" >> $tmpfile |
Installer scripts (3)
- plugins/zsh-navigation-tools/doc/install.sh, 71 lines, edits your shell profile; talks to github.com
- tools/install.sh, 606 lines, uses sudo, edits your shell profile; talks to bsky.app, commitgoods.com, crates.io, discord.gg, gist.github.com, github.com, opencollective.com, pubs.opengroup.org, raw.githubusercontent.com, www.apache.org, x.com, zsh.sourceforge.io
- tools/uninstall.sh, 42 lines, edits your shell profile
Workflows worth a look
- .github/workflows/project.yml: pull_request_target
By the numbers
| Stars | 190.6K |
|---|---|
| Forks | 27.3K |
| Contributors | 2,917 |
| Commits | 8,009 |
| Open issues | 82 |
| Open pull requests | 230 |
| Releases | 0 |
| Latest release | none tagged |
| Licence | MIT |
| Main language | Shell |
| Project age | 17 years |
| Last push | Nov 9, 2026 |
| Tracked files | 1,178 |
| Lines of code | 88.1K |
| Checkout size | 8 MB |
Lines by language: Shell 47.2K, JSON 21.6K, Markdown 17.2K, Python 1,328, YAML 731.
Questions
Is Oh My Zsh free?
Yes. It is free and open source under the MIT licence. The merchandise linked in the README is optional.
Does Oh My Zsh work on Windows?
Not in PowerShell or Command Prompt. It runs on macOS, Linux and other Unix systems, and on Windows inside WSL.
How do I uninstall Oh My Zsh?
Run uninstall_oh_my_zsh in the terminal. It removes the framework and restores the ~/.zshrc you had before, if a backup exists.
Will it slow down my terminal?
It can if you enable many plugins. Start with a few, such as git, and add more only when you miss them.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.