OpenWhispr: Private Voice Dictation for Any App (GitHub, Scanned)

OpenWhispr is a dictation app. Press a global hotkey, talk, and the transcribed text is pasted wherever your cursor is, in any app. You choose the engine: local models such as Whisper and NVIDIA Parakeet that keep your audio on the device, or a cloud provider with your own key when you want speed. Around that core it has grown a voice assistant hotkey that sends what you say to GPT, Claude, Gemini or a local model, dictation translation, notes with semantic search, and meeting transcription with speaker labels.

It earns a place as an open-source answer to paid dictation tools like Wispr Flow. Everything core works offline with local models, GPU acceleration covers Metal, CUDA and Vulkan, and it runs on macOS, Windows and Linux. The project is active, with a release most weeks.

Know what you switch on. Meeting transcription records calls, so check that everyone is fine with that; cloud sync, team spaces and shared notes go through OpenWhispr's own service when you sign in; and the assistant can optionally send a screenshot of your screen as context.

• Repository: github.com/OpenWhispr/openwhispr
• Licence: MIT (MIT License)
• Language: JavaScript. Stars: 10K. Forks: 1,287. Last push: Oct 26, 2026.
• Scan: safe, Oct 26, 2026, commit c0639e5

Who it is for

Anyone who types a lot and would rather talk, people who need dictation that never leaves the laptop, and Linux users short on good dictation options.

Getting started

1. macOS: install with the community Homebrew cask (Windows .exe and Linux packages are on the releases page)

brew install --cask openwhispr

2. Or run from source (needs Node.js 24+)

git clone https://github.com/OpenWhispr/openwhispr.git && cd openwhispr && npm install && npm run dev

Safety scan

We cloned OpenWhispr/openwhispr at commit c0639e5 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• All 19 secret hits are fake Slack tokens such as xoxp-secret-token in test files under test/helpers/connectors/, used to test the Slack connector.
• The six persistence hits are one feature: on Linux, pasting text uses ydotool, which needs a daemon. resources/linux/after-install.sh, run by the .deb or .rpm installer, adds a udev rule for /dev/uinput, adds you to the input group and enables a ydotoold user service. That is what lets it type into other apps, and it means any program in that group can simulate input.
• npm hooks: postinstall rebuilds native modules for Electron; the prepack and prebuild steps download whisper.cpp, llama-server, sherpa-onnx, yt-dlp, Qdrant and model files that end up inside the app.
• 24 known advisories across the desktop and mobile lockfiles, none critical: a clean result for an Electron app this size. The bare-IP hits are tests of endpoint validation using private and loopback addresses.
• 17 workflows, none using pull_request_target; only 1 of 21 third-party actions is pinned to a commit. Security policy, Dependabot and CodeQL all present.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: JavaScript 322.9K, TypeScript 250.1K, JSON 62.8K, Swift 16.4K, Markdown 10.5K, C 6,818.

Questions

Is OpenWhispr free?

Yes. It is MIT-licensed and free for personal and commercial use. Local models cost nothing to run; cloud transcription and AI features use your own API keys, and signed-in features such as cloud sync run on OpenWhispr's service.

Does OpenWhispr send my voice to the cloud?

Only if you choose a cloud model. With a local model such as Whisper or Parakeet, transcription happens on your machine and the audio never leaves it.

Does OpenWhispr work on Linux?

Yes, as AppImage, .deb, .rpm and tar.gz builds. Automatic pasting relies on ydotool, which the .deb and .rpm installers configure for you.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.