whisper.cpp: Fast, Private Speech to Text (GitHub, Scanned)

whisper.cpp runs OpenAI's Whisper speech recognition models without Python or PyTorch. It is plain C and C++ on the same ggml library that powers llama.cpp, so it gets the same treatment: Metal on Apple Silicon, CUDA, Vulkan, ROCm, Core ML for the Neural Engine, and integer quantization that shrinks a model to a fraction of its size. The whisper-cli tool transcribes a file, whisper-stream transcribes the microphone live, and whisper-server exposes an OpenAI-style HTTP transcription API.

It earns its place for being the transcription engine inside a long list of desktop dictation and captioning apps, and for running where the Python original will not: iPhones, Android, a Raspberry Pi, a browser tab through WebAssembly. It started as Georgi Gerganov's port and now lives under ggml-org with more than 1,000 contributors. MIT-licensed, like the Whisper models themselves.

• Repository: github.com/ggml-org/whisper.cpp
• Licence: MIT (MIT License)
• Language: C++. Stars: 53.9K. Forks: 6,195. Last push: Sep 24, 2026.
• Scan: safe, Sep 24, 2026, commit d09f61a

Who it is for

Anyone who wants transcripts or subtitles without uploading audio, developers embedding speech recognition in an app or device, and people for whom the Python Whisper is too slow or too heavy to install.

Getting started

1. Clone the repository

git clone https://github.com/ggml-org/whisper.cpp.git && cd whisper.cpp

2. Download a model converted to ggml format

sh ./models/download-ggml-model.sh base.en

3. Build, then transcribe the bundled sample

cmake -B build && cmake --build build -j --config Release && ./build/bin/whisper-cli -f samples/jfk.wav

whisper-cli reads 16-bit WAV. Convert anything else first, as the README shows: ffmpeg -i input.mp3 -ar 16000 -ac 1 -c:a pcm_s16le output.wav. The download script fetches weights from the project's Hugging Face repository.

Safety scan

We cloned ggml-org/whisper.cpp at commit d09f61a on Sep 24, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No secrets, no pattern hits and no bare-IP URLs across about 525,000 lines of C, C++, CUDA and Metal.
• The three scripts listed as installers are ci/run.sh, the CI test driver; a 24-line launcher inside an experimental ggml back end; and scripts/deploy-wasm.sh, which publishes the WebAssembly demos. None uses sudo, edits a shell profile or pipes a download to a shell.
• 15 committed binaries. Twelve are model files prefixed for-tests- (14 KB to 885 KB), which the models README describes as containing no weights and existing for the CI's sanitizer tests. The other three are Gradle wrapper jars for the Java binding and the Android examples.
• All 62 known advisories (2 critical, 33 high) are in examples/addon.node/package-lock.json, the Node.js addon example, whose only dependencies are the dev tools cmake-js, Jest and node-addon-api. The Go binding's seven packages have none, and the C/C++ library vendors what little it uses.
• 22 workflows, none using pull_request_target; 16 of 41 third-party actions are pinned to a commit. Licence and contributing guide present; unlike llama.cpp there is no security policy, and no Dependabot or CodeQL.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: C++ 240.5K, C/C++ header 100K, C 92.5K, CUDA 26.4K, Metal 12.3K, GLSL 7,984.

Questions

Is whisper.cpp free?

Yes. whisper.cpp is MIT-licensed and free for any use, including commercial products, and the Whisper models it runs were released by OpenAI under MIT as well. There is no paid tier and no account. The converted models download from the project's Hugging Face repository, also free.

What is the difference between whisper.cpp and OpenAI Whisper?

They run the same models. OpenAI's repository is the Python reference implementation on PyTorch, convenient in notebooks and research code. whisper.cpp is a rewrite in C/C++ with no Python, quantized models and hardware back ends, so it starts instantly, uses less memory and is usually much faster on CPUs and Apple Silicon. Accuracy is essentially the same for the same model size.

What hardware does whisper.cpp need?

Less than you would expect. By the README's table the tiny model needs about 273 MB of memory, base about 388 MB, medium about 2.1 GB and large about 3.9 GB. It runs on a CPU alone, including a Raspberry Pi; a GPU or Apple Silicon makes the large models fast enough for real-time work.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.