Any app that corrects your typing needs macOS's Accessibility permission, which is powerful by design. So the real question is what the app does with it. A trustworthy switcher processes keystrokes on your Mac, sends nothing anywhere, can't see password fields, and lets you verify all of that. Unfumble is built that way: on-device processing, no accounts, and network use limited to license checks and signed updates.
Why a layout switcher needs Accessibility
To turn akuo into שלום, an app has to do three things:
see the keystrokes as they arrive, replace the characters already in the text field, and switch the
input source. On macOS, the first two go through the Accessibility API — the same interface screen
readers and dictation tools use. There is no narrower permission that lets an app fix text inside
another app. That's why Unfumble asks for exactly one permission and nothing else: no contacts,
files, calendar, camera, or microphone.
What the permission allows, in plain terms
- Read text and interface elements in other apps. That's how it knows what's in the field you're typing into.
- Send keystrokes and edits. That's how it replaces the wrong-layout word in place.
- Observe keystrokes system-wide. That's how it sees the word as you type it.
What it doesn't do: it grants no access to your files, photos or contacts, it doesn't unlock the camera or microphone, and it says nothing about the network. Any app can use the network without asking — which is exactly why you should be able to watch what a keyboard tool does with it.
What it can never touch: secure input
macOS has a special mode for sensitive fields. Password fields in Safari and native apps, password managers, and Terminal when Secure Keyboard Entry is on all use it. In secure input mode the system stops delivering keystrokes to Accessibility clients altogether. No switcher — Unfumble included — can read or change what you type there. That's enforced by macOS, not by the app's good behaviour.
How to verify any switcher yourself
- See what it was granted. System Settings → Privacy & Security → Accessibility lists every app with the permission. A keyboard switcher belongs there. If it's also asking for Full Disk Access or Screen Recording, ask why.
- Watch its network. Open Activity Monitor's Network tab, or a firewall such as Little Snitch or LuLu, and type for a while. A switcher that works on-device stays quiet. Unfumble reaches out only to activate or validate a license and to check for signed updates, and nothing you type is included in those requests.
- Confirm it's notarized. Apple scans notarized apps for malware before they're
allowed to run, and macOS checks the signature at every launch. In Terminal:
A notarized app reportsspctl -a -vv /Applications/Unfumble.appacceptedwithsource=Notarized Developer ID. - Look for accounts and telemetry. An app that needs you to sign in, or that "improves suggestions" by uploading text, is doing something in the cloud. Read the privacy policy and look for the words on-device.
How Unfumble handles your keystrokes
- Evaluated locally, then discarded. Keystrokes are checked on your Mac against bundled dictionaries, only for as long as it takes to decide whether the current word needs fixing. They're never stored as text or transmitted.
- Your exceptions are a plain file. The words you tell it to leave alone are kept as
readable JSON at
~/Library/Application Support/Unfumble/learning.json, which you can open or delete any time. - Learning from your screen is opt-in. It's off until you turn it on. When on, it keeps individual words and how often they appear — never sentences or where they came from — encrypted with a key held in the macOS Keychain, and you can erase it all in Settings ▸ Learning.
- Network use is limited to licensing and updates. Payments are handled by the reseller Lemon Squeezy; updates are signed. There's no analytics inside the app.
- Signed and notarized by Apple. Every release carries an Apple Developer ID signature and passes Apple's notarization scan.
- Easy to stop. Turning it off is one switch in the Accessibility list; uninstalling is dragging it to the Trash.
The full details are in the privacy policy, written in plain language.
Questions to ask of any tool that reads your typing
- Where is the processing done — on the Mac, or on a server?
- Does it need an account?
- What does it store, and can I see or delete it?
- Can I watch its network activity, and is it quiet while I type?
- Is it notarized by Apple?
- Can I pause it in a specific app?
Frequently asked questions
Is Unfumble a keylogger?
No. A keylogger records what you type and sends it somewhere. Unfumble reads the current word to decide whether to correct it and then discards it; nothing is recorded as text or transmitted. You can verify this with a network monitor.
Can a keyboard switcher see my passwords?
No. Password fields use secure input, a macOS mode that stops delivering keystrokes to Accessibility clients. No switcher can read or change what you type there.
Why does macOS warn me when I grant Accessibility access?
The warning is identical for every app that asks, from screen readers to window managers, because the permission is broad. It's a reason to verify the app, not a verdict on it.
Can IT approve the permission for a whole team?
Yes. Accessibility access can be pre-approved with an MDM configuration profile so people never see the prompt. See Unfumble for teams and IT.
Private by design
Unfumble switches your keyboard language on your Mac, for your Mac. No accounts, no cloud, nothing you type leaves the machine. Free for your first 100 fixed words.
macOS 13 Ventura or later · Apple silicon and Intel · Signed and notarized by Apple