One command.
Zero mystery.
The Cratefox setup is a single line you paste once. This page is the plain-English account of exactly what that line does to your machine: what gets installed, every folder it touches, every network call it makes, and how to remove all of it. The scripts themselves are public: install.sh (Mac) and install.ps1 (Windows).
First things first: leaving is one line too
Before you trust an installer, know the exit. Paste this and Cratefox is gone completely (your downloaded music stays where it is):
echo "Removing Cratefox…"; launchctl bootout gui/$(id -u)/com.dwnhlpr.app 2>/dev/null; launchctl bootout gui/$(id -u)/com.dwnhlpr.slskd 2>/dev/null; rm -rf ~/dwnhlpr ~/Library/LaunchAgents/com.dwnhlpr.*.plist; echo "✓ Cratefox fully removed. Thanks for trying it."Get-CimInstance Win32_Process -Filter "Name='pythonw.exe' OR Name='slskd.exe'" | Where-Object { $_.CommandLine -like '*\dwnhlpr\*' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }; Write-Host "Cratefox stopped (it starts again next login)."Verify the bytes before you run anything
Your browser just downloaded both scripts from this site and hashed them locally (nothing was sent anywhere). If you fetch the script yourself and the hash matches, you are running exactly the code shown here.
computing in your browser...computing in your browser...Check it on your own machine
curl -fsSL https://cratefox.app/install.sh | shasum -a 256iwr https://cratefox.app/install.ps1 -OutFile "$env:TEMP\install.ps1"; Get-FileHash "$env:TEMP\install.ps1" -Algorithm SHA256The hash changes whenever we update the installer, that is expected. What matters: your download and this page agree at the same moment.
What the command actually does
| Step | What happens | What it touches |
|---|---|---|
| 1. Checks your code | Asks cratefox.app once whether your invite code is valid, sending a one-way hashed hardware id so your code locks to this Mac. The raw hardware id never leaves your machine. | Network: cratefox.app only |
| 2. Homebrew + Python | Installs Homebrew if you do not have it (this is the one moment macOS asks for your login password), then Python and tesseract via brew. | /opt/homebrew |
| 3. Downloads the app | Pulls the Cratefox app from cratefox.app and the open-source slskd Soulseek engine from its official GitHub releases. | Network: cratefox.app, github.com |
| 4. Creates your identity | Generates a random throwaway Soulseek account, a random engine-panel login, and a random API key. Nothing is registered with your name or email, and these are stored only in a file readable by your user alone. | ~/dwnhlpr/slskd/slskd.yml (chmod 600) |
| 5. Installs everything | App, Python environment, and engine live in one folder. Shared with the Soulseek community: only your Cratefox downloads folder, never your library. | ~/dwnhlpr/ |
| 6. Starts on login | Two per-user launch agents start the app and engine at login and restart them if they crash. No system daemons, nothing outside your user account. | ~/Library/LaunchAgents/com.dwnhlpr.*.plist |
| 7. Opens the app | Your browser opens the app running at localhost. Done. | localhost only |
Admin password: asked once, by macOS itself, only if Homebrew needs installing. The script never sees or stores it.
| Step | What happens | What it touches |
|---|---|---|
| 1. Checks your code | Asks cratefox.app once whether your invite code is valid, sending a one-way hashed hardware id so your code locks to this PC. The raw hardware id never leaves your machine. | Network: cratefox.app only |
| 2. Python | Installs Python via winget if missing (with guards against the fake Microsoft Store alias). No administrator rights are required for any step. | Per-user Python install |
| 3. Downloads the app | Pulls the Cratefox app from cratefox.app and the open-source slskd Soulseek engine (win-x64) from its official GitHub releases. | Network: cratefox.app, github.com |
| 4. Creates your identity | Generates a random throwaway Soulseek account, a random engine-panel login, and a random API key. Nothing is registered with your name or email. | %USERPROFILE%\dwnhlpr\slskd\slskd.yml |
| 5. Installs everything | App, Python environment, and engine live in one folder. Shared with the Soulseek community: only your Cratefox downloads folder, never your library. | %USERPROFILE%\dwnhlpr\ |
| 6. Firewall, narrowly | Adds one inbound firewall rule scoped to the engine program AND its Soulseek peer port only. The engine panel is not opened to your network. | One named Windows Firewall rule |
| 7. Starts on login | Two shortcuts in your user Startup folder launch the app and engine at logon. No services, no scheduled tasks, no registry autoruns. | shell:startup .lnk files |
Honest status: the Windows script is fully code-reviewed and its own header says it is still being proven on real Windows machines. If anything trips, hey@cratefox.app fixes it fast.
Why macOS may warn you anyway
Why Windows may warn you anyway
Gatekeeper warns about software from developers it does not recognize. Cratefox is a small indie tool without an Apple Developer certificate yet (a signed one-click app is the roadmap, and the tip jar literally funds the certificate). The warning means "Apple has not vouched for this", not "this is malicious". That is exactly why this page and the live checksums exist: so you can vouch for the bytes yourself.
SmartScreen warns about software it has not seen often enough to build a reputation for. Cratefox is a small indie tool without a code-signing certificate yet. The warning means "Windows has not seen this much", not "this is malicious". That is exactly why this page and the live checksums exist: so you can vouch for the bytes yourself.
What it will never do
- No account, no email, no password of yours is ever asked for or stored.
- Your existing music library is never scanned, uploaded, or shared.
- No telemetry from the app: the only server call is the one-time code check (plus the tracks you point it at, fetched directly).
- Everything lives in one folder, and the one-line remove at the top of this page deletes all of it.