A screenshot tool for macOS, Windows, and Linux — free, open source, and cross-platform from its first commit rather than as a later port.
Scrozz is alpha software. Downloadable test builds are available from GitHub Releases, but no version should be relied on for daily work yet.
On macOS it takes real screenshots today, from the menu bar and the command line. On Windows and Linux there is substantial, compiling, CI-tested implementation — but no human has yet sat down and used Scrozz as an application on either. Until someone has, this README will not call them supported. The status table below is exact about which is which.
Scrozz captures your screen and puts the result somewhere useful — on the clipboard, in a file, or dragged straight into whatever app you are already working in.
The part that makes it unusual is not the capture. It is that the
cross-platform core existed in the first commit, before any platform was
finished. macOS-first-then-port is how tools quietly become macOS-only: platform
assumptions get baked into the core long before anyone notices. So all three
backends compile on every push, and the interface is rendered and pixel-diffed
on all three in CI — the reasoning is in
docs/decisions.md (D3) and the machinery in
docs/platforms.md.
macOS is polished first because it is the maintainer's daily driver, and dogfooding is what actually gets an app finished.
Read this as a map of what is proven, not what is planned.
Verification levels
- ✅ Works — implemented, and used by a human on real hardware.
- 🟡 Implemented, not confirmed by hand — real code against the real platform API, covered by automated tests. On Windows and Linux that means it compiles for the target, links, and passes the suite on that platform's CI runner — nobody has run it as an app.
- 🟠 Partial — some of the pieces exist; the feature does not yet stand up end to end.
- ⬜ Not started — types and contracts only, or nothing at all.
- 🚫 Not available, by design — the platform genuinely cannot, and Scrozz says so rather than failing silently (D8).
| Area | macOS | Windows | Linux | Notes |
|---|---|---|---|---|
| Screen / display capture | ✅ | 🟡 | 🟡 | ScreenCaptureKit · Windows.Graphics.Capture · X11 + desktop portal |
| Window & region capture | ✅ | 🟡 | 🟡 | Wayland cannot enumerate windows; the portal picker is used instead |
| Save, clipboard, encoding | ✅ | 🟡 | 🟡 | Shared, platform-agnostic code — one implementation, tested everywhere |
| Menu-bar / tray app | ✅ | 🟡 | 🟡 | One cross-platform tray item; only the macOS one has been run by a person |
| Global hotkeys | ✅ | 🟡 | 🟠 | Works where the desktop allows it. Wayland cannot grab keys, so Scrozz refuses and hands you the exact compositor config line to bind the CLI instead (D11) |
| Recent Captures Overlay | 🟡 | ⬜ | ⬜ | The macOS overlay has reviewed native lifecycle proof and an atomic first-card reveal barrier; the unified build still awaits final hands-on confirmation. GNOME/Wayland cannot position overlays at all — the adaptation is D31 |
| Drag-out to another app | ✅ | 🟡 | ⬜ | Native macOS drag is hands-on verified; Windows delayed rendering is implemented but still needs native testing; Linux remains open |
| Pinned captures | 🟡 | 🟡 | 🟠 | Pin, lock, opacity, zoom and persistence are implemented; native focus and window-manager behavior still need the full platform matrix |
| Text recognition (OCR) | ✅ | 🟡 | 🟡 | Local only: Vision · packaged Windows.Media.Ocr / portable Tesseract · Linux Tesseract. The portable Windows ZIP includes Tesseract, its runtime DLLs, and English data; Linux uses host packages. Missing requested language data produces an actionable error |
| Barcode and QR reading | ✅ | ✅ | ✅ | A pure-Rust decoder on every platform, with Vision used for macOS symbologies it already covers. Payloads are returned verbatim and never followed |
| Sensitive-information review | 🟡 | 🟡 | 🟡 | Deterministic local detectors identify possible emails, payment cards, network addresses, phone numbers, token-bearing URLs and likely keys. Findings contain no recognized text, stay unselected until review, and become ordinary secure Redact annotations only after explicit acceptance of the current image revision |
| Capture history | 🟡 | 🟡 | 🟡 | Persistence, retention, restore/delete/filter UI and editable annotation documents are implemented; aggregate hands-on validation is in progress |
| Private sharing | 🟡 | 🟡 | 🟡 | Optional BYO S3/R2/B2/MinIO upload; automated signing, encryption and loopback transport tests pass, but no provider has been confirmed by hand |
| Command-line interface | ✅ | 🟡 | 🟡 | Every capture the app can take, headlessly (D11) |
| Annotation editor | 🟡 | 🟡 | 🟡 | Full editor UI, history, crop, zoom, Smart Frame, arrows, text, secure Redact and revision-safe copy/save/drag are implemented; final aggregate and platform validation remain |
| Screen recording | 🟠 | 🟠 | 🟠 | Native recording engines and editor playback exist; macOS editor/export corrections and Windows/Linux runtime closure remain active |
| Scrolling capture | 🟡 | 🟡 | 🟡 | Vertical and horizontal stitching, sticky-chrome removal, progress, cancellation and partial salvage are wired end to end. macOS synthesizes target-bound gestures; Windows and X11 have native drivers awaiting real-desktop smoke, while Wayland is deliberately manual |
| Beautification | 🟡 | 🟡 | 🟡 | Smart Frame, automatic backgrounds, exact output sizes, custom presets and revision-safe export are integrated; hands-on aggregate validation remains |
| BYO sharing | 🟠 | 🟠 | 🟠 | S3-compatible upload core exists; provider settings, credential-vault integration, history metadata and release packaging are active work |
What 🟡 rests on, precisely. Three automated layers, described in full in
docs/platforms.md: every target type-checks from a single
machine; every push builds, links and tests on real macOS, Windows and Linux
runners; and the interface is rendered headlessly and pixel-diffed on all three,
which is why "does it look right on Windows" is not an unanswered question. What
none of that can prove is behaviour in a live desktop session — whether the
overlay steals focus mid-sentence, whether a hotkey survives a lock screen,
whether a permission dialog says something a person can act on. That is a real
gap, it is stated in docs/platforms.md as layer 4, and it is why Windows and
Linux are not called supported here.
The road from 🟡 to ✅ runs through that layer 4: real desktop sessions on
each platform, a person driving the app, and the rough edges that only a live
session reveals fixed one at a time. The plan, the four layers, and the honest
account of where the asymmetry sits are all in
docs/platforms.md.
You will need Rust 1.98 or newer. Full Xcode is optional — it is used only to compile the layered macOS 26 app icon, and the build skips that step cleanly without it.
git clone https://github.com/thatcube/scrozz.git
cd scrozz
tools/dev.sh build
# builds, signs, installs /Applications/Scrozz.app, and opens itThe bundle is not a convenience. macOS attaches Screen & System Audio Recording access to a bundle identity, so a bare binary run from a terminal has the grant land on the terminal instead. Scrozz does not request access at launch. The first capture that needs it explains why before macOS asks; if direct access is not granted, supported Window and Screen captures can use Apple's limited content picker instead. The picker replaces Scrozz's custom selector and cannot provide custom Area, All Displays, unattended global capture, or system-audio recording.
Scrozz then lives in the menu bar. It is invisible at rest by design (D27) — the captures appear, the app does not.
Scrozz follows Plozz's CalVer model: the user-facing version is the unpadded
build date YYYY.M.D, so a build made on August 27, 2026 is 2026.8.27 and
its release tag is v2026.8.27. Same-day builds share that version and are
distinguished by the separate numeric build number.
Downloadable test builds use tags such as v2026.9.2-alpha.1. GitHub marks
them as prereleases, excludes them from Latest, and publishes a normal macOS
drag-to-Applications DMG, Windows packages, a Linux AppDir archive, and
SHA256SUMS after the tagged release workflow succeeds. Alpha builds may break
compatibility and should not be treated as stable. Unsigned platform artifacts
clearly say so; macOS downloads need Developer ID signing/notarization configured
in the repository before Gatekeeper provides the normal install flow.
Recording interaction overlays are opt-in. record.highlight-clicks and
record.show-keystrokes trigger Input Monitoring only when a recording starts;
keystrokes default to record.keystroke-scope=modifiers-only. The all mode can
expose typed content and is presented with an explicit privacy warning. Scrozz
retains only display-ready labels in memory for an open editor session, never in
history, logs, or event sidecars.
The camera is opt-in in the same way. record.camera is off by default, device
enumeration never opens a camera, and the camera is only started by an explicit
Preview in Settings or by a recording that asked for one. Composition — anchor,
size, shape, mirror, border, shadow, and the presenter switch — stays adjustable
while a recording runs, and is the only recording preference that does.
The CLI is not a wrapper around the app; it is the same capability, headless, and it is a stable contract (D11). It is also how Scrozz gets hotkeys on compositors that refuse to provide them.
tools/dev.sh run -- list displays
tools/dev.sh run -- list windows
tools/dev.sh run -- list cameras
tools/dev.sh run -- capture --display primary -o shot.png
tools/dev.sh run -- capture --region 0,0,1200,800 --json
tools/dev.sh run -- record --camera --camera-shape circle
tools/dev.sh run -- record --camera --presenter
tools/dev.sh run -- ocr shot.png
tools/dev.sh run -- settings get
tools/dev.sh run -- --helpPrivate sharing is a source-level optional feature and is enabled in distributed Scrozz binaries. It adds no account or Scrozz service, and uploads only to the S3-compatible endpoint you configure.
export SCROZZ_S3_BUCKET=my-captures
export SCROZZ_S3_ACCESS_KEY_ID=...
export SCROZZ_S3_SECRET_ACCESS_KEY=...
cargo run -p scrozz --features cloud -- share shot.pngAWS S3, Cloudflare R2, Backblaze B2 and MinIO presets are built in. Expiring
private links, client-side password encryption, provider-compatible object
organization and lifecycle deletion, tags where supported, and custom domains
are documented in
docs/private-sharing.md. The Settings window
stores non-secret provider policy in its versioned settings document and puts
credentials or an optional default share password only in macOS Keychain,
Windows Credential Manager, or Linux Secret Service. Environment, credential
command, and stdin sources remain available to scripts; secrets are never
command-line values or plaintext settings.
Commands that are not built yet say so and exit with a distinct status rather
than pretending — history, for instance, currently reports that it is not
implemented. Exit codes are part of the contract, so scripts can tell "no such
window" apart from "not implemented" apart from "permission denied".
Capture from the development binary may be refused on macOS because its grant belongs to the terminal rather than to Scrozz. That refusal is deliberate and tells you exactly which setting to change; the packaged app owns the just-in-time permission and Apple-picker flow described above.
Camera access is likewise requested only after an explicit Preview camera or recording action. Scrozz remembers the stable device identifier and composition preferences, never a native device handle. The recording HUD keeps an in-app privacy indicator visible while the camera is active and releases the device as soon as preview or recording stops.
One script runs everything CI runs, with the same flags:
tools/dev.sh # the full command list
tools/dev.sh check # type-check for this machine
tools/dev.sh lint # clippy, warnings denied
tools/dev.sh test # the test suite
tools/dev.sh build # on macOS: build, sign, install, and relaunch Scrozz
tools/dev.sh platforms # type-check macOS + Windows + Linux, from any of them
tools/dev.sh golden # headless golden-image tests
tools/dev.sh lock # refresh Cargo.lock after manifest changes, no build
tools/dev.sh update # intentionally update dependency versions, no build
tools/dev.sh smoke # build + smoke-test one release binary under one lease
tools/dev.sh package # build + package one release binary under one lease
tools/dev.sh ci # everything, in CI's order — the answer before pushingOn macOS, a successful tools/dev.sh build replaces the canonical
/Applications/Scrozz.app, stops only the process running from that exact
bundle, and opens the new build. Tests, checks, packaging, and CI never launch
the app. Set SCROZZ_BUILD_NO_LAUNCH=1 for an explicit install-only build.
Local build commands run through a two-slot Cargo pool. The lease keeps parallel
worktrees from writing the same target directory at once, while the fixed slot
count prevents every branch from retaining another full dependency graph. When
a slot changes worktrees, the wrapper removes only workspace-package artifacts
under the lease so stable Cargo cannot reuse a same-hash local artifact from
another checkout; registry dependencies remain warm. Set
SCROZZ_CARGO_POOL_ROOT to move the pool to another local filesystem, or
SCROZZ_CARGO_POOL_SLOTS to change the concurrency bound. Do not put the pool
on SMB/NFS, and do not point concurrent raw cargo commands at one shared
CARGO_TARGET_DIR; use tools/dev.sh or tools/cargo-pool.sh so the lease
covers the entire command.
tools/dev.sh platforms is the one worth knowing about: it type-checks the
Windows and Linux code against the genuine API surface without a Windows or Linux
machine, which turns most cross-platform mistakes into a compile error on your
own laptop instead of a CI round trip days later.
Before writing platform code, read
docs/platforms.md — particularly the recorded gotchas,
several of which are APIs that return success while doing nothing at all.
The documentation is the design. Decisions are binding and written down before implementation:
| Document | What it is |
|---|---|
docs/decisions.md |
Every architectural decision (D1–D31), with the reasoning and what it rules out |
docs/platforms.md |
The cross-platform strategy, the four verification layers, and what Windows and Linux still need |
docs/private-sharing.md |
BYO object-storage setup, credential boundaries, expiry and encrypted viewer behavior |
docs/feature-audit.md |
The authoritative feature inventory, per-platform feasibility, and the backlog |
docs/research/ |
The research the decisions were made from |
AI_DISCLOSURE.md |
How Scrozz is built, and what it does not do |
TRADEMARK.md |
What you may do with the name |
If you are changing behaviour, the decision record is the place to start. If a decision is wrong, say so and change it there first — that is what it is for.
A screenshot tool sees your screen, including things you never meant to share. That earns a direct answer rather than a marketing adjective, so:
Scrozz contains no generative AI. No language model, nothing generated: it does not describe or summarise what you capture. It has no telemetry, analytics, account, sign-in, or Scrozz server. Text recognition and sensitive-information suggestions run on device, through the recogniser built into your operating system or a Tesseract installation on your machine. A capture leaves the machine only when you explicitly use the optional sharing feature, and then it goes only to the S3-compatible storage you configured.
You can check that rather than believe it: the source default build compiles no
HTTP client. Distributed packages deliberately build with --features cloud,
which adds optional ureq networking for authenticated object-storage requests;
redirects and ambient proxies are disabled. Cargo.lock lists optional
dependencies either way, so verify the boundary with
cargo tree -p scrozz --no-default-features.
Coding agents did assist with implementation. Brandon Moore conceived Scrozz, researched it, designed the product and its visual identity, made every architectural decision, tested the results, branded it, and maintains it; agents wrote code against decisions that were already made, and built the automated checks that prove that code does what it claims. That arrangement was written down as D5 before most of the code existed, alongside D25, which exists for the blunt reason that an agent cannot see — so every product image is generated by a headless harness and diffed by the build, rather than trusted.
The full version, including how to verify each claim, is in
AI_DISCLOSURE.md.
Scrozz began as a study rather than as code, and the repository's own history shows it: the first commits are a feature audit, four research reports, and the decision record — architecture, licensing, platform strategy and interaction design were argued out and written down before the workspace existed at all. Concept and research preceded implementation. How long they preceded it is not recorded anywhere in this repository, so this README does not guess.
The first code lands afterwards, and the ordering is deliberate: the cross-platform verification harness before the capture backends, the platform backends before the interface, the interface before the app. The commit titled "Scrozz takes its first real screenshot" comes only once all of that is standing. Everything since has been macOS polish and cross-platform groundwork.
The whole design argument — including the decisions that were made, reversed, and
corrected along the way — is preserved in
docs/decisions.md. None of it was reconstructed after the
fact.
Brandon Moore — founder, product designer, researcher,
and maintainer. Scrozz is his: the idea, the research, the architecture, the
visual identity and icon, the testing, and the decisions about what ships. Every
commit in this repository is authored by him, which you can confirm with
git shortlog -sne.
Contributions are welcome. The design decisions in
docs/decisions.md are binding, and the fastest way to get a
change merged is to say which decision it serves — or which one it means to
revisit.
Please open an issue. Your operating system and version, your desktop environment on Linux, and what you expected to happen all help a great deal.
Screenshots often contain more than you intend — check yours before attaching it, and never paste credentials or tokens into an issue.
Scrozz is free and open source, with no paid features, no paywall, and no ads. If it turns out to be useful to you and you would like to chip in toward its upkeep, donations are welcome and genuinely appreciated. Anything is plenty, and not donating is completely fine.
Donate via GitHub Sponsors — one-time or recurring.
GPL-3.0, with a store-distribution exception © 2026 Brandon Moore.
The licence covers the code, and the freedom to use, change, and sell it is
the point. It does not cover the name: "Scrozz" and the Scrozz logo are
trademarks, so a modified version needs a different name. The reasoning, and
exactly what you may do without asking, is in
TRADEMARK.md.
Other products named anywhere in docs/ are the trademarks of their owners,
referred to descriptively for comparison only (D24).
Scrozz is one of a set of free, open-source apps by Brandon Moore. Same principles throughout: your data stays yours, nothing is monetised, and nothing is hidden behind an account.
| App | What it does |
|---|---|
| Hozz | Apple Health, exported to storage you own |
| Mozz | Your music, wherever it lives |
| Plozz | Movies & TV on Apple TV, iPhone & iPad |
| Twozz | Twitch on Apple TV, with real emotes |
| Scrozz | Screenshots that go where you need them — you are here |
More open source
