x2y Devs Tools reference

x2y Devs Tools is an independent software company based in Nairobi, Kenya, founded in October 2025 by Moses Gitiriku. The suite comprises seven products spanning Windows desktop applications, an Android mobile app, and a cross-platform Node.js SDK.

Every product shares three architectural commitments:

• Offline-first. Every feature works without a network connection. If a capability cannot function offline, it does not ship.
• Zero telemetry. No analytics, no crash reports, no "improve this product" prompts. Verified at 0 bytes collected since day one.
• No accounts. Downloads require no sign-up. Licences do not phone home. Your copy is yours.

As of July 2026, the entire suite is free. The Code Leak Detector will move to a one-time $29 licence on 1 September 2026; all other products remain free indefinitely under a donationware model.

The x2y security model is architectural, not contractual. Privacy is enforced by the absence of network pathways, not by promises. There is no upload endpoint to misuse because none exists.

Verification

Every claim above is independently verifiable. Run any network monitoring tool (Wireshark, Fiddler, mitmproxy, or your operating system's built-in firewall logs) while using any x2y product. You will observe zero outbound connections attributable to the application.

All release installers and archives are signed. Published SHA-256 checksums accompany every release on GitHub and itch.io. Verify before installing:

Open engines and threat intelligence

Antivirus scanning in AV Ultimate delegates to ClamAV 0.105 and YARA 4.5, both open-source projects with public signature feeds. Threat intelligence is sourced from MalwareBazaar (recent and full feeds), URLhaus (malicious URL detection), and OpenPhish (phishing protection). All feeds are downloaded manually and loaded offline — the application itself never connects to these services.

All x2y products are distributed through Microsoft Store (primary for Windows), itch.io, GitHub Releases, Uptodown, and APKPure (Android). The SDK is available via npm. No product requires an account, email address, or licence key to install and use.

x2y Authenticator is available on Uptodown and APKPure as an APK. Sideload the APK after enabling installation from unknown sources in your device settings. The app requests no permissions beyond local storage for the encrypted vault.

The SDK has zero postinstall scripts and no native dependencies. It runs on Node.js 18 and above. Full API reference is available at sdk.x2ydevs.xyz.

Comprehensive security suite for Windows. Real-time protection, threat intelligence with 5,500+ signatures, persistence auditing, network monitoring, quarantine vault, and hash lookup. Protects your system without slowing it down.

Offline by choice. Secure by design. A high-security offline 2FA vault with Stealth Mode, encrypted Panic Backups, and WiFi Companion for seamless desktop access. 100% offline — no internet required, ever.

Professional archive manager for Windows that lets you open, browse, extract, create, convert, split, and merge archive files entirely offline. Supports all major formats with full AES-256 password encryption.

Never commit secrets again. The essential security companion for modern developers. Whether you are working in Python, Node.js, React, or C++, ensuring your sensitive data stays out of your public repositories is critical. Generate the perfect .gitignore file in seconds and audit existing projects for dangerous exposures.

A professional text editor combining the simplicity of Windows Notepad with powerful tools for coding, scripting, and managing text files. Supports command-line usage, file associations, syntax highlighting for 30+ languages, and advanced editing features.

A professional-grade desktop application for web developers, SEO specialists, and digital marketers. Built as a high-performance crawling engine, it automates website structure discovery to generate search engine-compliant XML, HTML, JSON, and TXT sitemaps. 100% local processing, zero telemetry.

Desktop application that scans your entire codebase for accidentally exposed secrets — API keys, tokens, passwords, and other sensitive data. 200+ detection patterns with 100% offline processing.

Cross-platform Node.js toolkit exposing the same engines behind our desktop tools as programmatic modules: monitor, refactor, secrets, and audit. Offline by default, TypeScript-typed, CI-friendly.

A public record of every release across the suite. All releases are signed and accompanied by published SHA-256 checksums on GitHub.

Do any x2y products require an internet connection?

No. Every product in the suite is fully functional offline. Threat intelligence feeds for AV Ultimate are loaded from manually downloaded bundles. The SDK's npm installation requires a network connection (as all npm installs do), but the package itself makes no network calls at runtime.

How do I verify that zero telemetry is actually zero?

Use any network monitoring tool — Wireshark, Fiddler, GlassWire, or your operating system's firewall logs. Launch any x2y product and observe. You will see zero outbound connections attributable to the application. We encourage this verification.

Is the Code Leak Detector still free?

Yes, until 1 September 2026 at 00:00 EAT (UTC+3). After that moment, it moves to a one-time $29 licence. There are no subscriptions, no recurring fees, and no account requirements. Copies obtained while free continue to work indefinitely.

Can I use x2y products commercially?

Yes. All products are free for personal and commercial use under a donationware model. Donations are appreciated but never required.

Where do I report a security issue?

Email security@x2ydevs.xyz. Security disclosures are triaged first. Please include steps to reproduce and affected version numbers.

What platforms does Authenticator support?

x2y Authenticator is an Android application. It is not available on Windows or iOS. The WiFi Companion feature allows streaming TOTP codes to a PC browser over your local network, but the vault itself lives exclusively on the Android device.

We stand behind everything we build. Our support team responds within two working days (EAT, UTC+3).