Install Truzt.

Every installer is upgrade-safe. It closes the running app, removes any previous install (including legacy trust / netbird builds), reinstalls the service and keeps your peer registration and settings. Re-run it any time to update.

macOS

Homebrew cask

Recommended

Daemon + desktop app.

brew tap Dynamic-Labs-AI/tap
brew trust dynamic-labs-ai/tap    # one-time: approve the third-party tap
brew install --cask truzt

Install script

No Homebrew needed. One command to install or update the daemon and app:

curl -fsSL https://pkgs.truzt.lk/release/latest/install-macos.sh | bash

Homebrew formula

CLI and daemon only, for headless Macs.

brew tap Dynamic-Labs-AI/tap
brew trust dynamic-labs-ai/tap    # one-time: approve the third-party tap
brew install truzt

Manual .pkg

Pick your chip, then double-click to install (daemon + UI + service).

Universal Apple Silicon Intel

Gatekeeper: Truzt isn't Apple-notarized. The cask and install script clear the quarantine flag automatically. A manually downloaded .pkg prompts once: right-click → Open (or System Settings → Privacy & Security → Open Anyway).

Linux

Debian / Ubuntu .deb

Recommended

Daemon + desktop app. For arm64 or armv6, swap the architecture in the file name or use the downloads page.

V=$(curl -fsSL https://pkgs.truzt.lk/release/latest/version)
curl -fLO "https://pkgs.truzt.lk/release/v$V/truzt-full_${V}_linux_amd64.deb"
sudo dpkg -i "truzt-full_${V}_linux_amd64.deb"      # install or update

RHEL / Fedora .rpm

V=$(curl -fsSL https://pkgs.truzt.lk/release/latest/version)
curl -fLO "https://pkgs.truzt.lk/release/v$V/truzt-full_${V}_linux_amd64.rpm"
sudo rpm -Uvh "truzt-full_${V}_linux_amd64.rpm"     # install or upgrade

Homebrew

CLI and daemon only (there's no GUI cask on Linux).

brew tap Dynamic-Labs-AI/tap
brew trust dynamic-labs-ai/tap    # one-time: approve the third-party tap
brew install truzt
sudo "$(command -v truzt)" service install && sudo "$(command -v truzt)" service start

The .deb / .rpm post-install stops any old truzt / trust / netbird service and starts the new one. Your config is preserved.

Windows

PowerShell

Recommended

Run in an elevated PowerShell (Administrator). Re-run to update.

irm https://pkgs.truzt.lk/release/latest/install-windows.ps1 | iex

Installer .exe

Download Truzt-<VERSION>-setup.exe and run it.

Windows installer

WinGet

git clone https://github.com/Dynamic-Labs-AI/winget-pkgs
winget install --manifest winget-pkgs\manifests\d\DynamicLabs\Truzt\latest

latest always resolves to the newest release.

Unsigned build: two separate Windows checks.

SmartScreen (most PCs): the first run shows “Windows protected your PC”. Click More info → Run anyway.

Smart App Control (some clean Windows 11 22H2+ installs) blocks unsigned apps with no “Run anyway” button and has no per-app allowlist. Install on a PC without SAC, or have IT allow Truzt via Intune / MDM / WDAC policy. Turning SAC off is system-wide and can't be undone without resetting Windows, so we don't recommend it.

Connect

Open the Truzt app and sign in, or from a terminal:

truzt up --management-url https://app.truzt.lk:443
truzt status

Update

Every method updates in place. If Truzt is running, the updater closes the app and stops the service first, installs the new build, then restarts the service. Reopen Truzt when it's done.

Homebrew: always run brew update first so brew sees the new version.

macOS · cask	brew update && brew upgrade --cask truzt
macOS · script	curl -fsSL https://pkgs.truzt.lk/release/latest/install-macos.sh \| bash
macOS / Linux · formula	brew update && brew upgrade truzt
Linux · .deb	re-run the .deb download, then sudo dpkg -i truzt-full_<VERSION>_linux_amd64.deb
Linux · .rpm	re-run the .rpm download, then sudo rpm -Uvh truzt-full_<VERSION>_linux_amd64.rpm
Windows · PowerShell	irm https://pkgs.truzt.lk/release/latest/install-windows.ps1 \| iex (Admin)
Windows · WinGet	winget install --manifest winget-pkgs\manifests\d\DynamicLabs\Truzt\latest
Windows · .exe	download + run Truzt-<VERSION>-setup.exe

Troubleshoot

Truzt Doctor checks device internet, DNS, ping + TCP/HTTPS to the Truzt server, whether the service is running and the peer registered, and live Management / Signal status, then prints a PASS / WARN / FAIL summary. It can also restart the service or clear the peer config. Works with legacy trust builds too.

macOS / Linux · diagnose

curl -fsSL https://pkgs.truzt.lk/release/latest/truzt-doctor.sh | bash

Restart service

curl -fsSL https://pkgs.truzt.lk/release/latest/truzt-doctor.sh | bash -s -- restart

Clear config (re-register)

curl -fsSL https://pkgs.truzt.lk/release/latest/truzt-doctor.sh | bash -s -- clear-config

Windows · diagnose (Admin PowerShell)

irm https://pkgs.truzt.lk/release/latest/truzt-doctor.ps1 | iex

Restart / clear config

irm https://pkgs.truzt.lk/release/latest/truzt-doctor.ps1 -OutFile truzt-doctor.ps1
.\truzt-doctor.ps1 restart
.\truzt-doctor.ps1 clear-config

Arguments can't be piped to iex, so download the script first.

Uninstall

macOS

brew uninstall --cask truzt

Linux

sudo apt remove truzt-full
# or: sudo rpm -e truzt-full

Windows

Settings → Add or remove programs → Truzt