Download SealedBrief 1.1.0

SealedBrief ships as a single file per platform that bundles the full AI models — so it's a large download, and then runs with zero network egress. Every download is bound to an Ed25519-signed manifest — see verifying integrity below.

This download is the free 14-day trial

Already bought? Download below, then paste your licence on the first screen — or in Settings → License if the app is already running.

You don't have to buy first. The file below is the full product, not a limited demo — launch it and choose “Start 14-day trial” on the welcome screen. No account, no credit card, no signup, and starting the trial makes no network call. The engine that reads your documents has no network access by construction, so your files never leave this machine — confirm it yourself with a packet capture, exactly as you can on a paid licence. (The app may check sealedbrief.com for a newer version; that check never includes your documents — see verifying integrity below.)

For 14 days you have the full document workflow over your own files: index your documents, ask questions, read the cited answers, search, and export to Markdown — all on your own hardware.

After 14 days the app opens read-only. Nothing is deleted and nothing is locked away: you keep full read, search, and export (Markdown and PDF) of everything you have already indexed. Only indexing new documents and asking new questions pause until you paste a licence — in Settings → License if the app is running, or on the welcome screen if the trial has lapsed. No reinstall, no lost work, and your documents stay on this machine the whole time.

Recommended for your Linux machine

Linux

x86-64 · portable AppImage · every distribution

Download SealedBrief for Linux (.AppImage) 15.5 GB

One portable file — Debian, Ubuntu, Fedora, Arch, NixOS. No install step, and no .deb (the bundled AI models exceed the Debian package limit).

Verify (optional): echo "31d8f05d6d6a2a0198e17cb195b52906d7d38e6aa7c7ee3c2e2f938695ae5877 SealedBrief-1.1.0-x86_64.AppImage" | sha256sum -c

SHA-256: 31d8f05d6d6a2a0198e17cb195b52906d7d38e6aa7c7ee3c2e2f938695ae5877
Install & run on Linux
```
# 1. make it executable
chmod +x SealedBrief-1.1.0-x86_64.AppImage

# 2. run it (Debian 12, Ubuntu 20.04 and similar ship libfuse2):
./SealedBrief-1.1.0-x86_64.AppImage

# No libfuse2 (Ubuntu 22.04+, Fedora, Arch, NixOS)? Run without FUSE —
# universal, no install, no sudo, works on every distro:
./SealedBrief-1.1.0-x86_64.AppImage --appimage-extract-and-run

# ...or, on Debian/Ubuntu only, install FUSE and run it normally:
sudo apt install libfuse2
```
Recommended for your macOS machine

macOS

Apple Silicon (M1–M4) · signed & notarized

Download SealedBrief for macOS (.dmg) 15.9 GB

✓ Signed with an Apple Developer ID and notarized by Apple. macOS asks once to confirm an app downloaded from the internet — click Open. You will NOT hit an "unidentified developer" block or need a right-click workaround.

Apple Silicon (M1–M4) only — Intel Macs are not supported.

Verify (optional): echo "9c7e1b9df9861d6ca3dfd6397b6394fc9ff90dddb9657993edc94f78bfbc798f SealedBrief-1.1.0.dmg" | shasum -a 256 -c

SHA-256: 9c7e1b9df9861d6ca3dfd6397b6394fc9ff90dddb9657993edc94f78bfbc798f
Install & run on macOS
```
1. Double-click SealedBrief-1.1.0.dmg.
2. Drag SealedBrief into your Applications folder.
3. Open Applications and double-click SealedBrief. At the one-time macOS
   prompt ("downloaded from the Internet"), click Open.
```
Other platforms · same signed release

Why so large? The AI models (the LLM + the retrieval + reranking models) are inside the download — nothing is fetched at runtime. That's what makes SealedBrief work fully offline, with your documents never leaving the machine.

Ready to buy? Compare the two tiers on the pricing page — Personal $199, Professional $499, both a 3-year term. A licence unlocks this same install instantly, with no reinstall and no lost work, and every purchase is backed by a 30-day, no-questions refund — separate from the free trial above.

Verifying integrity (optional, recommended)

The release ships an Ed25519-signed manifest covering the binary's SHA-256 hash. The same public key SealedBrief uses to verify your purchased licence offline is the one that signs this manifest. So a tampered binary anywhere along the download path (CDN-cache poisoning, malicious mirror, mid-flight injection) gets caught by the same cryptographic chain that secures your licence.

Manifest URL: https://downloads.sealedbrief.com/releases/1.1.0/release_manifest.json

The verification script below downloads the manifest and the SealedBrief public key, then Ed25519-verifies the signature over the canonical manifest bytes. Then compute the binary's SHA-256 and match it against the manifest entry. If either check fails, the binary is suspect — don't run it; email support@sealedbrief.com.

One-liner (requires Python 3 + cryptography)

python3 -c '
import base64, json, urllib.request
from cryptography.hazmat.primitives import serialization

# Fetch the manifest + the bundled public key.
manifest_url = "https://downloads.sealedbrief.com/releases/1.1.0/release_manifest.json"
pubkey_url   = "https://sealedbrief.com/release_pubkey.pem"   # mirror of the in-binary pubkey

manifest = json.loads(urllib.request.urlopen(manifest_url).read())
pubkey   = serialization.load_pem_public_key(urllib.request.urlopen(pubkey_url).read())

# Strip the signature + base_url before computing canonical bytes
# (publish.py adds both fields AFTER signing).
sig = base64.urlsafe_b64decode(manifest.pop("signature") + "==")
manifest.pop("base_url", None)
canonical = json.dumps(manifest, sort_keys=True, separators=(",", ":"), ensure_ascii=True).encode("utf-8")

pubkey.verify(sig, canonical)
ver = manifest["version"]
print(f"Manifest signature verified — version {ver}.")
print("Now: compute the SHA-256 of your download (sha256sum on Linux, shasum -a 256 on macOS) and match it against the manifest entry.")
'

That check verifies the binary is the one we published. To audit the running app — confirm the document engine has no network egress and that your vault is encrypted at rest — follow the reproducible procedures on the verify-it-yourself page.