An Offline Typing Tutor for a Mac, With No Account: Four Ways to Check the Claim

You want to practise typing on a plane, or on a work Mac that will not let you sign into anything, or you would simply rather not have a password for a typing tutor. Search for that and every result says the same three words: offline, no account, one-time.

Those words are free to write. Nothing on a product page separates an app that never opens a socket from one that checks in quietly at every launch.

So the rest of this page is not another claim. It is the four checks that settle the question for any Mac app in about a minute, and they work whether or not you ever install Mochi Type, the app I make.

“Offline” is three claims wearing one word

Pull it apart before you test anything.

1. The content. Do the lessons, word lists and layouts ship inside the app, or arrive over the network when you open them?
2. The runtime. Does it open a connection while you use it?
3. Your data. Does your progress exist without somebody’s server?

An app can pass one and fail the others. A web tutor wrapped in Electron passes none of them while looking exactly like a Mac app in the Dock.

“No account” splits in two as well. No account with the developer is achievable. No account at all is not, if you got the app from the Mac App Store: the download is tied to your Apple Account, and the bundle carries a _MASReceipt file to prove it — the checkable trace of the promise from the short version above.

Check 1 — what the app is even allowed to do

Start with the ceiling rather than the behaviour. An app from the App Store runs fenced in, and the fence is built by macOS, not by the app: before it ships, the developer has to write down what it wants to be able to reach — the internet, the camera, the microphone, a folder you picked yourself — and anything left off that list is simply refused while the app runs. Good intentions do not come into it.

That list travels inside the app, so you can read it off the copy in your own Applications folder. It tells you what the thing could do if it wanted to, which is a much stronger fact than what a product page says it does.

Sandboxed apps have to declare an outbound network capability, and the sandbox enforces it. A sandboxed app without com.apple.security.network.client cannot connect to anything. That is not a promise in a FAQ; it is a ceiling.

The qualifier carries the whole check. Every Mac App Store app is sandboxed — Apple requires it. An app you downloaded from a website may not be, and an unsandboxed app is under no such ceiling at all: it can open any connection it likes with no entitlement to declare. So before you read an entitlement list, look for com.apple.security.app-sandbox in it. Without that line the rest of the list is decoration.

Read it off your own copy: substitute any app’s name and it works the same way.

codesign -d --entitlements - "/Applications/Mochi Type.app"

On macOS 26.6, against the copy in my own Applications folder, the interesting lines are (the real output is alphabetical and a little longer — this is the security-relevant slice of it):

	[Key] com.apple.developer.icloud-services
	[Value]
		[Array]
			[String] CloudKit
	[Key] com.apple.security.app-sandbox
	[Value]
		[Bool] true
	[Key] com.apple.security.files.bookmarks.app-scope
	[Value]
		[Bool] true
	[Key] com.apple.security.files.user-selected.read-write
	[Value]
		[Bool] true
	[Key] com.apple.security.network.client
	[Value]
		[Bool] true

The two files. keys are the backup folder: the app can read and write a folder you picked yourself in an open panel, and store a security-scoped bookmark so it can still write there next week. There is no entitlement here for blanket access to your home folder.

Read the direction of that evidence carefully, because it is easy to get backwards. In a sandboxed app, the absence of network.client is proof. Its presence proves nothing — the same entitlement is required for iCloud sync and for the App Store purchase, so almost every paid app has it.

Just as telling is everything not in the list: no network.server (it cannot accept incoming connections), no camera, no microphone, no address book, no location, no Apple Events automation of other apps.

Check 2 — is there an updater in the bundle

Some apps keep themselves up to date. For that to work, something inside them has to be able to call a server on its own schedule — no window opens, nobody asks you first. On an app you downloaded from a website that is entirely normal, and it is often the only part that ever talks to the network at all.

You can see whether such a thing is packed inside, because an app on a Mac is really a folder and you can list what is in it.

An auto-updater is a network channel the app can open without you. On the Mac the common one is Sparkle, and it lives at Contents/Frameworks/Sparkle.framework.

Look inside the bundle yourself:

ls "/Applications/Mochi Type.app/Contents"

_CodeSignature	_MASReceipt	Info.plist	MacOS	PkgInfo	Resources

There is no Frameworks directory at all. This is the expected result for anything installed from the store: App Store Review Guideline 2.4.5(vii) says Mac App Store apps “must use the Mac App Store to distribute updates; other update mechanisms are not allowed.” The check earns its keep on apps you downloaded from a website, where an updater is normal and is often the only thing that ever talks to the network.

Finding Sparkle is not by itself proof that something is phoning home on a timer. Sparkle’s documented default is that automatic checking starts off and the user is asked for permission on the app’s second launch; a developer who sets SUEnableAutomaticChecks to YES in Info.plist skips the question and schedules checks from the first run. Both are worth knowing before you read a Frameworks folder as an accusation.

Check 3 — the privacy manifest, which is a file rather than a page

Apps now carry their data-collection statement as a file inside the app itself, rather than as a page on a website that can be quietly reworded the week after you read it. It is still the developer talking — but it is what they filed with Apple, and the copy on your disk is the one you can print for yourself.

Print the one inside any app you have:

plutil -p "/Applications/Mochi Type.app/Contents/Resources/PrivacyInfo.xcprivacy"

  "NSPrivacyCollectedDataTypes" => [
  ]
  "NSPrivacyTracking" => false
  "NSPrivacyTrackingDomains" => [
  ]

The full output opens with one more key this excerpt leaves out — NSPrivacyAccessedAPITypes, three declared uses of Apple APIs (user defaults, file timestamps, disk space), each with a standard reason code from Apple’s allowed list. Below it: empty collected-data types, tracking false, no tracking domains. Treat this as a declaration rather than a measurement: it is what the developer filed, and Apple’s rules require third-party SDKs on its list to ship a manifest of their own — but a statically linked SDK folds its declaration into this same file rather than announcing itself as a framework, so check 3 does not replace check 4.

Check 4 — watch the sockets while you type

The first three checks tell you what an app is permitted to do and what it says about itself. This one is the closest you can get to watching. While the app is open in front of you, you can ask macOS which internet connections that particular program has going right now, and the answer comes from the system rather than from the developer.

Watch it yourself while you use it — with the app running, because that matters here: if it is not running, pgrep finds nothing and lsof quietly falls back to listing every TCP connection on the Mac, which looks alarming and says nothing about this app.

lsof -nP -iTCP -a -p "$(pgrep -x 'Mochi Type')"

No output means no open TCP connections owned by that process at that moment. Run it at launch, mid-session, and after finishing a lesson. Substitute any process name and it works on any app.

Know what it does not cover, or you will read an empty result as more than it is. Apple’s frameworks proxy their traffic through daemons of their own — CloudKit through cloudd, StoreKit and the App Store through storekitagent and appstoreagent — and those connections belong to those processes, not to the app you are watching. An app can be syncing every session you type and still show you nothing here. It is also a snapshot: a request that opened and closed between two runs of the command never appears.

The version that needs no terminal: turn Wi-Fi off and use the app for an evening. Whatever breaks was network.

What the four checks say about Mochi Type

Take it on a plane and nothing goes missing. Everything you type against — the lessons, the word lists, every keyboard layout, the sounds, the whole sixteen-stage course — is inside the app already, so there is nothing to fetch while you practise and nothing to lose when the signal goes.

There is also nobody to sign up to. In the App Store version there is no name, no email, no password and no licence key to paste in — nowhere in the settings to type a name at all — which is what makes it usable on a work Mac where signing into personal accounts is off the table. (A copy activated with a licence key — a bundle or promo purchase — is the one exception, and it is spelled out below.)

The App Store build makes exactly one outbound request of its own, and it is a screenshot. Some entries in the What’s New window have a small preview icon beside them; click it and the app fetches that one picture. Leave it alone and nothing is fetched — with the network off, the popover simply tells you it could not load it.

Two things do leave the Mac that the app did not ask for, and they belong in any honest version of this answer: Apple’s own machinery, for the displayed price, for your purchase and for the check at launch that you paid; and iCloud sync, when it is on — which, on a Mac signed into iCloud, it is by default. The second gets a section to itself further down, because it is the part that qualifies the whole word.

If you do want the mechanical version: the What’s New window that opens after an update is assembled from text compiled into the binary. A few entries carry a small camera or play icon beside the title; clicking it opens a popover that fetches one PNG or MP4 from a single host:

https://api.orsolabs.dev/whatsnew/mochi-type/<version>/<slug>.png

Do not click the icon and nothing is fetched. Click it with the network off and the popover says, word for word, Couldn’t load preview — Connect to the internet to load the screenshot or video for this change.

The frameworks behind Apple’s own traffic — StoreKit and CloudKit — make their calls under Apple’s daemon names, not under this app’s, which is why check 4 shows them nowhere in this process’s list.

Everything you type against is in the bundle — 48 keyboard layout files, 129 word-set files, 22 sound packs, the typing faces and the whole 16-stage course. That is also why a layout works with no network and no system change: the app resolves what you pressed from the physical key code through its own tables, which is the mechanism behind practising a layout without switching your input source.

“No account” has a checkable form too. Search the app’s interface for sign in, log in, password or email address, and the only match that applies to this build is “Sign in to iCloud in System Settings to enable sync” — an Apple setting, not an account. (The remaining matches belong to the direct-download build sold with a licence key.) In the App Store build, Settings has three tabs — General, Themes, Backup — and nowhere to type a name.

And the limit, since this whole page is about claims: it is a typing tutor, not a system utility. It changes no macOS setting, installs nothing on your Mac and repairs nothing there — your input source stays exactly where it was, even while you practise on a different layout.

Your history has no expiry because nothing expires it

The reason a web tutor’s free tier eventually loses your history is that storing it costs somebody money. Monkeytype’s own README says what the account is for: “an account system to save your typing speed history”.

On a Mac the storage is your disk, so the question stops being a policy and starts being a file. Nobody is paying rent on your numbers, so nothing has to be thrown away to keep the cost down: your practice history sits on the machine, and you can copy it, back it up or delete it whenever you feel like it.

Mochi writes one row per session into a SQLite database. Want to look at it yourself? It is one file, here:

~/Library/Containers/com.b166ar.mochi-type/Data/Library/Application Support/Mochi/mochi.db

That is the sandbox container path — the app asks macOS for Application Support and the sandbox hands it that.

Nothing in the app deletes a session on its own. A session leaves the database only because you deleted it, you cleared your history, or the deletion arrived from another of your Macs. There is exactly one time-based cleanup, and it does not touch your typing: the IDs of sessions you already deleted are kept for 180 days so a stale peer cannot resurrect them, then dropped.

Two ways to take it with you, both in the free tier:

Route	Where	What you get
Export…	Settings → Backup → Export & Restore	A .mochiarchive package — a consistent copy of mochi.db, your imported texts, and a manifest
Local Backups	Settings → Backup → Local Backups	A weekly snapshot into a folder you choose; it keeps the 4 most recent and prunes the rest

The local-backup panel describes itself plainly: “Mochi can save a weekly snapshot of your history to a folder of your choice (for example ~/Documents). It creates a “Mochi Backups” subfolder there to keep things tidy. Works offline, no iCloud needed.”

The part that is not offline, and it is on by default

iCloud sync. On a Mac signed into iCloud, the first-run tour reaches a card labelled “iCloud (recommended)” with the switch already flipped on, so a user who clicks Continue through the tour ends up synced without ever choosing it.

With it on, session history and the full text of any book or article you imported are uploaded to your own private CloudKit database. Private means private to your Apple Account: I cannot read it, and it does not consume iCloud Drive storage — the Settings help text says exactly that, “Uses CloudKit — doesn’t count against iCloud Drive space.” But private is not the same as local. Something left your Mac.

If you want the offline claim to hold literally, the switch is Settings → Backup → iCloud → “Sync this Mac”. Turn it off and the local weekly backup above is the replacement.

One more edge, for completeness: this website is not the app. The page you are reading loads a third-party analytics script. The app’s manifest says what the app does; it says nothing about me.

If you are shopping rather than auditing

Which of the four checks matter depends on where the app came from. Anything out of the App Store arrives fenced in and is not allowed to bring its own updater. A direct download from a website is under neither obligation — which is where the first two checks stop being formalities.

Typiq (typiq-app.com) sells on the same three words and is a desktop app rather than a browser tab, which makes it the honest comparison. Three things its own page said when I read it on 8 August 2026, and they change which checks apply: it is a direct download rather than a Mac App Store app (the same release is built for Windows, Linux and Chromebook); the licence is €18.99 one-time; and the offline claim is scoped — “After a one-time activation, Typiq runs fully offline on Mac, Windows and Linux.” I am not going to grade its feature list on my own site. One difference is the same class of fact as the price, so it belongs here: Typiq’s trial runs 30 minutes; Mochi Type’s free tier is permanent — the first 5 stages in all 21 languages, every layout, and the full statistics. But because it does not come from the App Store, checks 1 and 2 are worth more there than they are here: nothing obliges it to be sandboxed, and nothing forbids it an updater. Run all four on both.

If a browser tab is genuinely fine, monkeytype is the better pure speed test, and there an account is simply the price of keeping the numbers — its README says so outright, quoted above. Mochi Type is the native option: the content is in the bundle, the history is a file you can copy, and the only request it makes on its own is a screenshot you asked to see.

Whichever you pick, the useful habit is the one-minute audit. An app that cannot open a socket has settled the argument before anyone writes a word about it.