Install Guide

Get started

Install Octopus Scanner on Windows or macOS, keep it up to date and remove it completely when you no longer need it.

Windows

  1. Check the requirements

    RequirementWhat you needStatus
    Operating systemWindows 11, 64-bitRequired
    BrowserGoogle ChromeRequired
    Interface windowMicrosoft Edge WebView2 RuntimeRequired
    Memory16 GB of RAMRecommended
    Processor6 or more coresRecommended
    • Windows PCs with an Arm processor run Octopus Scanner through Windows' built-in x64 emulation. 32-bit Windows isn't supported.
    • Beta, Canary and portable versions of Chrome aren't detected. If Chrome is missing, Octopus Scanner tells you and links to its download page. You can still open past reports without it.
    • With less than 16 GB of RAM or fewer than six processor cores, the Octopus Server window warns at startup that scans may be unstable.

  2. Download and check the file

    Download the Windows version from the Download page. Before you run it, check that its SHA-256 hash (a fingerprint of the file) matches the Download page. See Verify the file yourself.

  3. Install

    The Windows download is a Setup file (.exe). Run it and follow its steps. Setup asks how to install:

    • Install for me only: The default. Octopus Scanner is installed for your Windows account only, and no administrator permission is needed.
    • Install for all users: Octopus Scanner is installed in Program Files for everyone who uses the computer. Windows asks for administrator permission.

    A desktop shortcut is optional. If you install an older version over a newer one, Setup warns you first.

    When Setup finishes, you can open Octopus Scanner straight away. If Google Chrome isn't installed, the last page also has Download Google Chrome, ticked by default. View Offline Terms & Conditions and View Offline Third-Party Licences open the copies installed with the app. The Octopus Scanner folder in the Start menu has shortcuts to the same offline copies.

    IT administrators can choose the install type from the command line with /ALLUSERS or /CURRENTUSER.

  4. Open Octopus Scanner

    The first time you run it, Microsoft Defender SmartScreen may warn you, because the app isn't signed. The Security Warnings Guide explains why and how to continue safely.

    While it runs, the Octopus Scanner icon appears in the Windows taskbar.

    The first time it opens, a few setup screens appear, including the terms of use and your update preferences. The User Guide describes each one.

    The Octopus Server window on Windows. Values are examples.
    Text description

    Example of the Octopus Server window on Windows. At the top are the Octopus Server title and CPU, RAM and Disk usage. The System Activity panel reads Requesting An Octopus From The Sea, The interface opens on its own once the scanner is ready, and Waiting for the interface to answer, with a Show System Activity button. Open Interface, Exit and Preferences buttons run along the bottom.

  5. Update

    When a new version is available, an update screen appears at startup. Select Download Update. Octopus Scanner downloads and checks the new Setup file, opens it, then closes so Setup can replace it. If a scan is running, it stays open until you close it. Follow Setup's steps; it can open Octopus Scanner again when it finishes. Setup keeps the install type you chose before, and your reports and settings are kept.

    A separate Engine Update Available screen appears at startup once a newer axe-core rules engine has been released. Engine updates have no waiting period. Select Update to install it, or Skip to keep the current one.

    Between releases, Octopus Scanner keeps itself current with component updates. See How Octopus Scanner stays up to date.

    If you installed from the terminal, you can also update by running the command again.

  6. Uninstall

    1. Open Windows Settings > Apps > Installed apps, find Octopus Scanner and select Uninstall.
    2. The uninstaller asks Keep your scan reports and settings? Keeping them is the default, so your reports, settings and saved configurations are there if you install Octopus Scanner again. Choose not to keep them to remove them as well.

    Either way, the uninstaller removes the program, its downloaded components, caches and logs and the Open At Login entry. Your preferences and saved configurations are kept along with your reports unless you choose to delete them. It only removes files it installed, so other files in the same folder are left alone. A silent uninstall always keeps your reports and settings. If you want to delete them later, reports and saved configurations are in %LocalAppData%\OctopusScanner, and the app's preferences are in the registry under HKEY_CURRENT_USER\Software\OctopusScanner.

    The uninstall steps are also in the app under Preferences > Data > Uninstall Guide.

    If you installed from the terminal, you can also remove Octopus Scanner by running the command again.

macOS

  1. Check the requirements

    RequirementWhat you needStatus
    Operating systemmacOS 14 (Sonoma) or laterRequired
    MacA Mac with Apple siliconRequired
    BrowserGoogle Chrome, in your Applications folderRequired
    Memory16 GB of RAMRecommended
    Processor6 or more coresRecommended
    • If Chrome is missing, Octopus Scanner tells you and links to its download page. You can still open past reports without it.
    • With less than 16 GB of RAM or fewer than six processor cores, the Octopus Server window warns that scans may be unstable.

  2. Download and check the file

    Download the macOS version from the Download page. Before you open it, check that its SHA-256 hash (a fingerprint of the file) matches the Download page. See Verify the file yourself.

  3. Install

    Open the .dmg file and drag Octopus Scanner into your Applications folder. If you open it from anywhere other than Applications or ~/Applications, a Finish Installation screen asks you to move it. Select Quit & Move, drag it into Applications and open it from there. Continue Anyway opens it from where it is, but running it from Applications is recommended.

    If macOS says the app is "damaged", open Terminal and run this command. Change the path if the app isn't in your Applications folder. The app then opens normally.

    xattr -cr /Applications/Octopus\ Scanner.app

  4. Open Octopus Scanner

    The first time you open it, Gatekeeper may stop it, because Apple hasn't checked (notarised) the app. The Security Warnings Guide explains why and how to continue safely. It also covers what to do if macOS says the app is damaged.

    While it runs, the Octopus Scanner icon appears in the macOS Dock.

    The first time it opens, a few setup screens appear, including the terms of use and your update preferences. The User Guide describes each one.

    The Octopus Server window on macOS. Values are examples.
    Text description

    Example of the Octopus Server window on macOS. At the top are the Octopus Server title and CPU, RAM and Disk usage. The System Activity panel reads Requesting An Octopus From The Sea, The interface opens on its own once the scanner is ready, and Waiting for the interface to answer, with a Show System Activity button. Open Interface, Exit and Preferences buttons run along the bottom.

  5. Update

    When a new version is available, an update screen appears at startup. Select Download Update and Octopus Scanner downloads it, checks it and opens it. Quit Octopus Scanner, drag it into Applications, select Replace, then open it again when the copy finishes. Your reports and settings are kept.

    A separate Engine Update Available screen appears at startup once a newer axe-core rules engine has been released. Engine updates have no waiting period. Select Update to install it, or Skip to keep the current one.

    Between releases, Octopus Scanner keeps itself current with component updates. See How Octopus Scanner stays up to date.

    If you installed from the terminal, you can also update by running the command again.

  6. Uninstall

    1. If Open At Login is on, turn it off in Preferences > Options first.
    2. To clear your settings and saved configurations, select Preferences > Data > Reset Data before you uninstall.
    3. Move Octopus Scanner from Applications to the Trash.
    4. To remove your reports, logs and settings as well, delete the ~/Library/Application Support/Octopus Scanner folder.

    The uninstall steps are also in the app under Preferences > Data > Uninstall Guide.

    If you installed from the terminal, you can also remove Octopus Scanner by running the command again.

Install from the terminal

You can also install Octopus Scanner with one command. It's a good choice if your browser blocks the download.

  • Windows (PowerShell):
    irm https://octopusscanner.com/install | iex
  • macOS (Terminal):
    curl -fsSL https://octopusscanner.com/install | bash

The Terminal Install Guide explains what the command checks and installs, how to update or remove Octopus Scanner with it and how to install on several computers without questions.

How Octopus Scanner stays up to date

Every month, Octopus Scanner offers updates to the components it runs on, which you install from inside the app. They bring security, bug and compatibility fixes between releases, and they are the recommended way to stay current. Updates that fix a known security problem are clearly marked, including Node.js security releases.

Each version you download from this website is tested with the components it ships with. Component updates are newer than that tested set. So each one must pass the safety checks below, and you can undo it at any time.

  • npm dependencies: Offered on the Dependency Patching screen once each version has passed the waiting period.
  • The Node.js runtime: Offered on the Node Runtime screen once a long-term support (LTS) release has passed the waiting period.
  • The axe-core engine: Offered on the Engine Update Available screen as soon as a new version is out. There is no waiting period, so new checks reach you straight away.

The app itself is only updated when a fix or feature can't come through the monthly component updates. The app downloads it from this website and checks it before opening the installer. See the Update step for your platform above.

How component updates are kept safe

  • A 14-day waiting period for dependencies and Node.js: Dependency and Node.js updates are only offered after they have been public for at least 14 days. This gives the community time to spot problems. You can choose 7, 14 or 30 days on the Dependency Patching and Node Runtime screens. 14 days is the default and is recommended. axe-core engine updates aren't held back.
  • A check for known malware: Before download, each dependency update is checked against osv.dev. This public database includes the OpenSSF list of malicious packages. The Component Safety Check also checks the packages in use, including axe-core, each time Octopus Scanner starts.
  • Verification before install: Every update is downloaded over HTTPS and checked before it is installed.
    • Dependencies come from the official npm registry and must match their published hashes and signatures.
    • The Node.js runtime comes from nodejs.org and must match its published checksum and carry the Node.js project's code signature.
    • The axe-core engine must match its published checksum and the release on the npm registry.
    • If any check fails, the update is discarded and nothing changes. A dependency or runtime update is kept only if the scanner still starts on it.
  • Your licence review: Before anything is downloaded, a Review Licences screen lists each component and its licence. Nothing is installed until you accept.
  • Revert at any time: Updates are installed next to the copy that came with the app, never over it. If anything misbehaves, select Revert in Preferences > Options > Advanced. Revert returns to the components this version shipped with.

Your antivirus or security software may scan or briefly block new components while they install. See Antivirus and component updates.

Turn on component updates

Keep component updates on. It's the best way to keep Octopus Scanner secure and working well between releases.

Component Update Notifications and Accessibility Engine Update Notifications are on by default. If you have turned them off, turn them on again under Preferences > Options, in the Updates group. You are notified when dependency and Node.js updates have passed the waiting period, and as soon as a new axe-core engine is released. Nothing is installed until you review it and choose to go ahead.

For every screen and setting, see Dependency Patching and Node Runtime in the User Guide.

Was this page helpful? Email your feedback.