How the scanner works

Checking only reads. A native engine written in Rust measures the disk map, folder sizes, the walk through your folders for duplicates and the photo fingerprints, on every processor core. It reads and calculates; it never moves or deletes anything. On an M1 Max with a warm cache, a million files take about five and a half seconds.

Long scans can be paused, resumed or cancelled, or stopped part way with “Stop and show”. Sizes that could not be finished are marked with a “+”, and folders that could not be opened say “Not measured” instead of guessing.

Every finding carries a label: Safe, Review or Manual, and never a guess presented as fact. Each of the 28 cleanup rules comes with a plain text: what this is, what happens if you remove it, and what to keep in mind. Storage explains what macOS calls “System Data” item by item, with its owner and how long it has been untouched.

Developer folders are suggested only when the files beside them show what made them, such as a project file next to node_modules or target.

Exact copies are files with the same SHA-256 of every byte. Look-alike photos are compared with a 64-bit dHash fingerprint. Every group keeps at least one copy, and copies that are already APFS clones are counted once, because removing them frees little.

“Replace with clones…” on APFS checks every pair byte for byte first, keeps the copy's permissions, dates and extended attributes, and moves the copy itself to the Trash, so Undo puts it back.

Moves and deletions are decided outside the scanner, through one protection list that refuses everything by default. An item passes only through a narrow door: a place you picked on the disk map, a cleanup rule's exact pattern, an app leftover named after the app's exact bundle ID, and a few other tested doors. Every door still refuses app package contents, Photos and Music libraries, keychains, cloud folders, Apple's files, system folders, your home folder itself and other users' files.

Right before each move, every item is checked again: still allowed, still there, same kind, not a link, same owner, not cloud-only, not on a connected disk, same size, app not open, same bundle ID. The move is written to Activity first, made with the system's own Trash call, then marked complete. A batch can be stopped between items, never in the middle of one.

Activity lists every move. Undo puts items back exactly where they were with a rename that refuses to overwrite, so nothing new is ever replaced. Work that needs an administrator password uses fixed commands from the code, shown before they run, through macOS's own password prompt or Windows's UAC prompt.

• Emptying the Trash, “Delete Safe items right away” and commands run with your password cannot be undone; CleanPanda says so before each one.
• Without Full Disk Access, some protected folders cannot be measured; CleanPanda says what it could not see.
• The Known adware check compares names with a short list. It is not an antivirus, and a match is not proof.
• Space is shown as freed only after the Trash is emptied; purgeable space and Time Machine snapshots are explained, not counted as yours.

The engine is tested on a simulated computer in a temporary folder, with no network calls: 1,065 tests pass on macOS and 717 on Windows. The safety rules were deliberately broken 111 ways and the tests catch every one. An end-to-end test on a dedicated APFS disk image checks, moves caches to the Trash, removes an app with its leftovers, undoes everything, and confirms the folders match the start.