The config is the product.

A key, a colon, a command. Comments sit next to the key they explain, macros keep long paths out of the way, and the file lives in your dotfiles like everything else you care about.

^f1: runApp("AppCode")          # control f1
#l: runApp("Telegram")         # command l
f4: osascript -e 'display dialog "Hi"'

At a hundred hotkeys the file is still the fastest interface you have. grep telegram ~/…/hotkeys.yml finds the key you half remember, your editor renames an app across forty lines in one pass, and git diff tells you what you changed last week. Save, press your reload key, and the new file is live without restarting anything. The tools that keep your shortcuts in a database, a plist or an encrypted store can offer you a scroll bar.

Three details you only notice after a week. A name that YAML would misread is quoted for you, so #k, !i and *f1 go in as they are, with no escaping trick. Doubling the hash, ##k, comments that one hotkey out and leaves it in the file. And the parser runs with every YAML type rule switched off, so 1:, 7: and f1: 007 mean exactly what they say and nothing quietly becomes a number, a boolean or a date.

BetterTouchTool keeps a versioned SQLite database and exports JSON that runs about 45 lines per shortcut, with UUIDs and timestamps that churn on every save. Keyboard Maestro keeps a plist its editor owns. Raycast keeps an encrypted store, and its export is encrypted too. None of them survives a grep, a code review or a merge.

Keys that know where they are.

A context is a line above the action. It matches on the bundle id, the process name or the window title, and else catches everywhere else. One key, every app it should behave differently in, all in one place.

f5:
  currentAppChrome(): openMenuItem("Google Chrome", "View", "Reload This Page")
  currentWindowContains("Emulator"): ADB shell input keyevent 187
  else: runApp("Google Chrome")

Of the text configured tools only Hammerspoon matches window titles, and it takes an app watcher and about seven lines of Lua. Karabiner-Elements matches exact titles since 16.2 and about ten lines of JSON per rule. skhd, Keyboard Cowboy and Leader Key have no window titles at all, and Raycast hotkeys are global, they fire in every app or nowhere.

One key tells you what is in front of you.

Bind displayActiveWindowInfo(), press it anywhere, and a panel prints 14 facts about the window in front: bundle id, process name, pid, both readings of the title, layer, alpha, resident memory and exact bounds. Select the line, paste it into your config, done. It is the difference between guessing a bundle id and knowing it.

Twelve of those fourteen need no permission at all. The same block goes to the log, so a support mail is a copy and paste. Every rival either hides this in a settings window, shows key codes only, or leaves you installing a third-party window inspector to write its config.

Run the action, still let the key through.

A matched hotkey is consumed, unless you say otherwise. forward: true runs your action and hands the key to the app in front anyway, per hotkey. If a key has contexts and none match, it passes through untouched.

#s:
  forward: true
  shellScript: ~/bin/backup-notes.sh   # save in the app, back up as well

Keyboard Maestro always swallows its hot key. BetterTouchTool has the switch for key sequences, not for a plain shortcut. Hammerspoon does it with a disable, retype, enable trick.

Runs the thing you would have run yourself.

Commands run in your login shell, so the PATH from your profile is there and brew, pyenv and your own scripts work without full paths. AppleScript goes inline or as a block. Menu items are clicked by name, not by screen coordinates. Keystrokes go to the app in front, and a key can flip the input source.

This is where the others cost you an afternoon. BetterTouchTool runs /bin/bash without your profile, Keyboard Maestro a /bin/sh with four directories on PATH, Karabiner a /bin/sh that knows only HOME, USER and UID, Alfred a fixed PATH, Raycast a non login shell. Their forums are full of command not found.

F5 on its own. Option and Shift on their own.

114 physical keys are nameable: F1 to F20 without a modifier, the numpad including its enter, punctuation written as the character itself, arrows, home and end, and the four modifiers in any mix. A hotkey can even be modifiers alone: !* is Option and Shift pressed and released, which is how the keyboard layout gets switched here, the way Alt and Shift do it on Windows. Names follow the key position, not the letter printed on it, so a hotkey survives a switch to another layout.

The notation is AutoHotkey's, ^ Control, ! Option, # Command, with * for Shift, so a Windows config translates almost line by line.

Keys that survive secure input.

A password field, Terminal's Secure Keyboard Entry or a password manager switches on secure input, and macOS then keeps keystrokes away from every watching app. Most hotkey tools go quiet. Hotkeys turns its menu bar icon into a lock, names the app holding it, and keeps firing: every combination with Command or Control, Option combos included, and modifier‑only keys. An optional helper, off until you turn it on, adds F‑keys, Esc, Tab, Delete and the arrows.

On a real 107-hotkey config, 83 keys keep firing with no extra permission at all, and 102 with the helper switched on.

One thing cannot work there: a key that types a character, pressed without Command or Control. macOS gives those to nothing but a keyboard driver, which is why Karabiner-Elements is the one tool that takes them. skhd and Keyboard Cowboy stop completely. How it works.

Nothing here dies quietly.

macOS switches off any event tap whose callback runs too long, and every hotkey in every tool built this way goes dead until it is relaunched. Hotkeys catches that in the same callback, switches the tap back on and re-reads which modifiers you are holding.

A typo never disarms your keyboard either. Reload a config with a syntax error and the hotkeys you already had keep firing, while the dialog names the line, gives the reason and prints the line back to you. Write the same key twice under two spellings, cmd-k and #k, and both are named at load instead of one silently winning. A key whose contexts do not match is not swallowed, it reaches the app in front exactly as if Hotkeys were not running. And there is a window inspector on a key: displayActiveWindowInfo() prints 14 facts about whatever is in front, bundle id, process, pid, both title readings, memory and bounds, in a panel you select and paste straight into your config.

Small enough to forget it is running.

Swift and a CGEvent tap, no Electron, no embedded Lua or Node, no kernel extension and no login account. The download is 5.2 MB against 90 MB for BetterTouchTool, 122 MB for Raycast, 42 MB for Karabiner-Elements and 37 MB for Keyboard Maestro, and it sits at 28 MB of memory and 0.09% of one core while it waits for a key.

8,034 lines of Swift, three frameworks in the bundle, one entitlement in the whole entitlements file, two processes and three threads at rest. Small enough that you can audit what it asks the system for in one command.

It cannot log your keystrokes, by build.

No account, no analytics, no crash reporter. Release builds never write a key name or the front app's bundle id to the system log, so there is no record of what you pressed even on your own Mac. The update check fetches a 778-byte file and sends no model, CPU, memory, macOS version or language with it. A free copy never contacts the licence server at all, and an activated one sends four fields, none of them a hardware fingerprint. Your config is a file on your disk that nothing on the network ever reads.

The optional password field helper is built to the same rule. It opens the keyboard non-seizing, so it has no mechanism to swallow a key. Its entire vocabulary back to the app is one number out of a list the app itself wrote, never a key code, a character or a timestamp. A key that types a character is watchable only together with Command or Control, and that rule is enforced three times: in the app, in the helper when the list arrives, and again on every press. It holds zero entitlements, and it answers only the user sitting at the Mac.

Installed the way you install everything else.

brew install --cask hotkeys-app/tap/hotkeys

Or the notarized, stapled dmg, which updates itself daily from its own signed feed, and installing it never asks for an administrator password. There is an App Store edition too, which none of BetterTouchTool, Keyboard Maestro, Karabiner-Elements, Hammerspoon, skhd, Raycast or Alfred offers, and moving up from it carries your config out of the sandbox on first launch, with nothing to export.

Leaving is as easy: brew uninstall --zap --cask hotkeys removes the app and names every path it ever wrote, and the cask unloads the password field helper, which is a root service that would otherwise outlive the bundle.

Free is the whole product: every method, every context, every trigger, no clock and no countdown. The only thing a licence changes is the number of hotkeys the file loads. Pro is 15 dollars once, three Macs, updates included, bought in ten seconds without an account. BetterTouchTool is 25 lifetime after a 45 day trial, Keyboard Maestro 36 per major version after 30 days, the Alfred Powerpack 34 pounds, Raycast Pro 96 dollars a year, every year.