TangoDown Security – the local OSINT workbench

Three principles

⌬

Everything in one place

Case, graph, map, browser, research and report work together. Findings go into the case with their source, and the report is built from the case file. No copying between five tools.

🔒

Your data stays with you

Cases are stored encrypted on your machine; unlocking can additionally be secured with a YubiKey. No telemetry, no account with the vendor. External services are only queried when you use and approve them.

⛓

Traceable case work

Audit log with source, time, checksum and justification for queries and findings, hash-chained. Closed cases are read-only. Exceptions are marked: the "free mode" of the edition for private investigators (no logging) and the built-in command line (PowerShell, CMD, WSL) – only opening and closing are logged there, not the input.

What TangoDown does

More than 60 modules – here are the most important. All in one interface, freely arranged, even across several screens.

⧉

Multiple monitors

Almost every module and window can be popped out and spread across additional screens – graph on the left, map on the right, monitoring wall on the third. TangoDown remembers the layout per case.

⌬

Investigation Graph

People, accounts, domains, wallets and places as a network. Queries via right-click, Search Around, subgraphs, shortest paths.

◍

Situation map & Geo intel

Finds, geofences, map symbols, live picture with aircraft and ships, world clock – on one map.

₿

Chain-Trace

Follow money flows on Bitcoin, Ethereum and other chains – with labels, swaps and plain-language explanations.

@

SOCMINT & social search

Check usernames on more than 40 platforms, watch hashtags and posts, take hits straight into the case.

✧

AI research

The AI proposes a research plan – you approve every step. Results as leads, never as findings.

⎙

Evidence capture

Capture single web pages exactly as displayed: full-page image and an archive file of that page (MHTML, with images and styling), each with SHA-256, time and origin in the audit log. Optionally several pages of a website (limited, robots.txt respected) with a page list.

⌕

Research browser

Isolated browser per case with tracker blocking, cloaking profile, download quarantine and finds on the page.

▦

Report Builder

Reports as PDF or Word with graph, evidence, sources and checksums – with your own logo.

⌖

Network & cyber

Domains, subdomains, mail checks (SPF, DKIM, DMARC), Shodan, PCAP and log analysis, single-target scan with an order.

▣

Sandbox & VMs

Open suspicious files in isolated virtual machines – with file forensics and hash checks.

▤

Monitoring walls

Webcams, live streams and situation pictures on your own walls – even on a second monitor.

⛓

Audit log & required details

Purpose, legal basis and retention deadline per case. Hash-chained log, four-eyes approvals in the agency edition.

Screenshots

Real screenshots from TangoDown – with demo data, no real people.

AI research: plan with approval per step

Bitcoin Discovery – where an address is mentioned publicly

Video

To play, your browser loads the video from YouTube (Google Ireland Ltd.). Among other things, your IP address and device information are transmitted to YouTube; Google may also process data in the USA. Nothing is loaded from YouTube before you click. Privacy

↗ Watch on YouTube

Load YouTube videos on this website directly from now on (stored in this browser only)

Who it is for

Private investigators & investigation teams

One case = one file. Purpose, retention deadline and sources are always included, the report is one click away.

OSINT analysts & journalists

Graph, map, browser and connectors in one interface. Ctrl+K finds every function.

Security teams

Domain, mail, PCAP and cyber tools, sandbox VMs for suspicious files.

Agencies

Agency edition with roles, orders, four-eyes approvals and offline operation (air gap).

Good to know

TangoDown helps you organise your research and keeps a record of every step. What the results mean is still up to you: a hit is a lead to begin with, and the AI gets things wrong now and then – so a second look is always worth it.

The app works with publicly available sources. Active scans belong only where you have been asked to run them. And whether a result can be used in court, for example, is not something any program can promise – if in doubt, ask someone who knows the field.

Waiting list

TangoDown Security is not publicly available yet. Sign up – I will write to you as soon as there is news or a release. No newsletter service, no sharing, unsubscribe at any time.

Already signed up? Unsubscribe here

Download

Free for Windows 11 (64-bit). Windows 10 no longer receives security updates from Microsoft – TangoDown still starts there, but I advise against it for investigative work. Installer or portable version – both verifiable via SHA-256.

🧪 Still in development and testing

TangoDown is a free hobby project developed by a single person in their spare time. The software is still being tested – there are certainly still bugs and a lot to improve, and some areas or functions may not yet work fully.

Help improve it in a targeted way: Tell me what you notice – ideally with the version, the exact steps leading to the error (reproducible), what you expected and what happened instead, preferably with a screenshot and the diagnostic report from the app (*Help & info → Contact → Create diagnostic report*).

If you would like to support the work: crypto or PayPal are welcome (see *Support*).

🐞 Report a bug (email) 💡 Suggest an improvement (email) Contact form Support

With a screenshot or diagnostic report, email works best – the buttons open a prepared message to info@tangodown.eu; you add attachments in your mail program.

⏸ Downloads are temporarily disabled. Please check back later.

Manuals as PDF: Manual ⬇ English PDF · 5.0 MB · v0.87.0 ⬇ Deutsch PDF · 5.0 MB · v0.87.0 Developer guide (plugins, interfaces) ⬇ English PDF · 1.0 MB · v0.87.0 ⬇ Deutsch PDF · 1.2 MB · v0.87.0

Plugin marketplace

Free extensions for TangoDown. Each plugin comes from its author, who is also responsible for it. There is no in-depth review. Install and use at your own risk. JavaScript and Python plugins run isolated in the sandbox and need your approval before their first run. Plugins of the "local web service" kind are separate programs outside the sandbox – they can do on your computer whatever that program is allowed to do.

No plugins published yet.

Plugins →

News

No news yet.

Frequently asked questions

What does TangoDown cost?

The version on this site is free. External data services you connect yourself may have their own costs.

Is my data sent anywhere?

No. Cases are stored encrypted on your machine, there is no telemetry. Queries to external services only happen when you start them – via the network route you choose (direct, Tor, proxy or VPN).

Does TangoDown work offline?

Yes. Case file, graph, analysis, reports and evidence work offline; the agency edition has its own air-gap mode.

Why does Windows warn on start?

Code signing is in progress. Until then: compare the checksum (SHA-256), then "More info" → "Run anyway".

Are the results court-proof?

I make no such assurance. Only courts and authorities decide on evidential value and admissibility, case by case. TangoDown logs the work steps (source, time, checksum, justification) – whether that is enough for your purpose is for you to clarify, if in doubt with legal advice.

How do I get updates?

On request, TangoDown checks here for a new version and shows the download and checksum. Nothing is ever installed automatically.

♥ Support the project

TangoDown is free. If you want to support further development, you can donate directly – via Bitcoin, Ethereum, USDC, XRP or PayPal.

Bitcoin

bc1qv9vht24kdarq6cqcgjr392yh83pemp9kugl5gs

Voluntary and without anything in return – using TangoDown stays free. For crypto, please check the network before sending and compare the address with the one shown here.

Developer

Lars Stahl

TangoDown Security is developed privately by Lars Stahl – free, without warranty. Questions, ideas and bug reports are welcome.

LinkedIn profile ✉ Write an e-mail

Contact

Questions, feedback, found a bug? Write to me.

Found a bug? Please include the version, exact steps, expected and actual result – preferably with a screenshot and diagnostic report (Help & info → Contact).

🐞 Report a bug (email) 💡 Suggest an improvement (email)