Antivirus and firewall: what to allow for VoiceKeyboard

When this applies

Some security products check a program the first time it runs, and again after it has been idle for a while. VoiceKeyboard starts a few small programs of its own for files and for Whisper: ffmpeg and yt-dlp (FILES), whisper-cli and whisper-server (Whisper). With such a product the first file, or the first Whisper phrase, can start a few seconds late. Nothing is broken; the product is looking at the program before it lets it run.

Dictation with Google, Soniox, Vosk, GigaAM v3, T-one and Parakeet v3 starts none of these programs. Vosk, GigaAM v3, T-one and Parakeet v3 run inside VoiceKeyboard itself, Soniox is a network connection, and Google uses the Chrome you already have installed.

Adding the folders below to your product's trusted list or exclusions tells it to skip that look. You do it once, in the product. VoiceKeyboard never changes antivirus or firewall settings itself.

VoiceKeyboard measures how long its helper programs take to start. When one takes longer than 1.5 seconds, it shows a window titled "Your security program is slowing VoiceKeyboard down", once each time you start VoiceKeyboard and only at a quiet moment: nothing is being dictated or transcribed, and VoiceKeyboard's window is the one in use. The window names the security program it found and lists the three folders below, each with a "Copy" button. "Open instructions" opens the section of this page for your product, and "Don't show again" stops the window from appearing by itself. You can open the same window at any time from SETUP → Help with the "What to add…" button.

Which programs VoiceKeyboard starts

The folders to add

Add these three folders. Only the first two hold programs from VoiceKeyboard; the third holds ffmpeg and yt-dlp, which VoiceKeyboard downloads after you agree, or copies from your computer.

1. The program folder, the one that contains VoiceKeyboard.exe. Its subfolder tools\whisper\cpu holds the built-in whisper-cli.exe. There is no fixed address, because it depends on how you installed the program. To find it while VoiceKeyboard is running, press Ctrl+Shift+Esc, right-click VoiceKeyboard in the list and choose "Open file location".
2. %AppData%\VoiceKeyboard\backends, which is C:\Users\your name\AppData\Roaming\VoiceKeyboard\backends. It holds the CUDA and OpenBLAS speed-up engines (the cuda and blas folders) with their own whisper-cli.exe and whisper-server.exe. It appears after you accept "Install and accelerate".
3. %LocalAppData%\VoiceKeyboard\tools, which is C:\Users\your name\AppData\Local\VoiceKeyboard\tools. FILES needs ffmpeg for every file and yt-dlp for links. When they are missing, VoiceKeyboard asks first, and only after you press "Download" does it fetch them: ffmpeg into the subfolder ffmpeg, yt-dlp into this folder itself. A copy that is already on your computer's PATH is copied here instead. The folder appears after that first file or link.

If a folder does not exist yet, skip it and add it when it appears.

How to paste a path

%AppData% and %LocalAppData% are Windows shortcuts for folders inside your user profile. Most antivirus windows do not understand them, so use the full path:

1. Press Win+R, type %AppData%\VoiceKeyboard\backends and press Enter. Explorer opens the folder. If Windows says it cannot find it, the folder does not exist yet.
2. Click an empty place in the address bar. The full path appears; press Ctrl+C to copy it.
3. In the antivirus window, paste it with Ctrl+V into the folder box, or into the folder name field of the Browse dialog.

Product by product:

• Windows Security (Microsoft Defender)
• COMODO Internet Security
• Kaspersky
• ESET
• Avast and AVG
• Bitdefender
• Norton
• McAfee
• Another product

Windows Security (Microsoft Defender)

If another antivirus is installed, Windows usually switches Defender's scanning off, and you need that product's section instead.

1. Open Start, type "Windows Security" and open the app.
2. Select Virus & threat protection, then Manage settings.
3. Under Exclusions, select Add or remove exclusions. Confirm the Windows permission prompt if it appears.
4. Select Add an exclusion, choose Folder, and pick or paste the folder.

Repeat for each folder. Microsoft's own steps are in Virus and threat protection in the Windows Security app.

COMODO Internet Security

COMODO has three places where a folder can be trusted. Start with the first: it tells COMODO that the programs in the folder are known and safe. Steps for version 12:

1. Open COMODO, click Settings, then File Rating → File List. Click Add and choose Folders (or Files, if your version offers only that), select the VoiceKeyboard folder and give it the rating Trusted.
2. Go to Settings → Containment → Auto-Containment and click Add. Choose the action Ignore and the VoiceKeyboard folder as the target (the Criteria tab, Edit). Ignore means the program is not contained and runs as normal.
3. If COMODO still scans the folder, go to Settings → Advanced Protection → Scan Exclusions, open the Excluded Paths tab and click Add → Folders.

If a HIPS alert appears for one of the programs, choose "Allowed Application" under "Treat as" and tick "Remember my answer". The COMODO help pages: File Rating, Auto-Containment rules, Scan Exclusions, HIPS. Older COMODO versions use Security Settings → File Rating, so the menu may differ.

Kaspersky

For Kaspersky Standard, Plus and Premium:

1. Open the main window and click the settings button (the gear) at the bottom.
2. Go to Security settings → Exclusions and actions on object detection, and click Manage exclusions.
3. Click Add, then Browse, choose the folder and click Select.
4. Leave the status Active and click Add.

Older versions call the section "Threats and exclusions". Kaspersky's page: How to exclude a file, folder, or threat type from scanning.

ESET

For ESET Internet Security, Smart Security Premium and Security Ultimate, version 19:

1. Press F5 to open Advanced setup.
2. Go to Scans → Exclusions, find Performance exclusions and click Edit.
3. Click Add. Click the browse icon next to the Path field and pick the folder, or type the full path and end it with \*, which tells ESET it is a folder.
4. Click OK on each window until the settings close.

ESET's pages: Performance exclusions and KB2769. Older versions say "Detection engine" instead of "Scans".

Avast and AVG

Avast and AVG use the same screens and the same steps. For Avast Free Antivirus, Avast Premium Security, AVG AntiVirus Free and AVG Internet Security:

1. Open the program and go to ☰ Menu → Settings.
2. Select General → Exceptions and click Add exception.
3. Read the questions, then click Next → I understand risks.
4. Open the File / Folder tab, click the folder icon, choose the folder and click OK.
5. Click Advanced options and check that all the features are ticked, in particular Hardened Mode detections and CyberCapture detections: those two judge programs the product does not know yet.
6. Click Add.

The vendors' pages: Avast Antivirus and AVG Antivirus. Avast One has its own steps on the Avast support site.

Bitdefender

In the Bitdefender consumer products for Windows:

1. Open Bitdefender and click Protection in the navigation menu.
2. In the Antivirus pane, click Open. On the Settings tab, click Manage Exceptions.
3. Click +Add an Exception. Enter the folder path in the field, or click the magnifying glass, browse to the folder and click OK.
4. Turn on the switch next to Antivirus and click Save.

Advanced Threat Defense, which watches programs while they run, keeps its own list: if it blocks one of the programs, repeat the steps from its pane. Bitdefender's pages: How to exclude files and folders from Bitdefender Antivirus scan and How to stop Advanced Threat Defense from blocking a trusted app. The newest app versions may word the menus a little differently.

Norton

For Norton 360 and Norton AntiVirus Plus on Windows:

1. Open your Norton product and click Security in the left pane.
2. On the Scans tile, click Open, then open the Exclusions tab.
3. Click Add Exclusion, then the browse icon, and select the folder. Click OK.
4. Click Add. The folder appears in the Exclusions list.

Norton's page: Exclude files and folders from Norton scans. Older Norton versions put this under Settings → Antivirus → Scans and Risks → Exclusions / Low Risks.

McAfee

McAfee Total Protection and LiveSafe keep the exclusion list with the real-time scanning settings. McAfee's menu names change between versions, so the steps are general:

1. Open the McAfee app and go to the real-time scanning settings.
2. Find the list of excluded files and click Add file.
3. Browse to the program and add it. If your version takes only single files, add the programs one by one: VoiceKeyboard.exe, whisper-cli.exe, whisper-server.exe, ffmpeg.exe and yt-dlp.exe, each from its folder above.

McAfee's page: Exclude files from virus scans on Windows and macOS.

Another product

Every product names it differently. Look in its settings for "exclusions", "exceptions", "trusted applications" or "allow list", and add the same three folders. Use the full paths from Explorer. The product's own help page for "exclude a folder" has the exact steps for your version. If the product has no such option, nothing breaks: the start of file transcription and of Whisper just takes a few seconds longer.

Firewall

VoiceKeyboard only connects out to the internet. Inside the computer, its window, Chrome and whisper-server talk to each other on 127.0.0.1, which never leaves this computer. No incoming rule and no open port are needed. Windows Defender Firewall allows outgoing connections by default, so there is usually nothing to set there.

A firewall that asks about each program should be told this:

• VoiceKeyboard.exe needs the internet for Soniox (a secure connection to Soniox), for the Pro licence server when you activate or renew, and for downloads you start or agree to: models from Hugging Face and alphacephei.com (Vosk), and the speed-up engines, ffmpeg and yt-dlp from GitHub. If an official source fails, the same file is fetched from voice-keyboard.com. It also listens on 127.0.0.1 for Chrome and talks to whisper-server there. A firewall that blocks this local traffic stops Google dictation.
• Chrome sends the audio to Google's speech recognition when the Google engine is on.
• yt-dlp.exe fetches the video behind a link on FILES.
• ffmpeg.exe and whisper-cli.exe use no network. whisper-server.exe only answers VoiceKeyboard on 127.0.0.1. Allowing local access is enough for them. If a firewall blocks even that, Whisper dictation falls back to starting whisper-cli for every phrase, which is slower because the model is loaded each time.

Keep exclusions small

Add only the VoiceKeyboard folders above, never a whole drive, your user profile, Downloads or the Temp folder. An exclusion means the product no longer looks inside, and a narrow one limits the risk to programs that VoiceKeyboard brought: it checks the speed-up engines against a fixed SHA-256 value before installing them. If you move the program to another folder, add the new one and remove the old entry.

After adding the folders, transcribe a file on FILES. If it still starts slowly, file transcription speed shows how to test the engines.