How to set up private offline dictation on a Mac

Start by naming the data. Dictation can contain raw audio, transcript text, corrections, surrounding screen context, custom vocabulary, app names, clipboard contents, API keys, and local history. It may reveal health, legal, client, source-code, financial, or personal information even when the final sentence looks harmless. Decide which categories may leave the device and how long each can remain locally.

Then map the system. Audio moves from a microphone to a recorder and speech model. Text may pass through punctuation, replacement, or language-model stages before reaching the cursor. The app can store history or audio and the Mac can back those files up. A destination such as email, Slack, Cursor, or a web form has its own processing. “Offline dictation” usually describes the speech-model stage, not this entire chain.

Whisper is a general-purpose OpenAI model family with multilingual recognition, translation, and several sizes. Smaller variants need fewer resources, while larger ones demand more memory and can improve difficult audio. Parakeet is a family of NVIDIA speech-recognition models with several architectures and language profiles. A particular app may use an optimized port rather than the original framework, so model-card numbers do not directly predict Mac performance.

Begin with a model the app officially supports on your hardware. Test your primary language, names, technical vocabulary, fast speech, whispering, and background noise. Prefer the smallest model that produces reliable text without disrupting the Mac. Keep a second model for multilingual or difficult sessions. Download models from the app's trusted source before going offline and verify their storage footprint.

Microphone access is unavoidable for live speech. macOS lets you review and revoke it under Privacy & Security → Microphone, and Control Center shows a recording indicator when the microphone is or recently was used. Grant access only to the selected dictation app. Remove old tools from the list so several background apps are not competing for capture.

System-wide text insertion may use Accessibility permission. Apple warns that this permission allows an app to access and control the Mac through accessibility features and recommends authorizing only familiar apps. A lower-permission editor extension can be safer when it solves the job. Review Accessibility access periodically, especially after testing several alternatives.

Disable cloud transcription providers, cloud fallback, AI enhancement, remote sync, optional improvement programs, context awareness, personalized cloud models, meeting upload, telemetry that contains content, and automatic sharing. Some apps separate these controls; others bundle them in a mode. Read the active configuration before every sensitive session and use a clearly named “Local literal” mode.

Context-aware cleanup deserves special attention. It can read nearby text to improve names or tone, which means the dictation tool sees more than the spoken sentence. If you need deterministic cleanup, use local dictionary terms and replacements first. When cloud enhancement is appropriate, create a separate mode and avoid mixing it with the shortcut used for sensitive local work.

Local storage is an advantage only when the endpoint is controlled. Determine whether the app stores audio, text, metrics, screenshots, vocabulary, model prompts, or debug logs. Check whether deletion removes the database record and audio file, and whether Time Machine or another backup retains copies. Use FileVault, a locked user account, current macOS updates, and organization endpoint controls where appropriate.

Set a retention period that matches the work. Keeping every dictation forever makes search convenient but turns a small app database into a sensitive archive. Consider disabling audio retention, deleting transcripts after delivery, and exporting only records with a real purpose. Never dictate passwords, recovery codes, private keys, or access tokens; a local history and clipboard can expose them just as surely as a server log.