Skip to main content
OpenWhispr tells you it can’t reach the cloud — either during onboarding (“We can’t reach OpenWhispr Cloud from this network”) or when a dictation fails (“Can’t reach OpenWhispr Cloud”). That’s a network path problem rather than an account problem. Your notes and local dictation are unaffected.

​
Quick checks

1

Try another network

Tethering to a phone for one dictation is the fastest diagnostic there is. If it works there, the problem is the network you were on — which points at a firewall, a DNS filter, or a proxy.
2

Check the error you got

If it mentioned a TLS handshake — “check your system clock or for a corporate proxy” — skip to Certificate and proxy errors.
3

Check your system clock

A clock that’s wrong by more than a few minutes breaks TLS outright. Set it to update automatically.
4

Use local processing meanwhile

Local models need no network at all. Set it per mode: Settings → Speech-to-Text under AI Models, then the tab for the mode you’re using — Dictation, Note Recording or Audio Upload. See Local models.

​
On a work or school network

Managed networks block by default, and OpenWhispr will be blocked along with everything else new. What your IT team needs is the host list:

Network allowlist

Every host the app contacts, with purpose and protocol — written to be forwarded as-is.
The two that matter most are api.openwhispr.com and auth.openwhispr.com. Without the second you can’t sign in at all.

​
Certificate and proxy errors

If you see a certificate error, a TLS handshake failure, or a warning about SSL inspection, a proxy is intercepting the connection and its root certificate isn’t trusted by your operating system. This is normal on corporate networks and it isn’t something OpenWhispr can work around — the fix is for the proxy’s root certificate to be installed in the system trust store, which your IT team will already do for other software. Model downloads report this specifically: “Certificate error — your network may use SSL inspection that blocks downloads. Try downloading from a different network.” That advice works, and it’s often the quickest way to get a local model installed before returning to the managed network.

​
VPNs and security software

Any of these can sit in the path:
  • Corporate VPNs that force all traffic through an inspecting gateway.
  • Consumer VPNs whose exit node is blocked or rate-limited.
  • DNS filters and ad blockers, including router-level ones — these produce “could not resolve host” rather than a connection failure.
  • Endpoint security software that inspects TLS.
Turn them off one at a time and retry. That identifies the one responsible faster than reasoning about it.

​
FAQ

Local processing does — transcription on a downloaded model needs no network at all. Cloud transcription, sync and the cloud agent need the connection. See Cloud vs local.
The app follows your system proxy settings, including PAC scripts, on every platform. Configure it at the operating-system level and OpenWhispr picks it up.
Then a filter is matching our hostnames specifically. Ask your IT team to allowlist the hosts on the network allowlist page — that’s what it’s for.
Both use api.openwhispr.com, so a partial failure usually means an intermittent path rather than a block. A debug log will show which requests failed — see how to send one.