Most Mac apps are fine, and a few minutes of checking separates the safe from the sketchy. This guide covers what macOS already verifies for you, what it leaves to you, and a routine you can run before opening anything unfamiliar.
What happens when you open a downloaded app#
You download a file
Browsers tag it as downloaded from the internet (a quarantine flag).
You open it for the first time
Gatekeeper wakes up.
Gatekeeper checks the signature
Is it signed by an identified developer, and unchanged since signing?
It checks notarization
Did Apple's automated scan approve this build?
It opens, or it warns you
A warning is your cue to stop and look closer.
Run the safety routine#
Five-minute safety routine
0/6
Check it yourself in Terminal#
Drag an app onto Terminal after typing the command, or type its path.
spctl --assess --type execute --verbose /Applications/YourApp.appPrints accepted or rejected. For a good app you will see source=Notarized Developer ID or source=Mac App Store.
To see who signed it:
codesign -dv --verbose=2 /Applications/YourApp.app 2>&1 | grep AuthorityShows the signing chain. Look for a company name you recognise on the Developer ID Application line.
If either command reports a problem, treat the app as untrusted until you know why.
What Gatekeeper and notarization cover#
| Checked | Not checked | |
|---|---|---|
| The developer is identified and the app is signed | Yes | No |
| The build passed Apple's automated malware scan | Yes | No |
| The app has not been altered since signing | Yes | No |
| The app's behaviour is fair to you (ads, tracking, upsells) | No | Yes |
| The developer will not change the app later | No | Yes |
Read the permissions#
macOS asks before an app uses sensitive areas. Find them all in System Settings → Privacy & Security.
| Permission | Real use | Question to ask |
|---|---|---|
| Full Disk Access | Backup tools, disk analysers | Does a notes app need your whole disk? |
| Accessibility | Window managers, text expanders | Can it do its job without watching your keystrokes? |
| Screen Recording | Screenshot and meeting tools | Is recording the point of the app? |
| Input Monitoring | Keyboard utilities | Why does it need every key? |
| Camera and Microphone | Calls, recording | Would it make sense for this app? |
| Files and Folders | Apps that open your documents | Is the folder one it needs? |
Review the lists later and remove what you no longer use. Granted permissions stay until you take them away. A network monitor such as Little Snitch shows what an app sends out, which helps if you are suspicious of one.
If macOS blocks an app#
When macOS says it cannot verify an app, stop and think. If you are sure the source is trustworthy:
- Try to open the app once, so macOS records the block.
- Open System Settings → Privacy & Security and scroll to the security section.
- Choose Open Anyway next to the app's name, and confirm.
Only do this for software you chose and downloaded yourself.
Already installed something suspicious?#
Match your symptom:
- Unexpected ads, pop-ups or a changed home page: remove unknown browser extensions, then remove unfamiliar items under System Settings → General → Login Items & Extensions. Delete the app and its leftovers, scan with a trusted tool and reset browser settings if they stay changed.
- An app you do not remember installing: right-click it, choose Get Info and note the developer. Search the name. If unwanted, move it to the Trash, empty the Trash and check Privacy & Security → Profiles for any profile you did not add. Our crash guide shows how to remove an app cleanly.
- You entered a password or card number somewhere you now doubt: change the password at once from a trusted device, turn on two-factor authentication, reuse it nowhere and watch your statements. Contact your bank if a card was involved.
A scanner such as Malwarebytes can check for known threats on demand. It adds a second opinion and does not replace good habits.
Free is not the same as risky#
Free apps from known developers are fine. A free app that asks for broad permissions and shows ads deserves more caution. Free vs paid Mac apps explains how to weigh that trade-off, and our Mac App Assessment can point you to apps that suit your needs.
Frequently asked questions#
Is an app from the Mac App Store always safe?#
It has passed Apple's review and runs in a sandbox, which lowers risk. You should still read permissions and reviews.
Does notarization mean Apple recommends the app?#
No. It means the build passed an automated scan and the developer is identified.
Can a Mac get a virus?#
Yes. Mac malware exists, though macOS defences block a lot of it. Safe habits matter more than any single tool.
Should I run unknown software in a virtual machine?#
That adds a layer of isolation for testing, at some cost in effort. Read Mac virtualization explained to see whether it fits.
Written by
Guides are researched, written, and maintained by the Atypical Mac User editorial team. Every procedure is checked against the current version of macOS before it is marked as published.
Last updated . First published .
Related guides
Free vs Paid Mac Apps: How to Decide
A practical framework for deciding when a free Mac app is enough and when paying makes sense.
3 min read
How to Fix an App That Keeps Crashing on Mac
How to work out why an app quits or freezes, and the fixes in order of risk.
3 min read
Mac Virtualization Explained: Do You Need a Virtual Machine?
What virtual machines are, what they're for on a Mac, and the cases where you don't need one.
2 min read
Next recommended guide
Free vs Paid Mac Apps: How to Decide
A practical framework for deciding when a free Mac app is enough and when paying makes sense.