How to Check if a Mac App Is Safe Before Installing

This guide walks you through a practical checklist to evaluate any Mac app you’ve downloaded from outside the App Store — especially the quirky, lesser-known ones. You’ll learn how to inspect the app’s code signature, check its permissions, scan it with built-in tools, and make an informed decision before double-clicking that installer.

What You’ll Need

• A Mac running macOS Catalina (10.15) or later
• The downloaded app file (usually a .dmg or .pkg) or the app itself in your Downloads folder
• An internet connection for checking developer reputation and scanning with online services (optional but recommended)

Step-by-Step

1. Check the source. Before anything else, ask where you got the app. If it’s from the developer’s own website, a trusted GitHub repository, or a well-known mirror, that’s a good start. If it came from a random forum post, a pop-up ad, or a torrent site, treat it as highly suspicious and skip to Step 7.
2. Look at the app’s quarantine attribute. When you download an app from the internet, macOS attaches a quarantine flag. Right-click the app file (or .dmg) and select Get Info. Under the General section, look for “Where from:� — it should show the download URL. If this line is missing, the file may have been created on your Mac or the flag was stripped, which is a red flag. Also, if the “Open� button shows a warning like “Apple could not verify this app,� that’s the quarantine system doing its job.
3. Verify the code signature. Open Terminal (in /Applications/Utilities) and run the following command, replacing /path/to/app.app with the actual path (you can drag the app into the Terminal window to fill it in):
   codesign --verify --deep --strict --verbose=2 /path/to/app.app
   If it says “valid on disk� and “satisfies its Designated Requirement,� the signature is intact. If it says “code object is not signed at all� or “invalid signature,� the app has been tampered with or was never properly signed — do not install it.
4. Check who signed it. Run codesign -dv --verbose=4 /path/to/app.app and look at the Authority lines. You should see a developer name and a certificate chain ending in “Apple Root CA.â€� If the authority says “Apple Mac OS Application Signingâ€� or similar, it’s an Apple-signed app (rare for third-party). If it says “Testâ€� or “Self-signed,â€� that’s a warning. Cross-reference the developer name with their website or a quick web search.
5. Scan for malware. macOS includes XProtect, which runs silently, but you can also upload the app file to VirusTotal (virustotal.com) — a free service that scans with over 60 antivirus engines. Drag the .dmg or .app zip file (you may need to zip the .app first) to the VirusTotal website. If any engine flags it, don’t install it.
6. Inspect the app bundle. Right-click the .app file and choose Show Package Contents. Look inside the Contents folder. A typical app has a MacOS folder with an executable, a Resources folder, and an Info.plist. If you see scripts, shell files, or unusual binaries in unexpected places, be careful. You can also run spctl -a -vv /path/to/app.app in Terminal to check if Gatekeeper would allow it to run. If it says “rejected,â€� the app is not notarized — a strong warning sign.
7. Review permissions before launching. Even if the app passes all checks, macOS will ask for permissions (camera, microphone, contacts, etc.) the first time you open it. Read each prompt carefully. A simple calculator app should not ask for location or full disk access. If it does, click Don’t Allow and delete the app.
8. Run it in a sandbox or virtual machine (optional). If you’re still unsure, create a separate macOS user account (System Settings > Users & Groups) and install the app there first. Or, if you have a spare Mac or a virtual machine, test it there. This isolates any potential damage from your main system.
9. Monitor system activity after launch. After opening the app, check Activity Monitor (in /Applications/Utilities). Look for the app’s process and see what it’s doing. Also check System Settings > Privacy & Security for any new entries that you didn’t approve. If you notice high CPU usage, network connections to unknown servers, or files being created in odd places, quit the app and remove it.
10. Remove it if anything feels off. To uninstall a downloaded app, drag it from /Applications to the Trash, then also delete any files it created in ~/Library/Application Support, ~/Library/Preferences, and ~/Library/Caches. A quick way is to use a free uninstaller tool or search for the app name in Finder while holding Option to see the Library folder.

Common Mistakes

• Ignoring the “unidentified developerâ€� warning. This warning means the app is not notarized by Apple. While not all unsigned apps are malicious, it’s a sign you need to do extra checks.
• Trusting a .pkg installer blindly. Package installers can run scripts with root privileges. Always check the package contents first: double-click the .pkg, then go to File > Show Files in the Installer window to see what it will install.
• Assuming the App Store is the only safe source. The App Store has its own review process, but it’s not foolproof. Still, apps from the App Store are sandboxed and signed, so they’re generally safer than random downloads.
• Disabling Gatekeeper globally. Running sudo spctl --master-disable to allow all apps is a terrible idea. It removes a key layer of protection. Instead, right-click the app and choose Open if you’ve verified it manually.
• Skipping the VirusTotal scan. It takes two minutes and can catch known malware that XProtect misses.

Tips

• Use Homebrew. If you install apps via Homebrew (brew install), it often pulls from verified sources and checks checksums automatically. The brew audit command can flag issues.
• Check the developer’s website for a support page. Legitimate developers usually have a contact page, a changelog, and a privacy policy. If the site is a single-page with no contact info, that’s a red flag.
• Look for a checksum. Many developers publish SHA-256 hashes for their downloads. You can verify with shasum -a 256 /path/to/file in Terminal and compare the output.
• Keep macOS updated. Apple updates XProtect and Gatekeeper definitions regularly. Staying current closes known vulnerabilities.
• Use a dedicated user account for testing. Even a standard (non-admin) user account limits what a malicious app can do. Don’t run unfamiliar apps as an admin.

Troubleshooting

• “App is damaged and can’t be openedâ€� or “Apple could not verify it.â€� This usually means the quarantine flag is present and the app is not notarized. Re-download the file from the official source. If it persists, the file may be corrupted — check the file size against the website’s stated size.
• codesign says “invalid signatureâ€� but the app works. This can happen if the app was modified after signing (e.g., by a crack tool). Do not trust it. Delete it.
• VirusTotal shows one or two detections. Look at the engine names. Sometimes generic “Heuristicâ€� detections are false positives for legitimate apps. Check the detection ratio — if it’s 2 out of 60, it might be a false positive, but if it’s 20 out of 60, it’s almost certainly malicious.
• The app asks for admin password during install. This is normal for many apps, but if it’s a tiny utility that shouldn’t need root access, cancel and investigate. Check the .pkg contents first.
• You already installed it and now regret it. Quit the app, move it to the Trash, then run sudo pkill -f appname in Terminal to kill any background processes. Then check ~/Library/LaunchAgents and /Library/LaunchDaemons for any auto-start entries related to the app and remove them.
• You’re not sure about a specific app. Search for “[app name] malwareâ€� or “[app name] safeâ€� on Google. Read recent Reddit threads or MacRumors forums. If you find no discussion at all, that’s a warning — popular safe apps usually have some footprint.

Frequently Asked Questions

Is it safe to install apps from outside the Mac App Store?

Yes, many reputable apps are only sold outside the App Store. The key is to verify the source and signature, not to assume all non-App Store apps are dangerous.

What does “unidentified developer� mean?

It means the app is not signed with an Apple-issued Developer ID and has not been notarized. It’s not automatically malware, but you must do extra checks before running it.

Can I trust an app if my antivirus says it’s clean?

No antivirus catches everything. Use VirusTotal for a second opinion, and combine that with signature verification and behavioral monitoring.

How do I know if an app is secretly sending my data?

After launching, use a network monitor like Little Snitch (paid) or the built-in lsof -i command in Terminal to see outbound connections. If an app connects to unknown IPs, that’s suspicious.

What’s the difference between a .dmg and a .pkg?

A .dmg is a disk image that you mount and drag the app out of — the app runs from your Applications folder. A .pkg is an installer that runs scripts and can install files in system locations. .pkg files are riskier because they can execute code with admin privileges.

Should I use a third-party “cleaner� app to remove a suspicious app?

You can, but manual removal is safer because cleaners sometimes delete legitimate files. Drag the app to Trash, then manually check the ~/Library folders mentioned in Step 10.

Related

• Pin Programs to Start Menu in Windows 10
• How to Make a FaceTime Call from iPhone to Android
• Schedule an Email on Mac: 5 Ways That Work