How to Tell if a Mac App Is Safe: 5 Real Checks

Short answer

No single check proves a Mac app is safe. Get it from the Mac App Store or the maker's real site, confirm it is signed and notarized, and notice what permissions it asks for. Notarization means Apple's automated scan found no known malware, not that a person reviewed the app. And never paste a Terminal command from a web page to install something.

1. Check where it came from

Apple calls the App Store the safest source, because Apple reviews and signs each app there and can remove problem apps quickly. Outside the store, go to the maker's own site. Type the address or follow a link from a source you trust. Attackers do copy real sites. One 2020 campaign used a lookalike of the Homebrew site.

2. Check the signature and notarization

Drag the app to Applications, but do not open it yet. Then run this in Terminal, with your app's name:

spctl -a -vv /Applications/YourApp.app

Result	What it means
`accepted` and `source=Notarized Developer ID`	Signed by a registered developer and notarized by Apple
`accepted` and `source=Developer ID`	Signed, but not notarized, per Apple's Xcode help
`accepted` and `source=Apple System`	Part of macOS
`rejected`	Gatekeeper would not allow it under its normal rules

The origin= line names who signed it. Check that it matches the company or person you expected. We ran this on macOS 26.7.1 on October 30, 2026, and Google Chrome showed origin=Developer ID Application: Google LLC.

To see the full signing chain, or to test only for notarization:

codesign -dv --verbose=2 /Applications/YourApp.app
codesign --test-requirement="=notarized" --verify /Applications/YourApp.app

The second command prints nothing when the app passes. Apple's own built-in apps fail that test because they are signed differently, so it is only useful for third-party apps.

3. Know what notarization does not prove

Apple says plainly that notarization is not App Review. It is an automated scan for malicious content and code-signing problems. It says nothing about quality, privacy or whether the app does what it promises. Malware has also passed it: in 2020, researcher Patrick Wardle reported notarized Shlayer malware, and Apple revoked the certificates he reported.

4. Notice what the app asks for

The sandbox is required in the Mac App Store, but many good direct downloads do not use it, because they need more access to do their job. So ask whether each request makes sense. A window manager needing Accessibility does. A calculator wanting your contacts does not. You can review and remove access in System Settings, under Privacy & Security.

5. Never paste install commands from a web page

A common attack in 2026 skips the app altogether. A page tells you to paste a command into Terminal, or to run a script it opens for you, as a "fix" or a "verification". That route avoids the checks above. Some real developer tools do install from Terminal, so use only the command on the official site, and only when you meant to install that tool. If you have already run an unknown command, treat the Mac as possibly compromised and change your passwords from another device.

What a MacPip blue tick means

It means a person checked that app on the date shown. For downloads, that covers the Developer ID signature and notarization, a comparison of the screenshots with the real app, and opening it to see that it does what it says. Each ticked app shows a dated report. Apps marked Check pending have not had this yet. A tick is not a guarantee that an app is safe, as our terms say. It is one more piece of evidence, with a date on it.

If macOS has already shown you a warning, read what "Apple could not verify" means.

Sources

Submit your app Browse apps

How to tell if a Mac app is safe