Apple could not verify an app is free of malware: what it means

The alert appears the first time you open the app, and the app stays closed. Click Done to leave it where it is, or Move to Trash if you don't want it. If you trust the app, you can approve it once in System Settings; the steps are in how to use Open Anyway. Whether you should depends on where the app came from and who made it.

What the message means

In Apple's current example of the alert, from macOS Sequoia, the title says the app was “Not Opened”, and its text says Apple could not verify the app is free of malware that may harm your Mac or compromise your privacy. The same text appears in System Settings › Privacy & Security under Security, below a line saying the app was blocked to protect your Mac, next to an Open Anyway button.

You may see other wording: Apple's article on opening apps safely also lists alerts saying Apple can't check the app for malicious software, or that the app's developer can't be verified. For the second, Apple explains that when the developer can't be verified and, since macOS Catalina, the app hasn't been notarized, macOS can't verify that the app is free of malware.

It's a missing check, not a finding. When macOS does find a problem, the alert says something else, and Apple's article explains each one:

• The app will damage your computer: macOS detected malicious content, or the app's authorization was revoked.
• The app is damaged or can't be opened: it was modified or broken, possibly tampered with.
• The app was moved to the Trash: macOS recognized known malware.

Those are not alerts to work around. Delete the app, and get a fresh copy from the developer if you still want it.

Notarization in plain words

Notarization is an automated scan. A developer signs the app with a Developer ID certificate and sends it to Apple's notary service, which checks it for malicious content and code-signing problems. If it finds none, Apple issues a ticket that Gatekeeper, the part of macOS that checks apps before they open, can find online or attached to the app.

Apple's developer documentation is clear that notarization isn't App Review: it's a check for malicious content, not a review of what the app does, how well it works or what it does with your data. An app that passed it can still ask for permissions it doesn't need. Since macOS Catalina, macOS requires notarization by default for software from outside the App Store.

Signed, notarized, or from the Mac App Store

What you see the first time depends on where the app comes from and what Apple was able to check:

Your Mac's own setting decides which of these may open at all. In Privacy & Security under Security, Allow applications from offers App Store or App Store & Known Developers; on macOS 14 the setting is Allow applications downloaded from, with App Store and identified developers as the second choice. With the first choice, macOS won't open apps from anywhere else, and the alert says so instead.

Check who signed an app

You can ask macOS the same question Gatekeeper asks, before you open the app. In Terminal, run this command with the app's path at the end. To fill in the path, type everything before it, add a space, drag the app onto the Terminal window, and press Return:

spctl -vvv --assess --type exec /Applications/Example.app

Apple documents this command in its guide to notarization issues. The first line ends in accepted or rejected, and the lines below it say why:

rejected means Gatekeeper's policy doesn't allow the app as it stands; on its own, it isn't a malware verdict. For the details of the signature itself, codesign -dvv followed by the app's path lists the certificates it was signed with on its Authority lines, and the developer's TeamIdentifier. Compare the name with the developer you meant to download from. Developers sometimes sign with a personal or company name that differs from the app's brand, so if the name means nothing to you, or there's no signature at all, rely on another check, such as a checksum the developer publishes, or ask them.

When it's reasonable to open it

Apple's advice is to override the warning only when you're certain the app comes from a trustworthy source and hasn't been tampered with. Signs that you are:

• You know who makes it, and you downloaded it from their own website or a page they link to, not from an ad, a pop-up or a download site.
• The developer's own site says the app isn't notarized and what the first open looks like, and the alert you see matches. That alone proves little, since anyone can publish instructions, so treat it as one sign among the others here.
• You can confirm your copy: the signature names the developer you expect, or the checksum they publish matches your download.
• You were opening this app on purpose. The alert appeared when you double-clicked it, not out of nowhere.
• What it asks for next fits its job. Be most careful with Accessibility, Input Monitoring and Screen Recording; what Accessibility allows explains why.

Apple's Mac User Guide is stricter: it says you shouldn't override these settings for an app Apple hasn't checked, even one that looks like it comes from a major developer, and that the safest approach is a version from the Mac App Store or an alternative app. If you go ahead anyway, you approve the app once and macOS remembers it; Open Anyway, step by step covers macOS 14 and later.

When not to

• A website told you to install something to continue, such as a video player, a codec or an urgent update.
• It's a free copy of an app that normally costs money, or it came from a file-sharing site.
• Someone contacted you and asked you to install it, or the instructions also ask you to paste commands into Terminal or turn security settings off.
• You can't tell who made it, or where the download really came from.
• The alert was one of the others: damage, damaged, or moved to the Trash.

Our case: Flick

We make Flick, a window switcher, and it's one of these apps: Flick is signed but not notarized yet. On macOS 15 and later you'll see this alert the first time you open it, and on macOS 14 you Control-click it and choose Open instead. We say so on the download page, before you download, and the installation guide walks through the approval. You approve it once; after that it opens like any other app.

Flick isn't on the Mac App Store, and we publish it only on flicknav.com, so treat a copy from anywhere else as untrusted. Flick isn't signed with a Developer ID yet, so the commands above won't show our name or match a row in the table, and they can't confirm that your copy came from us. For Flick, the check that counts is the checksum: compare your download's SHA-256 with the one on the download page. The safety article shows how, and lists the one permission Flick requires, Accessibility, and everything it sends.

Is Flick safe? What to check before you install it