Tend
Guide

“Apple could not verify” a Mac app: what to do

“Apple could not verify… is free of malware” means Gatekeeper couldn't confirm the app was checked and notarized by Apple. It doesn't mean macOS found malware. If you trust where the app came from, open it from System Settings › Privacy & Security › Open Anyway, within about an hour of the warning; since macOS 15 Sequoia, Control-click › Open no longer gets around it. If you aren't sure where it came from, click Move to Trash.

By · Updated · 10 min read · For Macs with Apple silicon running macOS 15 or later

What the message means

On macOS 15, 26 and 27 the warning looks like this, with the app's name in place of “Example”:

“Example” Not Opened

Apple could not verify “Example” is free of malware that may harm your Mac or compromise your privacy.

Buttons: Done and Move to Trash.

It comes from Gatekeeper, the part of macOS that checks software you download from outside the App Store the first time you open it. Apple's security guide describes three things Gatekeeper looks for: that the software is signed by an identified developer, that it's notarized, and that it hasn't been changed since it was signed (Apple Platform Security, Gatekeeper and runtime protection).

Notarization is the part this message is about. Developers who distribute apps outside the App Store sign them with a Developer ID certificate, which comes with an Apple Developer Program membership, and send them to Apple, which scans them automatically for known malware and issues a ticket Gatekeeper can check (Apple Developer, Developer ID). Apple has required notarization by default since macOS 10.15 Catalina. When an app has no valid signature or no notarization, macOS has nothing to vouch for it with, so it says it couldn't verify the app rather than saying it's harmful (Apple, Safely open apps on your Mac).

So the warning tells you what Apple didn't check. The app may be a perfectly good open-source tool, an older app from before notarization, or an in-house build. It may also be malware dressed up as something useful. The message can't tell those apart, and that's the decision left to you.

The other warnings, and how they differ

Gatekeeper and XProtect share a family of warnings that look alike but mean different things. These are the English texts in macOS 27.0.1:

MessageWhat it meansWhat to do
“Example” Not Opened · Apple could not verify “Example” is free of malware…Not notarized, or not signed by an identified developerOpen Anyway, if you trust the source (below)
“Example” is damaged and can’t be opened.The app's files no longer match its signature: a broken download or a modified copyDelete it and download it again from the developer (Apple)
“Example” can’t be opened.Apple revoked the developer's certificateLook for a current version from the developer or the App Store (Apple)
Malware Blocked and Moved to TrashXProtect recognized known malwareLeave it in the Trash; don't try to open it
File Not OpenedA script or other file that runs code, with a warning about scammersDon't open it unless you know exactly why you have it

Only the first one has an Open Anyway route that Apple supports for ordinary use. For the second, Apple notes that a few legitimate apps, such as AppleScript applets, change themselves after signing and trigger it too; for anything else, a fresh download is the fix.

Why you see it more since macOS 15

Up to macOS 14 Sonoma, you could Control-click an unverified app in Finder, choose Open, and get a dialog with an Open button. In August 2024 Apple announced that macOS 15 Sequoia would remove that: users now go to System Settings › Privacy & Security to review the app before allowing it (Apple Developer, Updates to runtime protection in macOS Sequoia). On macOS 15, 26 and 27, Control-click › Open no longer offers a way through.

Typical examples are open-source projects whose authors don't pay for a developer account, older apps that were never notarized, plug-in and driver installers from small hardware makers, and builds a colleague or school shares directly.

When not to open it

Apple's own guide is blunt about the risk: overriding these settings is, in its words, “the most common way that a Mac gets infected with malware” (Apple, Open a Mac app from an unknown developer). Click Move to Trash instead if any of these apply:

  • You didn't go looking for it. A website, pop-up or email told you to install a video player, codec, "Flash" or a system update. Apple delivers macOS updates through Software Update, not through websites.
  • It came from a download site or a link in an ad, rather than the developer's own site or the project's official release page.
  • It's a free copy of a paid app. Cracked software has no developer behind it to vouch for what's inside.
  • Someone else is telling you to open it: a caller claiming to be support, a message from a stranger, or a chat that walks you through "Open Anyway". Apple's script warning names this exact tactic.
  • The developer should be notarizing. If the warning appears for a well-known company's app, something is wrong with that copy. Get it from the App Store or the company's own site instead.

Two quick checks help. In Finder, select the downloaded file and choose File › Get Info: the Where from line under More Info often shows the address it was downloaded from. And look at the developer's install notes: projects that aren't notarized usually say so and explain the warning.

How to open an app you trust

These steps are the same on macOS 15 Sequoia, macOS 26 Tahoe and macOS 27 (macOS 15, macOS 26, macOS 27):

  1. Try to open the app once, so macOS records the attempt, and click Done on the warning.
  2. Open System Settings › Privacy & Security from the Apple menu, and scroll down to Security. You'll see “Example” was blocked to protect your Mac.
  3. Click Open Anyway. Apple says the button is available for about an hour after you tried to open the app. If it's gone, open the app again and come straight back.
  4. Confirm. macOS asks for your login password and shows the warning once more, this time with an Open button. Click Open.

macOS saves the app as an exception, and from then on it opens with a double-click like any other app. The exception covers that app; Gatekeeper still checks everything else you download. If the setting is missing or greyed out on a work or school Mac, the organization that manages it has decided, and only its IT team can change that.

Skip the Terminal shortcuts. Some guides suggest sudo spctl --global-disable (or the older --master-disable) or removing the download flag with xattr. The first asks macOS to allow apps from anywhere, for every app from then on; the spctl manual page on macOS 15 and later says changing Gatekeeper's global state from the command line is no longer supported, and the option now only reveals an "Anywhere" choice in settings. The second makes macOS skip its first-open check for that app without telling you anything about it. Open Anyway does the one thing you need, for one app, and leaves the rest of Gatekeeper on.

Check an app's signature yourself

Before you open something, or to see how an app you already have is signed, Terminal can show you what Gatekeeper sees. These commands only read: they need no sudo and change nothing. Type the command and a space, then drag the app from Finder into the Terminal window to paste its path.

What Gatekeeper thinks: spctl

spctl -a -vv /Applications/Example.app

For Visual Studio Code on our MacBook Pro with macOS 27.0.1, it printed:

/Applications/Visual Studio Code.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Microsoft Corporation (UBF8T346G9)

How to read the answers:

  • accepted, source=Notarized Developer ID: signed by the developer on the origin line and notarized. The code in brackets is the developer's Team ID.
  • accepted, source=Mac App Store or Apple System: from the App Store, or part of macOS.
  • rejected, source=Unnotarized Developer ID: signed by an identified developer but not notarized. This is the usual cause of the warning.
  • rejected, source=no usable signature: not signed at all. On a test bundle we left unsigned, that's exactly what it printed.
  • rejected with no source line: signed "ad hoc", without any developer identity, as local and many open-source builds are.

The manual page says spctl exits with 0 when the assessment passes and 3 when it's denied. One quirk: iPhone and iPad apps you installed from the App Store on an Apple silicon Mac show rejected with origin=Apple iPhone OS Application Signing. On our Mac, all six such apps did. They came from the App Store, so that answer isn't a warning sign.

Who signed it: codesign

codesign -dvv /Applications/Example.app

The lines that matter, again for Visual Studio Code:

Authority=Developer ID Application: Microsoft Corporation (UBF8T346G9)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Notarization Ticket=stapled
TeamIdentifier=UBF8T346G9

The Authority chain should end at Apple Root CA, and the name should be the developer you expect. Notarization Ticket=stapled means the ticket travels with the app, so Gatekeeper can check it offline. An unsigned app prints code object is not signed at all; an ad hoc one shows Signature=adhoc and TeamIdentifier=not set.

Has it changed since it was signed?

codesign --verify --deep --strict --verbose=2 /Applications/Example.app

A healthy app ends with valid on disk and satisfies its Designated Requirement. One app on our Mac instead reported a sealed resource is missing or invalid, followed by the two settings files inside it that had changed. That's what the “damaged” warning is reacting to. Here the changes were the app's own configuration files, but the check can't tell a harmless edit from a malicious one, which is why downloading a fresh copy is the reliable fix.

How Tend helps

Tend's free Security check shows whether Gatekeeper is on, and reads the signature of every app in your Applications folder, much as the commands above do. It lists the ones that don't come from a notarized developer or the App Store, grouped as signed but not notarized, ad hoc, unsigned, signature broken or notarization withdrawn by Apple, with a line on what each usually means. Tend only reads these things; it isn't antivirus and doesn't scan files for malware. How the Security check works.

Questions

Does “Apple could not verify” mean the app has a virus?

No. It means Gatekeeper couldn't confirm the app is notarized by Apple, so macOS can't vouch for it. When XProtect recognizes known malware, macOS says so directly, blocks the app and moves it to the Trash. An unverified app may be fine or may not; where it came from is what decides it.

How do I open an app that Apple could not verify?

Try to open it once and click Done. Then open System Settings › Privacy & Security, scroll to Security, click Open Anyway next to the app's name, confirm with your login password and click Open. Apple says the button is there for about an hour after the warning. macOS then remembers your choice for that app.

Why can't I Control-click to open an unverified app anymore?

Apple removed that shortcut in macOS 15 Sequoia. Control-click › Open now shows the same warning, with no Open button. The only supported way to open an app Gatekeeper blocked is Open Anyway in Privacy & Security, on macOS 15, 26 and 27.

Why don't I see Open Anyway in Privacy & Security?

Usually because more than an hour has passed since the warning: open the app again and go straight back. You also won't get Open Anyway for an app macOS identified as malware, and an organization that manages your Mac can remove the option.

Is it safe to open an app Apple couldn't verify?

Only if you trust where it came from: the developer's own website or the project's official release page, for software you went looking for. Don't open it if it came from a download site, an ad, a pop-up saying you need a player or update, a cracked copy of a paid app, or someone you don't know.

What is XProtect on Mac, and do you still need antivirus?

The malware checks behind these warnings

What are syspolicyd and trustd on Mac?

The processes that run Gatekeeper's checks

How to check a Mac for malware and remove it

If you opened something you now regret

How to update apps on Mac, including non-App Store apps

Current versions are more likely to be notarized

Sources

Spotted something out of date? Tell us and we'll fix it.

See which of your apps aren't notarized

Tend is free to download. Pro is $1.99 a month, $12.99 a year with a 7-day free trial, or $29.99 once.

Download TendSee pricing