Open apps from outside the App Store on Mac (safely)

You downloaded an app from a developer’s website, double-clicked it, and macOS refused: Apple could not verify it’s free of malware. Older versions of macOS called this an app from an “unidentified developer”. Either way, that’s Gatekeeper doing its job, and you can still open the app in under a minute. The minute before that is the one that matters, though, because the same steps that open a small indie app also open malware.

Why macOS blocks some apps

Gatekeeper is the part of macOS that checks software you get from outside the App Store before it runs for the first time. Apple’s security guide says it looks for two things:

• A Developer ID signature. The developer registered with Apple and signed the app, so macOS knows who made it and can tell if the app was changed afterwards.
• Notarization. The developer sent the app to Apple, which scanned it for known malicious content and found none.

Which apps may open at all is set under Allow applications from at the bottom of System Settings → Privacy & Security. On macOS Tahoe the choices are App Store and App Store & Known Developers. With the second, a signed and notarized app opens after a short “downloaded from the internet” question. Anything macOS can’t vouch for gets blocked, and it’s then up to you.

Notarized vs not notarized

The wording of the warning tells you which case you’re in. Apple notes the exact text varies, but the meaning is consistent:

You can also ask macOS directly. In Terminal, run spctl -a -vv followed by the app’s path. Notarized Developer ID means the app passed both checks, and the line after it names the developer.

Open Anyway in Privacy & Security

When you’ve decided the app is trustworthy, this is the supported way to open it:

1. Double-click the app once. When the warning appears, click Done, not Move to Trash.
2. Choose Apple menu → System Settings, then click Privacy & Security in the sidebar.
3. Scroll down to Security. You’ll see a note that the app was blocked, with an Open Anyway button next to it.
4. Click Open Anyway, confirm in the dialog that follows, then enter your login password and click OK.

The app opens and is saved as an exception, so it opens normally from now on. Apple’s guide says the button is only offered for about an hour after the blocked attempt. If it’s gone, double-click the app again and come straight back.

Before you click Open Anyway

Open Anyway turns off the check for one app, permanently. Apple’s own guide warns that overriding these settings is the most common way a Mac gets infected with malware. Take a minute first:

• Where did it come from? The developer’s own website, reached by typing the address or from a source you trust, is a good answer. A download portal, a link in an email or a direct message, a pop-up ad or a “cracked” copy of a paid app is not.
• Is there a real developer behind it? A name, a support address, release notes and a history of updates all count.
• Does the download match? If the developer publishes a SHA-256 checksum, run shasum -a 256 followed by the file’s path in Terminal and compare the two values.
• Is there a notarized alternative? Apple’s own advice is to look for a Mac App Store version or a similar app first.
• Do the installer’s instructions make sense? Be suspicious of any installer that asks you to paste a command into Terminal or drag a file into it. That’s a common way to get around Gatekeeper. On recent versions of macOS Tahoe, Terminal may stop such a paste with a “Possible malware, Paste blocked” alert. Apple’s advice is to paste only if you know what the command does and trust where it came from.

After the app opens, watch what it asks for. A request for Screen Recording, Accessibility or Full Disk Access should match a feature you’re about to use. Our guide to whether Screen Recording permission is safe explains how to judge requests like these.

Never disable Gatekeeper

Old forum answers still suggest sudo spctl --master-disable to bring back an “Anywhere” choice under Allow applications from, or xattr commands that remove the downloaded-from-the-internet flag from an app. Both work in the wrong way. Choosing Anywhere turns off the check for every app you download from then on. The second removes the marker that tells macOS the app came from the internet, so you skip the approval step and the developer and notarization checks that come with it.

Open Anyway is the better trade: you approve one app, and Gatekeeper keeps checking the next one. If you disabled Gatekeeper in the past, go back to Privacy & Security and choose App Store & Known Developers under Allow applications from.

Applying this to any app you download

Unpixel isn’t sold on the Mac App Store, so the same checks apply to it. Get it from the Download page, never from a mirror or a download site. The install guide describes what macOS may show the first time you open it. Once it’s running, Unpixel asks for one permission, Screen Recording, so it can read the text in the area you select with ⇧⌘2.

Quick checklist

• Blocked app? Privacy & Security → Security → Open Anyway, within about an hour.
• Check the source first: the developer’s own site, a real developer, a matching checksum.
• “Damaged” means download again. “Will damage your computer” means trash it.
• Control-click → Open no longer bypasses the check.
• Leave Gatekeeper on: approve apps one at a time.