“Apple could not verify” an app? How to open it safely on a Mac

When macOS displays an alert stating “Apple could not verify that this app is free of malware,” it means the developer has not submitted the application to Apple’s automated notarization service, not that the app contains a virus. You can safely open trusted applications by clicking Done, opening System Settings › Privacy & Security, scrolling down to Security, and clicking Open Anyway.

Encountering a security warning when opening downloaded software can be alarming. On recent macOS releases, including macOS 15 Sequoia and macOS 26 Tahoe, Apple tightened security rules, making it harder to run open-source tools and community utilities outside the Mac App Store. Long-standing shortcuts like Control-clicking an app no longer work. This guide explains what Gatekeeper verification actually measures, how to decide whether an unverified app is safe, and how to authorize trusted software step by step.

What does “Apple could not verify that this app is free of malware” actually mean?

To understand this dialog, it helps to examine how macOS verifies third-party software. When you download an application from the web using Safari, Chrome, or another browser, macOS attaches a hidden metadata tag called com.apple.quarantine to the file.

When you double-click the quarantined application, Apple’s Gatekeeper subsystem performs three distinct security checks:

1. Code signature integrity: It checks whether the application is signed with a valid digital certificate issued by Apple.
2. Apple notarization ticket: It contacts Apple servers (or checks an embedded cryptographic ticket) to verify whether the developer uploaded the compiled binary to Apple’s automated notary service before distribution.
3. Malware signature detection (XProtect): It scans the app against Apple’s local database of known malicious signatures.

When Gatekeeper displays the alert “Apple could not verify that this app is free of malware”, your Mac has passed check 3 (no known malware was found), but failed check 2 (the developer has no notarization ticket on file with Apple).

Notarization is not a human code review. It is an automated cloud scanner that Apple introduced in macOS 10.14 Mojave. To notarize an app, a developer must enroll in the official Apple Developer Program, which costs $99 USD every year, sign the app with an Apple-issued Developer ID certificate, and upload every compiled build to Apple’s servers using command-line developer tools (xcrun notarytool).

Many independent software developers, open-source maintainers, academic researchers, and hobbyists do not pay Apple’s recurring $99 annual fee. Because they do not have a paid developer account, they cannot notarize their software. Gatekeeper flags their applications with the unverified warning by default, regardless of how clean and secure the underlying code is.

Why did Control-click stop working on macOS Sequoia and Tahoe?

For more than a decade, experienced Mac users bypassed Gatekeeper warnings using a simple shortcut: holding the Control key, clicking the app icon, and selecting Open from the contextual menu. This opened a secondary dialog with an “Open” button that bypassed the block immediately.

Starting in macOS 15 Sequoia and continued in macOS 26 Tahoe, Apple permanently removed the Control-click override.

The shortcut had become a favorite of malware campaigns, whose fake installers told people to “Control-click and choose Open.” By moving the override into System Settings, Apple made it a deliberate step: you open the security settings, click Open Anyway and confirm with Touch ID or your password.

How to open an unverified app using System Settings

If you have verified that an unnotarized application comes from a trustworthy source, authorizing it to run takes less than a minute. The process involves three distinct steps:

Animation

Opening MacLC the first time: three steps

“MacLC” Not Opened

Apple could not verify “MacLC” is free of malware that may harm your Mac or compromise your privacy.

DoneMove to Trash

GeneralAppearanceDisplaysPrivacy & SecurityDesktop & Dock

Privacy & Security

Security

Allow applications fromApp Store & Known Developers

“MacLC” was blocked to protect your Mac.Open Anyway

Open “MacLC”?

macOS asks you to confirm, with Touch ID or your password.

Open AnywayCancel

1. 1The warning
2. 2Privacy & Security
3. 3Open Anyway

Step 1: macOS says it could not verify MacLC. Click Done.

Step 1: Trigger the initial Gatekeeper alert

Double-click the downloaded application in your Applications folder or Finder window. When the warning appears stating that Apple cannot check the app for malicious software, click Done (or Cancel on some macOS versions). Do not click “Move to Trash”.

Step 2: Open Privacy & Security settings

Open the Apple menu in the upper-left corner of your screen and select System Settings. In the left-hand sidebar, click Privacy & Security.

Step 3: Click Open Anyway

Scroll down past the permissions section until you reach the Security header. Under the text that reads “Allow applications downloaded from”, you will see a notice naming the blocked app:

"[Application Name]" was blocked to protect your Mac.

Immediately to the right of this message, click the Open Anyway button.

Step 4: Confirm

macOS asks you to confirm: click Open Anyway, then use Touch ID or enter your Mac password. The app opens, and from then on it opens with a normal double-click, without the warning.

Why is the Open Anyway button missing?

A common source of confusion is opening System Settings only to find no “Open Anyway” button under the Security heading.

Apple designed the Open Anyway override button with a strict time limit: it remains visible for approximately one hour after your last blocked launch attempt. If you downloaded an app yesterday or closed the warning dialog earlier in the afternoon, macOS removes the button from System Settings.

To make the button reappear:

1. Return to Finder and double-click the application icon again.
2. When the warning dialog appears, click Done.
3. Re-open System Settings › Privacy & Security, and the Open Anyway button will be visible again.

How to verify an application is safe before clicking Open Anyway

You should never click “Open Anyway” blindly. Because Gatekeeper is warning you that Apple has not verified the software, you must perform your own basic due diligence. Follow these three rules to evaluate any unverified Mac application:

1. Verify the download source

Never download Mac applications from generic download portals, file-sharing forums, or software aggregation sites. Download exclusively from the software’s official domain name (using HTTPS) or the developer’s official GitHub repository. Malicious software is almost always distributed through third-party rehosting sites that bundle unwanted adware or trojans into legitimate open-source installers.

2. Check for public open-source code

Many legitimate apps that aren’t notarized are open-source software, released under licenses like the GNU GPL, MIT or Apache, with public code on GitHub or GitLab. Public code and a release history don’t guarantee safety, but they make hidden malware much harder, and they let you see who is behind the project.

3. Verify the cryptographic SHA-256 checksum

Responsible software developers publish cryptographic hash values—usually a SHA-256 checksum—alongside their software downloads. A checksum is a unique 64-character mathematical fingerprint of the file. If an attacker tampers with the file or your download becomes corrupted, the checksum changes completely.

To verify a downloaded .dmg or .zip file against the developer’s published checksum:

1. Open Terminal on your Mac.
2. Type shasum -a 256 (include a space at the end).
3. Drag the downloaded file from Finder directly into the Terminal window to insert its path, then press Return.
4. Compare the 64-character string output by Terminal with the SHA-256 hash published on the developer’s official download page. If the strings match character for character, your file is exactly the one the developer published.

The Terminal method: How to remove the quarantine attribute

For software engineers, system administrators, and power users who frequently install developer tools, navigating through System Settings for every binary can be tedious. You can authorize unverified applications directly from the command line by removing the quarantine flag.

When you download a file, macOS assigns the quarantine flag using an extended file attribute named com.apple.quarantine. You can view this attribute in Terminal:

xattr -l /Applications/ExampleApp.app

If the app is quarantined, Terminal will print a line beginning with com.apple.quarantine followed by metadata recording the downloading application and timestamp.

To strip the quarantine attribute recursively from the entire application bundle, run the following command:

xattr -dr com.apple.quarantine /Applications/ExampleApp.app

In this command:

• xattr is the macOS extended attributes utility.
• -d instructs the tool to delete the specified attribute.
• -r applies the deletion recursively to all files, frameworks, and helper binaries inside the application bundle.

Once the quarantine attribute is deleted, Gatekeeper treats the application as if it were created on your Mac, so it opens without the warning. Only do this for apps you have checked as described above.

If an application displays a different error saying it is damaged and can’t be opened, the download is usually incomplete or the app’s signature is broken. Read our companion guide on fixing “App is damaged and can’t be opened” on Mac for the exact solution.

Why you should never disable Gatekeeper globally

Some online tutorials tell you to turn Gatekeeper off entirely with the spctl command in Terminal, so that apps from “Anywhere” can run.

Disabling Gatekeeper globally is a bad idea on a Mac you use every day.

Gatekeeper serves as your Mac’s primary line of defense against real malware, malicious browser downloads, and silent background installers. When you leave Gatekeeper enabled and use the “Open Anyway” button, you grant an isolated exception for a single, specific application that you have evaluated and chosen to trust. Disabling Gatekeeper globally strips that protection from every file on your system, allowing malicious scripts downloaded in the background to execute without warning.

Always leave Gatekeeper active and authorize unverified applications on an individual basis.

Why MacLC is not notarized by Apple

MacLC, the player we make at Hazen Studio, is an independent, open-source video player built for Apple Silicon Macs running macOS 26 Tahoe or later. When you download MacLC from our website, macOS will display the unverified app warning on the first launch.

MacLC isn’t notarized because notarization requires a paid Apple Developer ID, and MacLC is a free project. Donations would pay for Apple’s developer program, so that macOS stops asking you to click Open Anyway.

What you can check yourself:

• Open source: the code is published under the GNU General Public License (GPL-2.0 or later).
• Checksum: we publish the SHA-256 checksum of every release on our download page, so you can verify your download in Terminal before opening it.
• Signed: the app is signed ad hoc; if a file inside it were altered, the signature would break.
• No tracking: MacLC has no telemetry, no ads and no account. What you watch stays on your Mac.

To run MacLC, follow the standard procedure: click Done on the first prompt, open System Settings › Privacy & Security, click Open Anyway next to MacLC, confirm with Open Anyway, then Touch ID or your password. After this single approval, MacLC opens like any other app.

Summary checklist for unverified Mac apps

Opening open-source software outside the Mac App Store is safe when you follow a structured procedure:

1. Confirm that you downloaded the software directly from its official project website or official GitHub repository.
2. Verify that the project is open-source and has a clear community presence.
3. Check the file’s SHA-256 fingerprint in Terminal against the developer’s published checksum.
4. Double-click the application once, click Done on the alert, and open System Settings › Privacy & Security.
5. Click Open Anyway under the Security heading within one hour of the launch attempt.
6. Authenticate with Touch ID or your administrator password.

By understanding how Gatekeeper works, you can take advantage of powerful open-source utilities while keeping your Mac completely secure. To explore the best modern players available for macOS, see our comprehensive guide to the best video players for Mac and our review of VLC for Mac.