Mac Security · Gatekeeper & App Safety · Lesson 1 of 5

Gatekeeper and Notarization

How your Mac checks a downloaded app before it opens.

Two downloads, two answers

You met Gatekeeper earlier. It is the part of macOS that checks an app you downloaded before it opens for the first time. Let's see what it actually checks.

An identified developer is a person or company that has signed up with Apple and has a special digital signature. A digital signature is like a tamper seal on a jar. It shows who made the app and that nobody changed it since.

Notarization is a free check that Apple runs on apps sold outside the App Store. The developer sends the app to Apple. Apple's computers scan it for known malware, which means harmful software. If nothing bad is found, Apple gives the app a pass, like a stamp.

When you open a signed, notarized app for the first time, your Mac shows a gentle question. It says the app was downloaded from the internet and asks if you are sure you want to open it. This is normal. If you meant to download it, click Open.

An app without that stamp gets a stronger warning. It says Apple cannot check the app for malicious software. The exact words change a little between versions of macOS. The buttons are usually Done and Move to Trash. Notice there is no Open button.

That second warning does not prove the app is harmful. It means Apple could not vouch for it. For an app you found through an ad, a pop-up or a stranger's link, that is reason enough to say no.

One more thing. Apple can also cancel a stamp later if an app turns out to be harmful. Your Mac checks for this in the background.

On the practice computer, open PhotoTidy.dmg from the maker's site, then try VideoPlus Free.dmg from the ad. Find Open Anyway in Privacy & Security, but don't click it. Move VideoPlus Free to the Trash.

Open Anyway, used rarely

Your Mac has a setting for where apps may come from. Open System Settings, then Privacy & Security, and scroll to the Security section. Under Allow apps downloaded from you will see two choices:

• App Store: only apps from Apple's store can open.
• App Store and identified developers: apps from the store, plus apps from signed developers.

The second choice is the usual setting. The exact wording may differ slightly on your version of macOS. On a work Mac, your IT team may lock this setting.

Right below that, after you try to open a blocked app, a button can appear. It is called Open Anyway. Clicking it, then confirming, lets that one app skip Gatekeeper. Your Mac may ask for your password. After that, the app opens normally each time.

Open Anyway exists for real cases. A small, honest developer may not have notarized an older tool. A teacher might share a class program. Apple says to use it only when you are sure the app comes from a source you trust and has not been changed.

That is why you should use it rarely. Ask yourself three questions first:

1. Did I go looking for this app on purpose?
2. Did it come straight from the maker's own website?
3. Is there a version in the App Store, or a notarized version, I could get instead?

If any answer worries you, don't click Open Anyway. Scammers often write instructions that walk you through this exact button. They may say "macOS is just being picky" or "this is normal for free apps." A website that tells you how to get around your Mac's safety check is a warning sign by itself.

When in doubt, move the app to the Trash. You can always get a safer version later.