Tidy My Mac
Applications · Updates
Check for app updates on your Mac, security fixes first
Tidy My Mac checks every app in your Applications folders for a newer version, whether it came from the App Store, Homebrew or the developer's own website, and shows the results in one list. Apps whose installed version lacks a published security fix are listed first, from a signed list of vendors' advisories that we rebuild every six hours.
macOS 26 Tahoe or later · No credit card · Everything runs on your Mac
Why there is no "update all apps" button on a Mac
The App Store's Updates page only knows about apps you got from the App Store. Every other app updates itself in its own way, usually with a Check for Updates… command and a notice you see only when you open it. Apps installed with Homebrew are updated with Homebrew. An app you rarely open can sit on an old version for months.
That matters most for security. Browsers, media players and mail apps regularly ship fixes for security holes, and the fix only protects you once it is installed.
One list, three sources
Press Check for Updates and Tidy My Mac asks each app's own update source for its newest version:
| Source | How it is checked | How you update |
|---|---|---|
| App Store | Apple's public App Store lookup, for apps with an App Store receipt | App Store opens the app's page, where Update installs it |
| Homebrew | Homebrew's catalog on your Mac, for apps installed as casks | Update runs brew upgrade --cask for that app |
| Developer | The update feed the app itself declares, the same one its own updater reads | Open App opens it, and its Check for Updates… installs the update, signed by its developer |
Results are sorted into Security Fixes, Updates Available, Up to Date and Can't Check. Each update shows the installed and the new version, and a Release Notes link when the developer's feed has one. Tidy My Mac doesn't download or install app updates itself: the App Store, Homebrew or the app's own updater does that, as it normally would.
Mac apps with known security vulnerabilities
An update is not always just new features. Tidy My Mac compares your apps with a list of apps that have published security fixes: for each app, the vendor's advisories and the first version of each release branch that fixes them. The list is compiled from vendors' own security advisories, such as Mozilla's for Firefox and Thunderbird, Google's Chrome release notes, VideoLAN's for VLC, and the GitHub security advisories of open-source apps such as Visual Studio Code, KeePassXC, Zed and Joplin, and rebuilt on our server every six hours.
An app on your Mac that lacks a fix goes to the top, under Security Fixes, whatever its update source says. Its row shows the worst severity (low, medium, high or critical), the version that fixes it, whether the hole is known to be exploited in the wild, and a link to the vendor's advisory. Release branches are respected: an extended-support version that already has its branch's fix is not flagged just because a newer major version exists.
The list is signed, and the app checks the signature before using it, and refuses a copy older than the one it already has, so a tampered or replayed list is ignored. It is downloaded at most once a day and kept on your Mac, so the check also works offline. The same list feeds the vulnerable-apps check in Security Settings.
Versions compared the way the app's updater compares them
A version number like 2.1 against 2.1.0, or 1.5 against 1.5b3, is easy to get wrong. Tidy My Mac orders versions the way Sparkle, the updater most Mac apps use, does, so it agrees with what the app itself will offer. From a developer's feed it only counts releases this Mac would actually get: not beta or nightly channels, not builds for another system or for Apple silicon on an Intel Mac, and not versions that need a newer macOS than yours. Feeds are only fetched over HTTPS.
An app that isn't from the App Store or Homebrew and doesn't publish an update feed is listed under Can't Check with the reason, rather than shown as up to date.
What a check sends
Updates is the one section that asks the internet about your apps, so it sends as little as possible. App Store apps: their bundle IDs and your region go to Apple's lookup. Developer apps: each app's own feed is fetched, as its updater would. Homebrew apps: nothing, the answer comes from your Mac. The security list is downloaded from tidymymac.com and compared on your Mac. No account, Mac or user identifier is sent, and the list of your apps is never sent to us. The Privacy Policy has the details.
Checks without opening the section
A Smart Scan includes an update check, and the sidebar shows how many updates are waiting. You can also turn on a weekly App update check in Settings › Scheduled Scans. It runs while Tidy My Mac is open and sends a notification, with security updates called out, when something needs updating.
Questions about Updates
It hands each update to the tool that should install it. App Store apps open in the App Store, apps that update themselves are opened so their own updater can install a build signed by their developer, and Homebrew apps are updated with brew upgrade when you press Update. Tidy My Mac never downloads an app update itself.
Apps whose vendors publish security advisories we can read reliably, including Firefox, Thunderbird, Google Chrome, VLC, Visual Studio Code, KeePassXC, Zed and Joplin. Each listed advisory links to the vendor's own page. Any app, listed or not, still gets the normal update check.
It isn't from the App Store or Homebrew and doesn't declare an update feed, or its source didn't answer. The reason is shown on the row. For those apps, use the app's own Check for Updates command.
No, macOS updates come from System Settings. Whether automatic security updates are turned on is one of the checks in Security Settings.
Try every section free for 7 days.
Just your email, no credit card. Then $19.99 for your first year, $59.99 a year after that.
Start your free trial