Permissions · App Signatures

Check if your Mac apps are signed and notarized

Q: How do I check if an app is notarized on Mac?

Run spctl --assess --type execute -vv followed by the app's path in Terminal and look for source=Notarized Developer ID. App Signatures runs the same check for every Developer ID app on your Mac and lists the ones that aren't notarized.

Q: What is an ad-hoc signature?

A signature made without a certificate, for example with codesign -s -. It seals the app's contents but says nothing about who made it. Many open-source and home-built apps are signed this way, and so are cracked copies of paid apps that had their original signature stripped.

App Signatures checks the code signature of every app in your Applications folders, finds the ones that are unsigned, signed without a developer identity, not notarized by Apple, or changed since they were signed, and explains what each finding means. It is the same check as codesign and Gatekeeper, for every app at once.

Try it free for 7 days See pricing

macOS 26 Tahoe or later · No credit card · Everything runs on your Mac

What a code signature tells you

A Mac app's code signature does two jobs. It says who made the app, through a certificate that Apple issued to the developer, and it seals the app's contents, so any file changed after signing breaks the seal. Notarization adds a third: the developer sent that exact build to Apple, which scanned it for malware before it was released.

Gatekeeper uses all of this when you first open an app you downloaded, which it recognises by the quarantine mark a browser adds to downloads. An app copied from a disk, or unpacked by a tool that drops the mark, may never have had that check at all.

How to verify an app's code signature yourself

In Terminal, these commands check a single app:

codesign --verify --verbose=2 /Applications/Example.app checks that the signature is valid and the app is unchanged.
codesign -dvv /Applications/Example.app shows who signed it, including the developer's Team ID.
spctl --assess --type execute -vv /Applications/Example.app asks Gatekeeper whether it would allow the app, and why: a source=Notarized Developer ID line means the app is notarized.

That works for one app. App Signatures does it for all of them.

What App Signatures checks

Click Check Apps and Tidy My Mac reads every app in /Applications and in your own ~/Applications folder, including apps one folder down, such as in Utilities. It validates each signature in full, every architecture and every resource file, because that is what catches an app changed after signing. It takes about a minute.

Apps that are part of macOS, such as Safari, are left out: the sealed system volume already guarantees they are unchanged.

Each app lands in one category. The ones worth your attention are listed:

Finding	What it means
Broken signature	The app changed after its developer signed it, or the signature is malformed. Malware injected into an app looks like this, and so do cracked copies. So, harmlessly, do some apps that write files inside themselves; reinstalling from the developer fixes that case.
Not signed	Nothing says who made it or that it is unchanged.
No developer identity	Signed ad hoc, without a developer certificate, so nothing says who made it. Common for open-source builds, and for cracked copies of paid apps.
Not notarized	Signed with a Developer ID, so the developer is known to Apple, but Apple never checked this build for malware.
Unusual signature	Signed with a certificate Apple doesn't use for distributing apps, such as a development certificate.

Everything else is counted in a summary line: apps from Apple, from the Mac App Store, and from developers whose build Apple notarized. If nothing needs your attention, the card says so.

An app in one of those five categories that also has no quarantine mark is tagged Never checked by Gatekeeper, because it reached your Mac some way Gatekeeper didn't see. For a broken signature, the row also gives macOS's own description of what is wrong.

What to do about a finding

A finding is a reason to look, not proof of malware. If you don't recognise the app, or it came from somewhere other than its developer, Scan with Antivirus runs the antivirus on that app straight from the row, and the magnifying glass shows it in Finder. For an app you trust with a broken signature, download it again from the developer. To remove one, the Uninstaller takes its leftovers with it.

Gatekeeper's own setting is part of the Security Settings score.

Questions about App Signatures

Run spctl --assess --type execute -vv followed by the app's path in Terminal and look for source=Notarized Developer ID. App Signatures runs the same check for every Developer ID app on your Mac and lists the ones that aren't notarized.

Not necessarily. It means the app changed after it was signed. That is how injected malware and cracked copies look, but some legitimate apps change their own files too. If you got the app from its developer and trust it, reinstall it; if not, scan it with the antivirus.

A signature made without a certificate, for example with codesign -s -. It seals the app's contents but says nothing about who made it. Many open-source and home-built apps are signed this way, and so are cracked copies of paid apps that had their original signature stripped.

Apps that are part of macOS live on the sealed system volume, which macOS verifies itself, so they are left out. Apple apps you installed into Applications, such as from the App Store, are checked and counted.

Try every section free for 7 days.

Just your email, no credit card. Then $19.99 for your first year, $59.99 a year after that.

Start your free trial

Check if your Mac apps are signed and notarized

What a code signature tells you

How to verify an app's code signature yourself

What App Signatures checks

What to do about a finding

Questions about App Signatures

More in Permissions

Security Settings

Privacy Access

Privacy Cleanup

Browser Extensions

Wi-Fi Security

Sudo Activity

Try every section free for 7 days.