Gatekeeper is the macOS security feature that verifies downloaded software before it runs, checking that an app is signed with a valid Apple-issued developer certificate and, for software from outside the Mac App Store, that it has been notarized by Apple. Among the protections built into macOS, it is the gate at the moment of first launch: it does not scan running processes, but it decides whether newly arrived code may open at all.
Gatekeeper was introduced in OS X Mountain Lion in 2012 and has tightened with almost every major release. It works together with code signing, notarization, XProtect and System Integrity Protection to form the layered defense that protects a Mac from untrusted software.
How Gatekeeper decides whether an app may open
The process starts when software arrives through a browser, email client, messaging app or other download tool. These apps attach a quarantine extended attribute, com.apple.quarantine, to the file. Gatekeeper performs its full evaluation only on quarantined files, which is why software built locally or copied by some tools is not checked in the same way.
At first launch, Gatekeeper verifies the code signature to confirm the app comes from an identified developer and has not been modified since signing. It then checks for a notarization ticket, either stapled to the app or fetched online from Apple, and confirms that the developer certificate has not been revoked. If all checks pass, the user sees a confirmation dialog naming the source of the download.
Quarantined apps opened from an unusual location may also be run from a randomized read-only path, a mechanism known as app translocation. This prevents a signed app from loading unsigned plug-ins or libraries placed next to it in a downloaded folder.
Gatekeeper verdicts and what they mean
The result of the evaluation determines what the user sees and can do. The table below summarizes the main outcomes on current macOS versions.
| App status | Gatekeeper response | User option |
|---|---|---|
| Mac App Store app | Opens without extra warning | None needed |
| Signed and notarized | Confirmation that it was downloaded | Click Open to continue |
| Signed, not notarized | Blocked with a warning | Approve in Privacy and Security settings |
| Unsigned | Blocked as unverified developer | Approve in settings, with clear risk |
| Revoked certificate or known malware | Blocked, offered to move to Trash | No approval path |
| Signature broken after download | Reported as damaged | Download again from the source |
Since macOS Sequoia, the old shortcut of Control-clicking an app and choosing Open no longer bypasses the warning. Users must open System Settings, Privacy and Security, and choose Open Anyway, which makes accidental approval of untrusted software less likely.
Gatekeeper compared with related macOS protections
Gatekeeper is one layer among several, and each layer covers a different stage of an app’s life. The comparison below places it among its neighbors in macOS security and privacy.
| Protection | When it acts | What it checks |
|---|---|---|
| Gatekeeper | First launch of downloaded software | Signature, notarization and revocation |
| App notarization | Before distribution, by the developer | Automated scan for malicious content |
| XProtect | At launch and in background scans | Known malware signatures |
| SIP | Continuously | Modification of protected system files |
| TCC | When an app requests sensitive access | Camera, microphone, files and more |
| Hardened Runtime | While the app runs | Code injection and unsafe memory use |
A common misconception is that notarization means Apple reviewed the app. Notarization is an automated malware scan with signature checks, not the human review used for the Mac App Store, so a notarized app can still be poorly built or collect more data than users expect.
Managing Gatekeeper on single devices and fleets
On an individual Mac, the setting Allow applications from in Privacy and Security offers two choices: the App Store only, or the App Store and identified developers. The second option is the default and the recommended balance for most users.
Administrators manage Gatekeeper through mobile device management (MDM) profiles and can inspect its decisions with the spctl command-line tool. The table below lists common management decisions.
| Situation | Recommended approach | Reason |
|---|---|---|
| Standard employee Macs | App Store and identified developers | Blocks unsigned software with little friction |
| High-security devices | App Store only, plus approved deployments | Minimizes unknown code |
| Internal tools | Sign with Developer ID and notarize | Passes Gatekeeper without user approval |
| Software deployed by MDM | Install through the management service | Managed installs avoid quarantine prompts |
| Developer workstations | Keep Gatekeeper enabled | Local builds are not quarantined anyway |
Disabling Gatekeeper globally is strongly discouraged. On recent macOS versions, the command that once turned it off now requires confirmation in System Settings, reflecting Apple’s position that a global bypass creates more risk than it solves.
Limitations and common mistakes
Gatekeeper does not inspect files without the quarantine attribute in the same depth, so software delivered through tools that do not set it may skip the first-launch check. It also cannot judge intent: a properly signed and notarized app from a malicious developer passes until Apple revokes its certificate.
- Removing the quarantine attribute manually with
xattrto silence a warning disables the check entirely for that app. - Approving every warning by habit trains users to defeat the protection that Gatekeeper provides.
- Treating Gatekeeper as antivirus ignores that malware detection is the job of XProtect.
- Distributing internal apps unsigned forces users through warnings that teach unsafe behavior.
The short version
Gatekeeper is like a doorman checking identification before letting a new app into the Mac. When something is downloaded from the internet, the Mac first checks who made it and whether Apple has scanned it for known dangers.
Apps that pass get a short confirmation question; apps that fail are stopped and the user must deliberately decide to let them in. The key lesson is simple: a Gatekeeper warning deserves attention, not a reflexive click to make it go away.
Where it makes a difference
A freelance video editor searches the web for a free video converter and downloads an installer from an unofficial mirror site. The file looks legitimate, but when the editor opens it, Gatekeeper reports that the app is from an unidentified developer and cannot be verified.
Instead of approving it in Privacy and Security settings, the editor checks the publisher’s official website and downloads the genuine version, which is signed and notarized and opens after a single confirmation. Later analysis of the first installer by a security vendor shows that it bundled an adware component designed to change browser settings.
In this case, the warning took only seconds to read but prevented an infection that could have exposed client footage and cost hours of cleanup.