Skip to main content
macOSbeginner

"developer cannot be verified" - Fix Blocked Mac Apps

Fix "cannot be opened because the developer cannot be verified" on macOS. Use the per-app Open Anyway approval instead of disabling Gatekeeper, and know the security tradeoff.

7 min readUpdated August 2026

Downloaded an app on your Mac and hit "cannot be opened because the developer cannot be verified"? Here is what macOS is telling you, and how to open the app without switching off protection for everything else.

The Error

"AppName" cannot be opened because the developer cannot be verified.

macOS cannot verify that this app is free from malware.

The dialog offers Move to Trash and Cancel. There is no "Open anyway" button in the dialog itself, which is what sends most people looking for a fix.

Why This Happens

macOS runs Gatekeeper, which checks software before first launch. Two things are being assessed:

  1. Code signature - was the app signed with a certificate issued to a registered Apple developer, and is it unmodified since?
  2. Notarization - was the app submitted to Apple's automated malware scan and issued a ticket?

This particular message means notarization could not be confirmed. Common reasons, in rough order of likelihood:

  • The developer is small, or the project is open source, and never enrolled in notarization
  • The app is signed ad-hoc or self-signed
  • The download was built from source or repackaged by a third party
  • The app is genuinely malicious

That last possibility is why the warning exists, and it is the reason the honest first step is not a command but a question: do I know where this came from? An open-source utility from its own GitHub releases page is a different proposition to an installer that arrived by email.

Gatekeeper triggers on the com.apple.quarantine extended attribute, which macOS attaches to files delivered by browsers, mail clients, and messaging apps. Files you compiled locally or copied from a USB drive typically carry no such attribute and open without any prompt.

Fix 1: Approve the App in System Settings

This is the supported route and the narrowest one - it creates an exception for a single application.

  1. Double-click the app and let the warning appear. Click Cancel (not Move to Trash).
  2. Open System Settings > Privacy & Security.
  3. Scroll down to the Security section. You will see a line such as "AppName" was blocked to protect your Mac.
  4. Click Open Anyway.
  5. Authenticate with Touch ID or your password.
  6. Open the app again and confirm at the final prompt.

The message only appears for roughly an hour after the blocked launch attempt. If it is not there, open the app again and go straight back to Settings.

On macOS Sonoma and earlier you can also Control-click (or right-click) the app, choose Open, and then Open in the dialog. Apple removed this bypass in macOS Sequoia (15), so on current systems the Settings route above is the one that works.

Fix 2: Verify Before You Approve

If you are not certain of the source, inspect the app before opening it. This takes under a minute.

Check what signature it carries:

codesign -dv --verbose=4 /Applications/AppName.app

Read the Authority= lines. A legitimately signed app names a real certificate, for example Authority=Developer ID Application: Example Ltd (AB12CD34EF). Signature=adhoc or an error means it carries no meaningful identity at all.

Ask Gatekeeper directly why it objected:

spctl -a -vvv /Applications/AppName.app

Typical output for this situation:

/Applications/AppName.app: rejected
source=Unnotarized Developer ID

Unnotarized Developer ID means a known developer signed it but never submitted it for notarization - the mildest version of this problem. rejected (the code is invalid) is a different matter and worth taking seriously.

See where the file came from:

xattr -l /Applications/AppName.app

The com.apple.quarantine value records the app that downloaded it and the source URL.

Advertisement

Fix 3: Remove the Quarantine Attribute (One App)

If you have verified the source and the Settings route is unavailable - for example when scripting a deployment - you can clear the attribute for that single app:

xattr -d com.apple.quarantine /Applications/AppName.app

For a bundle that still complains, clear it recursively:

xattr -dr com.apple.quarantine /Applications/AppName.app

The tradeoff: this does not answer the question Gatekeeper asked, it just stops it being asked. You are substituting your own judgement about the source for Apple's automated scan. That is a legitimate choice for software you trust and a poor one for software you have not checked. Scope it to one path - never run it against /Applications as a whole.

What Not to Do

# Don't do this
sudo spctl --master-disable

This disables Gatekeeper assessment machine-wide and permanently, for every app you have downloaded and every app you download in future, restoring the "Anywhere" option that Apple removed by default years ago. It converts a single-app decision into a standing exposure for the whole system, including for other people who use the Mac.

Apple has tightened this across recent releases and it may have no effect on a current system. If you have run it previously, re-enable protection:

sudo spctl --master-enable
spctl --status

assessments enabled is the state you want.

Verify the Fix

After approving the app:

# Gatekeeper's current assessment
spctl -a -vvv /Applications/AppName.app

# System-wide protection still on
spctl --status

spctl --status should report assessments enabled. That is the important line - it confirms you solved the problem for one app rather than for all of them. The app itself should now launch normally on every subsequent open, with no further prompts.

Prevention

  • Download from the developer's own site or the Mac App Store. Aggregator sites frequently re-wrap installers, which breaks signatures and is a genuine malware vector.
  • Where a project publishes checksums, verify them: shasum -a 256 ~/Downloads/AppName.dmg and compare against the published value.
  • For internally built or line-of-business Mac apps, notarize them properly rather than teaching staff to click past warnings. A workforce trained to dismiss this dialog will dismiss the one that matters.
  • On managed fleets, distribute approved apps through MDM so they install without triggering the prompt at all, rather than lowering Gatekeeper.
  • Keep spctl --status reporting assessments enabled and treat any machine where it does not as needing attention.

Summary

  1. Approve one app: System Settings > Privacy & Security > Open Anyway
  2. macOS Sonoma and earlier: Control-click the app > Open (removed in Sequoia)
  3. Check first: codesign -dv --verbose=4 and spctl -a -vvv
  4. Scripted case only: xattr -d com.apple.quarantine /Applications/AppName.app
  5. Never: sudo spctl --master-disable

Frequently Asked Questions

Find answers to common questions

macOS could not confirm the app was notarized by Apple. Notarization is an automated scan Apple performs on software submitted by registered developers. The message means the check could not be completed - the app may be unsigned, signed with an unrecognized certificate, or simply never submitted. It is not a statement that the app is malware.

It depends entirely on where the app came from. Software downloaded directly from a known open-source project or a vendor you already trust is usually just unnotarized. An app that arrived by email, from a download aggregator, or from a link in a forum post deserves real suspicion - this warning is exactly the moment to stop and check.

Try to open it once and let it be blocked, then go to System Settings > Privacy & Security, scroll to the Security section, and click "Open Anyway" next to the app's name. This creates an exception for that one app and leaves protection in place for everything else.

Apple removed that bypass in macOS Sequoia. On macOS 15 and later you must go through System Settings > Privacy & Security to approve a blocked app. On Sonoma and earlier, Control-click then Open still works.

The button only appears after macOS has actually blocked a launch attempt, and it disappears after about an hour. Try opening the app again, then return to System Settings > Privacy & Security immediately.

No. That turns off Gatekeeper for every application on the machine, permanently, including anything you download later. Apple has progressively restricted the command across recent releases so it may not even work, but the reason to avoid it is that it solves a one-app problem by removing protection from all of them.

The "damaged" message usually means the code signature failed validation or the download was incomplete or altered, rather than merely unnotarized. Re-download from the original source first. If it persists on a file you trust, the quarantine attribute is often involved.

It removes the flag macOS attaches to files downloaded from the internet, which is what triggers the check. Applied to a single app you have already vetted it is reasonably narrow, but it silences the warning rather than answering it, so verify the source before using it.

Run 'codesign -dv --verbose=4 /Applications/AppName.app' and read the Authority lines. They name the signing certificate. 'spctl -a -vvv /Applications/AppName.app' reports whether Gatekeeper accepts it and why not.

No. The Open Anyway approval is recorded per application. Every other app on the machine is still assessed normally, which is precisely why the per-app route is preferable to any global switch.

Related Articles

How to Capture and Analyze Network Traffic on macOS With tcpdump and Wireshark

Learn how to capture and analyze network traffic on macOS using the built-in tcpdump command, the pktap pseudo-interface, and Wireshark for deep packet inspection.

Read More →

How to Use the macOS Firewall (pf) to Restrict Network Access

Learn how to configure both the macOS Application Firewall and the low-level pf packet filter to restrict inbound and outbound network access on macOS.

Read More →

How to Create and Deploy a Configuration Profile (.mobileconfig) on macOS

Learn how to create, sign, and deploy macOS configuration profiles (.mobileconfig) using Apple Configurator 2, iMazing Profile Editor, or hand-written XML.

Read More →
Back to macOS