What is Gatekeeper on Mac? The warnings, and when to open an app anyway
Gatekeeper is the macOS feature that checks apps you get from outside the App Store before they open. Apple says it's designed to help ensure that only trusted software runs on your Mac. It checks who made the app, whether Apple has scanned it for known malware, and whether it's been altered.
Quick answer
Gatekeeper checks software from outside the App Store is from an identified developer, notarised by Apple and unaltered, and asks for your approval the first time it opens. You can override some warnings with Open Anyway in System Settings > Privacy & Security, but only for an app you're certain about.
What does Gatekeeper check?
When you download and open an app, plug-in or installer package from outside the App Store, Apple's Platform Security guide says Gatekeeper verifies that the software is from an identified developer, is notarised by Apple to be free of known malicious content and hasn't been altered. Apple's support article says macOS checks the app's Developer ID signature to confirm both.
It also asks for your approval before downloaded software opens for the first time, so you aren't tricked into running code you believed was a data file.
What is notarisation?
Notarisation is Apple's malware scanning service for developers who distribute Mac apps outside the App Store. The developer submits the app, Apple scans it for known malware, and if none is found, Apple issues a notarisation ticket. Developers usually staple that ticket to the app so Gatekeeper can check it even when you're offline.
By default, macOS Catalina and later require software to be notarised. Apple can also issue a revocation ticket for an app known to be malicious, even one it notarised earlier. macOS checks for revocation tickets in the background, and Apple says it does so much more often than the updates that bring new XProtect signatures.
What do the Gatekeeper warnings mean?
Apple lists these alerts, and says you could see similar ones it doesn't list.
- Downloaded from the internet. The first time you open an app from an identified developer from outside the App Store, your Mac asks if you're sure.
- Apple cannot check it for malicious software. Apple suggests contacting the developer, checking the App Store for an updated version or looking for an alternative app.
- The developer cannot be verified. In macOS Catalina and later, this means the app hasn't been notarised, so macOS can't verify it's free of malware.
- Not downloaded from the App Store. Your settings allow apps only from the App Store, so macOS won't open it.
- Will damage your computer. macOS found malicious content, or the app's authorisation has been revoked.
- Can't be opened because it's damaged. The app has been modified or damaged. Apple says it may be broken or corrupted, or may have been tampered with.
If macOS detects known malware, it tells you the app can't be opened and moves it to the Bin. That part is XProtect's work, covered in what XProtect is and does.
How do I open an app anyway on a Mac?
For warnings 2, 3 and 4, Apple says that if you're certain the app is from a trustworthy source and hasn't been tampered with, you may be able to override your security settings. Apple gives these steps:
- Try to open the app first.
- Choose Apple menu > System Settings, then click Privacy & Security in the sidebar. You may need to scroll down.
- Scroll down to Security and click Open Anyway. Apple says this button is available for about an hour after you try to open the app.
- Enter your login password, then click OK. The warning appears again; click Open only if you're absolutely sure.
The app is then saved as an exception to your security settings, and it opens with a double-click from then on.
When shouldn't I open an app anyway?
Apple's Mac User Guide says overriding security settings to open an app is the most common way that a Mac gets infected with malware, and that you shouldn't do it for an app Apple hasn't checked, even if it looks like it comes from a major developer.
Apple's override steps are written for apps that haven't been notarised or come from an unidentified developer. They don't cover the "will damage your computer" or "damaged" alerts, or an app macOS has moved to the Bin as malware, and this guide doesn't suggest a way round them.
Where do I change Gatekeeper settings?
Choose Apple menu > System Settings, click Privacy & Security, then scroll down to Security. Apple's support article calls the setting "Allow apps downloaded from"; the Mac User Guide calls it "Allow applications from". You get two options:
- App Store. Apple says this is the most secure setting to protect your system from malware.
- App Store and identified developers (the Mac User Guide says "Known Developers"). This also allows apps from developers registered with Apple.
These settings may not be available if your Mac is managed by an IT department.
How does Gatekeeper relate to XProtect?
They work in sequence. Apple describes Mac malware defences in three layers. The first, stopping malware from launching at all, is the App Store, or Gatekeeper combined with notarisation. The second, blocking malware from running, uses Gatekeeper, notarisation and XProtect together. The third, removing malware that has already run, is XProtect alone.
XProtect is the built-in antivirus. Apple notes notarisation works on known files, while XProtect's rules are more generic and can find variants Apple hasn't seen.
Where Failshot fits
Your password is the first layer. Failshot is the second: second layer device security for your Mac. While it's on, it photographs whoever unlocks your Mac, then, with Pro, records a 5-second video.
Gatekeeper looks after the apps you open. Failshot is for the moment someone sits down at your Mac and unlocks it.
With the Mac's built-in camera, the green light comes on, and Failshot's window tells whoever unlocked the Mac that the unlock was photographed. With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on. Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.
iPhone, Android and Windows versions are coming soon. Failshot is a free download for Mac (macOS 14 or later) from failshot.app, and turning it on needs a paid Pro plan. Try Failshot Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel.
More questions
Is Gatekeeper on by default?
Apple says that by default, Gatekeeper helps ensure all downloaded software has been signed by the App Store or by a registered developer and notarised by Apple. So by default, all software is checked for known malicious content the first time it's opened, however it arrived on the Mac.
Does Gatekeeper send Apple my identity?
Apple says Gatekeeper and notarisation checks have never included your Apple Account or the identity of your device. It says it doesn't log IP addresses associated with Developer ID certificate checks, and removes any collected IP addresses from logs.
Why has the Open Anyway button disappeared?
Apple's Mac User Guide says the Open Anyway button is available for about an hour after you try to open the app. If it's gone, try opening the app again, then go back to Privacy & Security.
Do I need to do Open Anyway every time?
No. Apple says that once you've used Open Anyway, the app is saved as an exception to your security settings, and you can open it in future by double-clicking it, like any other authorised app.
Is Gatekeeper the same as antivirus?
Not quite. XProtect is what Apple calls the built-in antivirus. There's more in does a Mac need antivirus and how to check your Mac for malware.