How do I check whether an app is properly code signed?
Use codesign and spctl to see whether a macOS app's code signature is valid, intact and acceptable to Gatekeeper.
What this covers
When macOS refuses to open an app, the usual cause is code signing: the app is unsigned, was modified after it was signed, or was signed by an identity Gatekeeper does not trust. A few short commands separate those cases and tell you whether the fix belongs at the signature or at the Gatekeeper policy.
Symptom
Inspect the app's signature and signing identity
Start by dumping the signature of the app bundle. This shows at a glance whether the app is signed at all and, if it is, which Developer ID and team signed it. An ad-hoc Authority line or no Authority line at all means the app was never properly signed, so nothing about Gatekeeper is the real problem. Swap the example path for the app you are checking: drag the app from Finder into the Terminal window to paste its full path.
See the signing identity, TeamID, CDHash, and entitlements of any application on your Mac.
$ codesign -dv --verbose=4 /Applications/Safari.appVerify the signature has not been tampered with
The previous dump only lists metadata; this step actually validates the cryptographic signature and every file inside the bundle. If it prints nothing, the signature is intact. Errors that name a specific file, or 'code object is not signed at all', mean the app was modified after signing or was never signed. Use the same bundle path you inspected in the previous step.
Check whether an application bundle was signed properly and hasn't been modified since.
$ codesign --verify --deep --strict --verbose=2 /Applications/SomeApp.appAsk Gatekeeper for its verdict
Gatekeeper's decision is what actually blocks the launch, and it can reject an app for reasons codesign cannot see, such as a missing notarization ticket. Run the assessment with the verbose flag to get the exact reason, for example 'source=no usable signature' or a Developer ID origin. Use the same app path as before.
spctl evaluates any app against macOS's Gatekeeper policy and tells you exactly why it was accepted or rejected.
$ spctl --assess --verbose /Applications/SomeApp.appAdd a targeted Gatekeeper exception for this app
If the app is one you trust but it is unsigned, or signed by an identity Gatekeeper will not accept, add a per-app assessment rule instead of weakening Gatekeeper globally. Replace /Applications/MyTool.app with the bundle you have just inspected, and give the label a name you will recognise later. The app can then launch while every other app is still assessed normally.
spctl --add inserts a per-app assessment rule so one tool can launch even while Gatekeeper stays strict for everything else.
$ sudo spctl --add /Applications/MyTool.app --label "Approved Tools"▾ Undo
$ sudo spctl --remove /Applications/MyTool.appConfirm Gatekeeper is still enforcing policy
Adding a rule should never switch Gatekeeper off, so check the master status one more time. You want to see 'assessments enabled'; if it reports disabled, turn the master switch back on before doing anything else. Then open the app from Finder — it should start without the interruption.
Use spctl --status to see if macOS's download-app verification (Gatekeeper) is turned on.
$ spctl --status▾ Undo
$ sudo spctl --global-enableHow to confirm it worked
codesign --verify finishes with no output, spctl --assess reports 'accepted', and the app opens normally from Finder.
Undo everything
Every command above can be reverted. Run these in order to undo all of it.
$ sudo spctl --global-enable
sudo spctl --remove /Applications/MyTool.appReview before running — some steps may not be independent.
Sources
- codesign — create and manipulate code signatures (macOS)Evidence: Documents -d (display), -v (verbose) and the detail levels that reveal authority chain, CDHash and entitlements.
- spctl — system policy security assessment tool (macOS)Evidence: Documents --assess to evaluate a path against system policy and --verbose to show the reason for the verdict.
- Code Signing GuideEvidence: Apple explains code signature validation and why deep verification checks nested code.
- Protecting against malware (Apple Platform Security)Evidence: Apple's security guide explains Gatekeeper and notarization assessments performed on downloaded apps.
- Protecting users from malware on MacEvidence: Explains Gatekeeper's role in verifying that downloaded apps come from identified developers before they are allowed to run.
Last verified: 2026-09-22
Related guides
Diagnose why macOS says an app is damaged, then fix it with a per-app Gatekeeper rule or by clearing the quarantine flag — without disabling system-wide protection.
Diagnose and fix repeated Wi-Fi dropouts on macOS using built-in terminal tools: check your connection, read signal stats, reset the interface, and verify the link holds.