>

Delete a single extended attribute with xattr -d

Instead of the better-known xattr -c (clear everything), the -d flag surgically removes one named attribute such as com.apple.metadata:kMDItemWhereFroms, the record of where a downloaded file came from.

macOSmetadatacom.apple.metadataxattrMedium risk
Run `xattr -l file.pdf` to list attributes, then `xattr -d com.apple.metadata:kMDItemWhereFroms file.pdf` to delete just that one.

01Command

Command
$ xattr -l file.pdf
xattr -d com.apple.metadata:kMDItemWhereFroms file.pdf

02What it does

The com.apple.metadata:kMDItemWhereFroms attribute stores the download URL of files fetched via browsers and Mail, and Spotlight indexes it. Deleting a single attribute preserves others that apps may legitimately need — for example, quarantine would be wiped by -c, but here only the chosen key is removed. Note that quarantine (com.apple.quarantine) is a separate attribute; removing the WhereFroms key alone does not bypass Gatekeeper.

03Risk

RiskMedium risk
!Warning: Some attributes are meaningful to the system; deleting the wrong one (for example on application bundles) can change behavior, so list first with -l and target exactly.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

Last verified: 2026-09-17 · Category: Files & Folders

06Related solutions

Remove the Quarantine Attribute with xattr
macOSquarantineGatekeeperxattr

List and clear extended attributes — the quarantine flag, Finder tags, and download provenance — on any file.

Medium risk ✓ 2026-09-17
Query Spotlight's Raw Syntax with mdfind
macOSmetadatasearchmdfind

Use kMDItem attributes to search file metadata the Spotlight UI can't express, faster than find ever will.

Low risk ✓ 2026-09-17
Read a File's Spotlight Metadata with mdls
macOSmetadatamdlsphotos

Dump every indexed attribute of any file: EXIF, dimensions, duration, authors, content types.

Low risk ✓ 2026-09-17