Inspect and Remove Quarantine Attributes with xattr

See the hidden metadata Gatekeeper attaches to downloads, and understand what it means before removing it.

macOSquarantineGatekeeperxattrMedium risk

Run `xattr -l ~/Downloads/SomeApp.app` to list extended attributes; the com.apple.quarantine entry marks it as a downloaded file.

01Command

Command

$ xattr -l ~/Downloads/SomeApp.app

02What it does

Files downloaded by browsers, Mail, and AirDrop carry the com.apple.quarantine extended attribute, which is what makes Gatekeeper assess them at first launch and can surface 'app is damaged' warnings for unsigned software. xattr -l lists all attributes on a path; -dr com.apple.quarantine removes it recursively across a bundle. The record also embeds the timestamp and the app that downloaded it.

03Risk

RiskMedium risk

RequirementsBuilt-in on macOS; bundles may need the recursive form `xattr -dr`.

!Warning: Only delete quarantine from software you trust and have verified another way — doing so skips Gatekeeper's launch check for that file.

04Undo

Undo

$ xattr -d com.apple.quarantine ~/Downloads/SomeApp.app

05Sources

xattr — display and manipulate extended attributes (macOS)
SS64 · technical · 2026-09-17
Evidence: Documents -l to list all extended attributes, -d to delete one, and -r for recursive operation on bundles.

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Remove the Quarantine Attribute with xattr

macOSquarantineGatekeeperxattr

List and clear extended attributes — the quarantine flag, Finder tags, and download provenance — on any file.

Medium risk ✓ 2026-09-17

Verify an App's Code Signature with codesign

macOSGatekeepersignaturecodesign

Check whether an application bundle was signed properly and hasn't been modified since.

Low risk ✓ 2026-09-17