>

Fix “app is damaged and cannot be opened” on macOS

Diagnose why macOS says an app is damaged, then fix it with a per-app Gatekeeper rule or by clearing the quarantine flag — without disabling system-wide protection.

macOSquarantineGatekeepersignaturexattrcodesignsecurityMedium risk
First verify the app's code signature to find out whether the bundle is truly broken or just blocked by quarantine.

What this covers

When macOS refuses to open a downloaded app with "is damaged and can't be opened", the app is usually fine — Gatekeeper is rejecting its quarantine metadata or signature. This guide walks you from diagnosis to a targeted fix.

Symptom

?Double-clicking a downloaded .app shows an alert like "SomeApp is damaged and can't be opened. You should move it to the Trash." The app never launches.

Check whether the app's signature is actually broken

The 'damaged' message usually means the code signature doesn't check out. Verify the bundle's signature first: a clean result points to quarantine metadata as the culprit, while a 'code object is not signed at all' or 'resource modified' result tells you the bundle itself is broken. You'll see verbose output ending in 'valid on disk' when the signature is fine.

macOSVerify an App's Code Signature with codesignLow riskStep 1

Check whether an application bundle was signed properly and hasn't been modified since.

Command
$ codesign --verify --deep --strict --verbose=2 /Applications/SomeApp.app
Full explanation & undo →

Look for the quarantine flag

If the signature is valid, macOS is most likely refusing the app because of the com.apple.quarantine extended attribute that gets stamped onto anything downloaded from the internet. List the app's extended attributes to confirm the flag is present. Seeing com.apple.quarantine in the output confirms this is a Gatekeeper issue, not real damage.

macOSInspect and Remove Quarantine Attributes with xattrMedium riskStep 2

See the hidden metadata Gatekeeper attaches to downloads, and understand what it means before removing it.

Command
$ xattr -l ~/Downloads/SomeApp.app
▾ Undo
Undo
$ xattr -d com.apple.quarantine ~/Downloads/SomeApp.app
Full explanation & undo →

See how strict Gatekeeper currently is

Knowing whether Gatekeeper assessments are enabled helps you choose the right fix: if it's strict, a per-app approval rule will work; if someone already disabled it, the problem is likely elsewhere. Run the status check and note whether it reports 'assessments enabled' or 'disabled' before moving on.

macOSCheck Gatekeeper State with spctl --statusMedium riskStep 3Optional

See whether Gatekeeper assessments are enabled, and control the master policy switch from the Terminal.

Command
$ spctl --status
▾ Undo
Undo
$ sudo spctl --master-enable
Full explanation & undo →

Approve just this app through Gatekeeper

Rather than loosening Gatekeeper globally, insert a per-app assessment rule so this one tool can launch while every other download stays blocked. This is the preferred fix when the signature is valid but quarantine is blocking launch. After adding the rule, try opening the app again — it should launch without the damaged warning.

macOSAllow a Specific App Through Gatekeeper with spctl --addMedium riskStep 4

spctl --add inserts a per-app assessment rule so one tool can launch even while Gatekeeper stays strict for everything else.

Command
$ sudo spctl --add /Applications/MyTool.app --label "Approved Tools"
▾ Undo
Undo
$ sudo spctl --remove /Applications/MyTool.app
Full explanation & undo →

Clear the quarantine attribute directly

If the per-app rule isn't enough (or the app lives outside /Applications with a path the rule didn't cover), remove the quarantine flag from the bundle recursively. This directly strips the metadata Gatekeeper uses to flag downloaded apps. Success looks like the app opening normally afterward with no security prompt.

macOSRemove the Quarantine Attribute with xattrMedium riskStep 5Optional

List and clear extended attributes — the quarantine flag, Finder tags, and download provenance — on any file.

Command
$ xattr -r -d com.apple.quarantine /Applications/SomeApp.app
Full explanation & undo →

Confirm Gatekeeper is still protecting your Mac

After fixing the app, check that the master Gatekeeper policy was never left disabled by earlier troubleshooting — the whole point of a per-app fix is that global protection stays on. The status should report assessments enabled. Then open the app once more as a final check that it launches cleanly.

macOSCheck Whether Gatekeeper Is EnabledMedium riskStep 6

Use spctl --status to see if macOS's download-app verification (Gatekeeper) is turned on.

Command
$ spctl --status
▾ Undo
Undo
$ sudo spctl --global-enable
Full explanation & undo →
!Never disable Gatekeeper globally just to open one app, and only clear quarantine or add rules for apps from sources you trust — the 'damaged' message can occasionally be macOS correctly refusing a tampered bundle.

How to confirm it worked

The app opens normally with no damaged warning, and Gatekeeper status still shows assessments enabled.

Undo everything

Every command above can be reverted. Run these in order to undo all of it.

Undo everything
$ sudo spctl --global-enable
sudo spctl --remove /Applications/MyTool.app
sudo spctl --master-enable
xattr -d com.apple.quarantine ~/Downloads/SomeApp.app

Review before running — some steps may not be independent.

Sources

Last verified: 2026-09-21

Related guides

How do I check whether an app is properly code signed?
macOSProblem fix

Use codesign and spctl to see whether a macOS app's code signature is valid, intact and acceptable to Gatekeeper.

Medium risk5 steps
Mac Wi-Fi keeps disconnecting: diagnose and fix it
macOSProblem fix

Diagnose and fix repeated Wi-Fi dropouts on macOS using built-in terminal tools: check your connection, read signal stats, reset the interface, and verify the link holds.

Medium risk7 steps