Ask

Are unsigned apps safe to use?

Why are some major apps — such as HandBrake and the GIMP image editor — not signed? Are they safe to download and use?

Code signatures are used by macOS to tell whether apps have been altered since they were signed, either by accident or interference from malware. Unfortunately, they don’t fit well with open-source software.

To sign an app, developers must register with Apple and pay an annual subscription to have it issue code signatures for their software. Each signature applies to the entire contents of its corresponding.app bundle — the icon that appears in Finder. Once signed, the slightest change to the bundle’s contents will cause macOS’s Gatekeeper feature to refuse to run the app, if ‘Allow applications downloaded from’ in System Preferences’ Security & Privacy pane is set to one of the first two options. (For protection, avoid selecting the third option — Anywhere.)

Apps can be signed at the time they’re compiled from source code. If an app is not signed,