Identity and signing
See signing status, Team ID, bundle ID, version, distribution type, certificate chain, signing timestamp, and whether the signature still matches the file on disk.
Understand Mac software before you open it.
App Trust Preview turns macOS security metadata into a readable trust report for apps, installers, disk images, executables, and scripts.
Drop in a file, choose one from disk, inspect from Finder with Quick Look, or export a report from Terminal. See who signed it, what access it may ask for, whether it can reach the internet, which domains and URLs appear in static analysis, what is packaged inside it, which executable hashes are present, which VirusTotal reports match, and which signals deserve review.
.app .pkg .dmg Executables and scripts Quick Look and CLI Local analysis
What App Trust Preview checks
Apple safety signals
Review Developer ID or Mac App Store distribution, notarization, certificate revocation, quarantine, sandboxing, hardened runtime, and network declarations.
Privacy access
Camera, microphone, screen recording, accessibility, contacts, calendars, reminders, photos, location, Bluetooth, local network, speech recognition, Apple Events, and other sensitive access are grouped into readable labels.
Saved permission decisions
When macOS allows the local privacy database to be read, App Trust Preview can show saved decisions such as allowed, denied, limited, add-only, not decided, or unknown.
Download history and file metadata
See the original source URL, download application, date, file type, quarantine status, and macOS processing metadata. Copy the original download URL in one click.
Internet access and potential connections
See whether sandbox rules restrict direct internet access alongside domains and URLs found through static analysis. Potential destinations are presented as clues, not claims that the app actually connects to them.
Technical details and metadata
Review relevant code-signing, Finder, and system file metadata. DMG reports keep disk image metadata separate from the extracted app and its bundled components.
Inside apps and disk images
Helper tools, login items, XPC services, extensions, frameworks, plug-ins, dynamic libraries, nested apps, architectures, minimum macOS target, and bundle size are surfaced in the report.
Save analyzed apps
Keep an analyzed app as an app bundle, ZIP archive, or DMG disk image. Install it in Applications only when you explicitly choose Install, including apps inspected from DMG files.
Packages, binaries, and scripts
Installer components, install locations, scripts, package payload files, Mach-O metadata, linked libraries, runtime search paths, code signatures, executable hashes, clickable VirusTotal report links, and readable script source previews are shown when available.
Technology and private API signals
Detect Electron, Chromium, CEF, Firefox, Gecko, ToDesktop, Tauri, Wry, WebKit, Qt WebEngine, SwiftUI, React Native, Flutter, Unity, Unreal Engine, Godot, Wine, CrossOver, Java, .NET, Python, Node.js, Mac Catalyst, iOS apps on Mac, Apple private framework links, URL schemes, associated domains, keychain groups, App Groups, and recognized entitlements.
Supported formats
Use the same readable report model across the files Mac users actually download, install, run, and review.
App bundles
Inspect the main app, nested apps, helpers, extensions, frameworks, signatures, entitlements, privacy strings, technologies, potential network connections, and saved decisions.
Installer packages
Review package identity, install location, authorization needs, components, payload paths, and install scripts when available.
Disk images
Inspect packaged apps without opening them first, then review the app and helper signals inside the mounted image preview.
Binary executables
Check platform, architecture, minimum OS, SDK, linked libraries, runtime search paths, code signature data, executable hashes, clickable VirusTotal report links, and unusual binary indicators.
Executable scripts
Preview readable script source and understand why app bundle signing, notarization, and sandbox signals may not apply to plain text scripts.
How it works
1
Choose a target
Drop in a file, choose one from disk, preview it with Quick Look, or pass a path to the CLI.
2
Local scan
Checks run on your Mac and load progressively, so available information appears while slower checks continue.
3
Read the report
Important findings appear at the top, good signs are shown as good signs, and sections expand when you want more detail.
4
Export or automate
Save PDF or PNG from the app. JSON and text reports include download history and file metadata and can be exported from the app or Terminal for workflows and AI analysis.
Make every report part of your workflow
Keep chosen tools, personal context, and download provenance directly in each report.
Open with the apps you choose
Add compatible antivirus tools, disk image utilities such as EasyDMG, editors, or other apps. Each appears as a report button that opens the analyzed target in one click.
Keep a personal note for each app
Record why you trust an app, where it came from, which permissions you approved, or what to recheck after an update. Notes save automatically and appear in App Trust Preview and Quick Look.
Trace where downloads came from
Download history keeps the recorded source URL, download app, date, file type, quarantine state, and macOS processing metadata together. Copy the original URL with one click.
CLI
Start with help
Run the installed app binary directly from Terminal. Quote the path because the app name contains spaces.
The help output lists the current options, supported export formats, scan filtering, and test discovery commands.
CLI guide'/Applications/App Trust Preview.app/Contents/MacOS/App Trust Preview' --helpUse the right surface for the job
The main app, Finder Quick Look, Settings, and CLI all show the same intent in different workflows.
Main app
Drag, choose, rescan, expand details, copy fields, open System Settings shortcuts, and export reports.
Finder Quick Look
Press Space on supported files to inspect them before opening or installing them, then hand off to the full app when needed.
Settings
Configure Quick Look and the main report view, expand details by default, skip slower checks, reorder sections, hide sections, and manage allowed paths for automation.
Command line
Export JSON or text reports for a given app, package, disk image, executable, or script. Use it in workflows, shell scripts, review pipelines, or AI agent analysis.
What the report means
Strong safety signals
The main macOS checks look good, with valid signing, clear identity, expected isolation, and no major before-you-open findings.
A few things to know
Some signals need context, such as a non-sandboxed app, weaker network settings, sensitive permission requests, installer scripts, or saved decisions worth reviewing.
Some signals are weaker than usual
The report highlights stronger concerns such as invalid signatures, revoked certificates, unsigned helpers, private framework links, private symbol matches, or unusual runtime exceptions.
Not enough information
macOS could not confirm enough about the target from inside the current app environment to give a confident verdict.
App Trust Preview is not a malware scanner and cannot prove that software is safe. It gives practical context before trusting software.
App Trust Preview in action
Screenshots showing build-matched privacy decisions, attached offline notarization tickets, Quick Look, package and script inspection, Open With setup, report exports, personal notes, download history, and hash lookup targets.
Changelog
Latest App Trust Preview updates
The newest release notes for checks, clearer wording, and UI improvements.
- Added Download history with source URLs, download application, date, file type, quarantine status, and macOS processing metadata.
- Added one-click copying of the original download URL.
- Reorganized Internet access and potential connections into one clearer section.
- Improved Technical details with relevant code-signing, Finder, and system file metadata.
- Improved DMG reports by clearly separating metadata for the disk image, extracted app, and bundled components.
- Expanded JSON, text, and CLI reports with download history and file metadata.
- Fixed incorrect whole-app quarantine claims and confusing metadata descriptions.
- Improved nested PKG extraction reliability, including packages containing symbolic links.
- Preserved existing report order and visibility preferences after the panel reorganization.
Privacy. Local-first by design.
App Trust Preview inspects software on your Mac across the main app, Finder Quick Look, and command line workflows.
- The Mac app sends no network requests of its own.
- The inspected software is not uploaded.
- The inspected software is not launched.
- The inspected software is not modified.
- Reports are generated on your Mac.
- Certificate revocation uses macOS own trust service, not an App Trust Preview server.
Why I made App Trust Preview
As a developer, I understand hardening, sandboxing, entitlements, signing, notarization, helper tools, package scripts, and internal executables. Most Mac users should not need to learn all of that just to decide whether downloaded software deserves caution.
I built App Trust Preview to translate technical macOS signals into human-readable indicators that are visible before software is opened or installed.
It does not prove that software is safe, and it is not an antivirus scanner. It gives practical context so users and reviewers can make a more informed trust decision.
Built by Ihor July
App Trust Preview is made by Ihor July, a macOS developer, cybersecurity expert, and reverse engineer focused on practical, privacy-respecting Mac utilities.
Ihor also made Parall and DockLock Pro. App Trust Preview follows the same approach, with native macOS behavior, clear user control, and careful handling of security-sensitive details.
FAQ
Does App Trust Preview detect malware?
No. It is not antivirus and cannot prove an app is safe or malicious. It shows verifiable macOS trust signals so you can decide what deserves trust, context, or caution.
Which files can I inspect?
App Trust Preview can inspect .app bundles, .pkg installer packages, .dmg disk images, binary executables, and executable scripts.
How can I inspect software?
Use the main app with drag and drop or Choose, select a supported file in Finder and press Space for Quick Look, or export JSON and text reports from Terminal with the command line interface.
Does it launch or modify the software I inspect?
No. App Trust Preview reads local metadata but does not open, run, modify, grant permissions to, revoke permissions from, or upload the inspected software.
Why does an app installed from a DMG keep its quarantine attribute?
App Trust Preview intentionally leaves the com.apple.quarantine attribute in place when it installs an app from a DMG. It is designed not to modify inspected apps or change their attributes, including when copying an app to the Applications folder. If you prefer a one-click DMG installation workflow that can remove quarantine after its own macOS security preflight, install the third-party EasyDMG utility and add it to the Open with other apps report section. App Trust Preview passes the analyzed DMG to EasyDMG, which handles installation according to its own settings and security checks.
How do I use the command line interface?
Run '/Applications/App Trust Preview.app/Contents/MacOS/App Trust Preview' --help from Terminal to see the current options. Use this main app binary for CLI access, not AppTrustPreviewInspect. The help output describes supported targets, report formats, scan filtering, test discovery, and the current commands. See the CLI guide for examples.
Can an AI agent analyze apps with App Trust Preview?
Yes. First open Settings in App Trust Preview and add the folders the app may read. /Applications already has read-only access. You can add folders such as ~/Downloads and ~/Applications for files you want an AI agent to inspect. Then tell the agent to run '/Applications/App Trust Preview.app/Contents/MacOS/App Trust Preview' --help, read stdout, avoid the --json argument, inspect the target files, read report output from stdout, and summarize the findings for you. Add an output folder with read and write access only when you want saved report files.
Why is Location shown as Unknown?
macOS stores Location authorization outside the privacy database App Trust Preview can read. The app can show that software declares Location access, but the saved Location decision is Unknown by design.
What does sandboxed mean?
A sandboxed app is limited by macOS and cannot freely access files, devices, other apps, or the network unless it has specific permissions or entitlements.
The report says an app ships helpers that are not sandboxed. Is that bad?
It depends. Some apps use unsandboxed helpers for legitimate work, such as updating themselves outside the Mac App Store. It is still worth reviewing because anything the main app hands to an unsandboxed helper can run outside the sandbox limits.
What are internal components?
Many apps include helper tools, app extensions, XPC services, login items, frameworks, dynamic libraries, or plug-in bundles. App Trust Preview checks each bundled or runnable component for signature and sandbox status.
Can it show executable hashes?
Yes. App Trust Preview can display hashes for executable files and provide clickable VirusTotal links so you can view matching public reports by hash. It does not upload the inspected file.
What are potential network connections?
This section lists domains and URLs found through static analysis of the target app. It does not record live network traffic and does not prove that the app connects to every result. To focus the list on destinations the developer could use to send data or provide user links, App Trust Preview filters out routine Apple infrastructure domains and URLs found in standard file format headers or certificate chains when they are unrelated to those uses.
Is AppTrustPreviewInspect open source?
Yes. JulyIghor/AppTrustPreview contains AppTrustPreviewInspect, the internal inspection helper used by the app for Gatekeeper assessment, strict bundle seal verification, package and disk image inspection support, and saved privacy decision lookup. It is not a user-facing CLI tool and is not meant to be run directly from Terminal. For CLI access, use '/Applications/App Trust Preview.app/Contents/MacOS/App Trust Preview' --help. It is published under the MIT license.
What are detected technologies?
The report identifies common app stacks such as Electron, Chromium, CEF, Firefox, Gecko, ToDesktop, Tauri, Wry, WebKit, Qt WebEngine, SwiftUI, React Native, Flutter, Unity, Unreal Engine, Godot, Wine, CrossOver, Java, .NET, Python, Node.js, Mac Catalyst, and iOS apps running on Mac when they can be confirmed.
What can I export?
The app can export PDF, PNG image, JSON, or plain text reports. Save Files can copy an analyzed app bundle, create a ZIP archive or DMG disk image, or install the app in Applications only when you explicitly choose Install. The command line interface exports JSON or text for automation and AI analysis.
Does it work without internet?
Yes. The main scan is local and sends no network requests of its own. Certificate revocation uses macOS own trust service. If the system cannot answer, that field can read Could not check while the rest of the report still works.
Ready to inspect software before opening?
App Trust Preview is available on the Mac App Store.
Download on the Mac App Store
macOS 10.13+