App Trust Preview turns macOS security metadata into a readable trust report for apps, installers, disk images, executables, and scripts.
Drop in a file, choose one from disk, inspect from Finder with Quick Look, or export a report from Terminal. See who signed it, what access it may ask for, whether it can reach the internet, which domains and URLs appear in static analysis, what is packaged inside it, which executable hashes are present, which VirusTotal reports match, and which signals deserve review.
See signing status, Team ID, bundle ID, version, distribution type, certificate chain, secure signing timestamp, whether the build can keep validating after its certificate expires, and whether the signature still matches the file on disk.
Review Developer ID or Mac App Store distribution, notarization and attached offline tickets, certificate revocation, quarantine, sandboxing, Hardened Runtime, and network declarations.
Detect Sparkle update delivery, review feed transport security and update signature verification, and flag timestamp problems that could make a signed build stop validating after its certificate expires.
Get prominent warnings for unvalidated third-party code, unsigned executable memory, debugger attachment, development push notifications, and the affected component paths.
Camera, microphone, screen recording, accessibility, contacts, calendars, reminders, photos, location, Bluetooth, local network, speech recognition, Apple Events, and other sensitive access are grouped into readable labels.
When macOS allows the local privacy database to be read, App Trust Preview can show saved decisions such as allowed, denied, limited, add-only, not decided, or unknown.
See the original source URL, download application, date, file type, quarantine status, macOS processing metadata, and additional source details recovered from macOS. Copy the original download URL in one click.
See whether sandbox rules restrict direct internet access alongside domains and URLs found through static analysis. Potential destinations are presented as clues, not claims that the app actually connects to them. Copy the detected URL list for further review.
Compare logical size with actual disk use and review relevant code-signing, Finder, and system file metadata. DMG reports keep disk image metadata separate from the extracted app and its bundled components.
Helper tools, login items, XPC services, extensions, frameworks, plug-ins, dynamic libraries, nested apps, architectures, and affected component paths are surfaced. The main app's minimum macOS requirement is shown separately from the highest requirement among bundled components.
Keep an analyzed app as an app bundle, ZIP archive, or DMG disk image. Install it in Applications only when you explicitly choose Install, including apps inspected from DMG files, and optionally move the downloaded DMG to the Trash afterward.
Installer components, install locations, scripts, package payload files, Mach-O metadata, linked libraries, runtime search paths, code signatures, executable hashes, clickable VirusTotal report links, and readable script source previews are shown when available.
Detect Sparkle, Electron, Chromium, CEF, Firefox, Gecko, ToDesktop, Tauri, Wry, WebKit, Qt WebEngine, SwiftUI, React Native, Flutter, Unity, Unreal Engine, Godot, Wine, CrossOver, Java, .NET, Python, Node.js, Mac Catalyst, iOS apps on Mac, Apple private framework links, URL schemes, associated domains, keychain groups, App Groups, and recognized entitlements.
Use the same readable report model across the files Mac users actually download, install, run, and review.
Inspect the main app, nested apps, helpers, extensions, frameworks, signatures, entitlements, privacy strings, technologies, potential network connections, and saved decisions.
Review package identity, signature and notarization classification, install location, authorization needs, components, payload paths, and install scripts, including reliable inspection of nested packages and packages containing symbolic links.
Inspect packaged apps without opening them first, then review the app and helper signals inside the mounted image preview.
Check platform, architecture, minimum OS, SDK, linked libraries, runtime search paths, code signature data, executable hashes, clickable VirusTotal report links, and unusual binary indicators.
Preview readable script source and understand why app bundle signing, notarization, and sandbox signals may not apply to plain text scripts.
Drop in a file, choose one from disk, preview it with Quick Look, or pass a path to the CLI.
Checks run on your Mac and load progressively, so available information appears while slower checks continue.
Important findings appear at the top, good signs are shown as good signs, and sections expand when you want more detail.
Save PDF or PNG from the app. JSON and text reports include security findings, update delivery checks, compatibility details, download history, and file metadata, and can be exported from the app or Terminal for workflows and AI analysis.
Keep chosen tools, personal context, and download provenance directly in each report.
Add compatible antivirus tools, disk image utilities such as EasyDMG, editors, or other apps as one-click report actions. App Trust Preview is fully compatible with App Archiver. Add App Archiver to Open with other apps once, then archive, optimize, or restore an app in one click from any app report, including Quick Look.
App ArchiverRecord why you trust an app, where it came from, which permissions you approved, or what to recheck after an update. Notes save automatically and appear in App Trust Preview and Quick Look.
Download history keeps the recorded source URL, download app, date, file type, quarantine state, macOS processing metadata, and additional source details recovered from macOS together. Copy the original URL with one click.
CLI
Run the installed app binary directly from Terminal. Quote the path because the app name contains spaces.
The help output lists the current options, supported export formats, scan filtering, and test discovery commands.
CLI guide'/Applications/App Trust Preview.app/Contents/MacOS/App Trust Preview' --helpThe main app, Finder Quick Look, Settings, and CLI all show the same intent in different workflows.
Drag, choose, rescan, open multiple analysis windows, expand details, copy fields, open System Settings shortcuts, and export reports.
Press Space on supported files to inspect them before opening or installing them, then hand off to the full app when needed.
Configure Quick Look and the main report view, expand details by default, skip slower checks, set result limits, reorder sections, hide sections, and manage allowed paths for automation.
Export JSON or text reports for a given app, package, disk image, executable, or script. Use it in workflows, shell scripts, review pipelines, or AI agent analysis.
The main macOS checks look good, with valid signing, clear identity, expected isolation, and no major before-you-open findings. A Strong result requires every relevant trust check to complete successfully.
Some signals need context, such as a non-sandboxed app, weaker network settings, sensitive permission requests, installer scripts, or saved decisions worth reviewing.
The report highlights stronger concerns such as invalid signatures, revoked certificates, unsigned helpers, private framework links, private symbol matches, or unusual runtime exceptions.
macOS could not confirm enough about the target from inside the current app environment to give a confident verdict. Unavailable, unknown, or unreadable checks are kept separate from actual security failures.
App Trust Preview is not a malware scanner and cannot prove that software is safe. It gives practical context before trusting software.
Screenshots showing build-matched privacy decisions, attached offline notarization tickets, Quick Look, package and script inspection, Open With setup, report exports, personal notes, download history, and hash lookup targets.
Changelog
The newest release notes for checks, clearer wording, and UI improvements.
App Trust Preview inspects software on your Mac across the main app, Finder Quick Look, and command line workflows.
As a developer, I understand hardening, sandboxing, entitlements, signing, notarization, helper tools, package scripts, and internal executables. Most Mac users should not need to learn all of that just to decide whether downloaded software deserves caution.
I built App Trust Preview to translate technical macOS signals into human-readable indicators that are visible before software is opened or installed.
It does not prove that software is safe, and it is not an antivirus scanner. It gives practical context so users and reviewers can make a more informed trust decision.
App Trust Preview is made by Ihor July, a macOS developer, cybersecurity expert, and reverse engineer focused on practical, privacy-respecting Mac utilities.
Ihor also made Parall, DockLock Pro, and App Archiver. App Trust Preview follows the same approach, with native macOS behavior, clear user control, and careful handling of security-sensitive details.
No. It is not antivirus and cannot prove an app is safe or malicious. It shows verifiable macOS trust signals so you can decide what deserves trust, context, or caution.
App Trust Preview can inspect .app bundles, .pkg installer packages, .dmg disk images, binary executables, and executable scripts.
Use the main app with drag and drop or Choose, select a supported file in Finder and press Space for Quick Look, or export JSON and text reports from Terminal with the command line interface.
No. App Trust Preview reads local metadata but does not open, run, modify, grant permissions to, revoke permissions from, or upload the inspected software.
App Trust Preview intentionally leaves the com.apple.quarantine attribute in place when it installs an app from a DMG. It is designed not to modify inspected apps or change their attributes, including when copying an app to the Applications folder. If you prefer a one-click DMG installation workflow that can remove quarantine after its own macOS security preflight, install the third-party EasyDMG utility and add it to the Open with other apps report section. App Trust Preview passes the analyzed DMG to EasyDMG, which handles installation according to its own settings and security checks.
Run '/Applications/App Trust Preview.app/Contents/MacOS/App Trust Preview' --help from Terminal to see the current options. Use this main app binary for CLI access, not AppTrustPreviewInspect. The help output describes supported targets, report formats, scan filtering, test discovery, and the current commands. See the CLI guide for examples.
Yes. First open Settings in App Trust Preview and add the folders the app may read. /Applications already has read-only access. You can add folders such as ~/Downloads and ~/Applications for files you want an AI agent to inspect. Then tell the agent to run '/Applications/App Trust Preview.app/Contents/MacOS/App Trust Preview' --help, read stdout, avoid the --json argument, inspect the target files, read report output from stdout, and summarize the findings for you. Add an output folder with read and write access only when you want saved report files.
macOS stores Location authorization outside the privacy database App Trust Preview can read. The app can show that software declares Location access, but the saved Location decision is Unknown by design.
A sandboxed app is limited by macOS and cannot freely access files, devices, other apps, or the network unless it has specific permissions or entitlements.
It depends. Some apps use unsandboxed helpers for legitimate work, such as updating themselves outside the Mac App Store. It is still worth reviewing because anything the main app hands to an unsandboxed helper can run outside the sandbox limits.
Many apps include helper tools, app extensions, XPC services, login items, frameworks, dynamic libraries, or plug-in bundles. App Trust Preview checks each bundled or runnable component for signature and sandbox status.
Yes. App Trust Preview can display hashes for executable files and provide clickable VirusTotal links so you can view matching public reports by hash. It does not upload the inspected file.
This section lists domains and URLs found through static analysis of the target app. It does not record live network traffic and does not prove that the app connects to every result. To focus the list on destinations the developer could use to send data or provide user links, App Trust Preview filters out routine Apple infrastructure domains and URLs found in standard file format headers or certificate chains when they are unrelated to those uses.
Yes. JulyIghor/AppTrustPreview contains AppTrustPreviewInspect, the internal inspection helper used by the app for Gatekeeper assessment, strict bundle seal verification, package and disk image inspection support, and saved privacy decision lookup. It is not a user-facing CLI tool and is not meant to be run directly from Terminal. For CLI access, use '/Applications/App Trust Preview.app/Contents/MacOS/App Trust Preview' --help. It is published under the MIT license.
The report identifies common app stacks and update frameworks such as Sparkle, Electron, Chromium, CEF, Firefox, Gecko, ToDesktop, Tauri, Wry, WebKit, Qt WebEngine, SwiftUI, React Native, Flutter, Unity, Unreal Engine, Godot, Wine, CrossOver, Java, .NET, Python, Node.js, Mac Catalyst, and iOS apps running on Mac when they can be confirmed.
The app can export PDF, PNG image, JSON, or plain text reports. JSON, text, and CLI reports include security findings, update delivery checks, compatibility details, download history, and file metadata. Save Files can copy an analyzed app bundle, create a ZIP archive or DMG disk image, or install the app in Applications only when you explicitly choose Install.
Yes. The main scan is local and sends no network requests of its own. Certificate revocation uses macOS own trust service. If the system cannot answer, that field can read Could not check while the rest of the report still works.
App Trust Preview is available on the Mac App Store.
