Fixing “app is damaged and can’t be opened”

Few messages cause as much quiet panic as this one. You download an app, double-click it, and macOS tells you it’s damaged and should be moved to the Bin. Nine times out of ten nothing is damaged at all. Gatekeeper simply doesn’t like something about where the file came from.

Why macOS says this

When a file arrives from the internet, macOS attaches a quarantine flag to it. On first launch, Gatekeeper checks two things: is the app signed by a known developer, and has Apple notarised it? If either check fails in a particular way, you don’t get the polite “unidentified developer” prompt. You get “damaged”.

The usual causes, roughly in order of how often I saw them on the help desk:

• the download was interrupted and the disk image really is incomplete;
• the app was copied from a USB stick or network share that stripped its signature;
• the app is signed, but the signature has expired or been revoked;
• it’s an open-source build that was never notarised.

Check the download first

Before overriding anything, make sure the file is what it says it is. Delete it, empty the Bin and download it again from the listing on this site. Compare the size with the one on the program page; if they differ by more than a megabyte, the download didn’t finish.

Comparing a checksum

Where a developer publishes a SHA-256 checksum, you can compare it in Terminal:

shasum -a 256 ~/Downloads/Compresto-1.31.dmg

The long string it prints should match the one on the developer’s site character for character.

Allow it in System Settings

1. Try to open the app once, so macOS registers the attempt.
2. Open System Settings → Privacy & Security.
3. Scroll down to the Security section. You should see a line about the app being blocked.
4. Click Open Anyway and confirm with your password or Touch ID.

On macOS Sequoia and Tahoe the right-click → Open shortcut no longer bypasses the check, so this is the route to use.

The Terminal route

If there’s no “Open Anyway” button, the quarantine flag can be removed by hand. Only do this for an app you trust and have checked:

xattr -dr com.apple.quarantine /Applications/AppName.app

Replace AppName with the actual name, keeping the .app on the end. Tip: type the start of the command, then drag the app from Finder into the Terminal window and the path fills itself in.

When none of that works

Restart. I know. But a surprising number of Gatekeeper decisions are cached until the next login. If the app still refuses, leave a comment on its program page with your macOS version and Mac model, and I’ll take a look.