Vault App Download Safety: How to Check a Mac Download

Mac steps use macOS 14 and later names. Menu wording can differ slightly between versions.

Start with where the file comes from

Apple says the safest place to get apps for your Mac is the App Store, where Apple reviews apps before accepting them. Many Mac apps are sold outside it. For those, use the developer's own website and type the address yourself.

A vault app holds your most private files, so a fake copy would do real harm. Do not download one from a search ad, a mirror site, a forum post, a link in a message, or a "free" copy of a paid app.

This guide covers Mac downloads. For a phone vault app, install from the official store for your phone and read the store page first. What a vault app is lists what to look for.

What macOS checks for you

Gatekeeper is the part of macOS that checks downloaded software. Apple says it is designed to help ensure that only trusted software runs on your Mac. By default it expects software signed by the App Store, or signed by a registered developer and notarized by Apple. It asks for your approval before it opens downloaded software for the first time.

Apple says a notarized app indicates that Apple checked it for malicious software and none was detected. That is a check for known malicious content. Apple's pages do not describe it as a check of how an app stores or encrypts your files. A notarized vault app can still be a weak vault.

Check a download step by step

1. Open the official page

   Type the address yourself. Check that the site uses https and that the spelling is exact. Download only from the publisher's page.

2. Find the published checksum

   Look for a SHA-256 value on the download page or in the release notes. If the publisher lists none, you cannot do the next two steps, so rely more on the other checks.

3. Compute your file's SHA-256

   Drop the file on the free SHA-256 checker, which runs in your browser, or run this in Terminal.

   shasum -a 256 ~/Downloads/VaultApp.dmg

4. Compare every character

   The two values must match exactly. If they differ, delete the file and download again from the official page. If they differ twice, stop and contact the publisher.

5. Open the app and read the prompt

   Drag the app to Applications and open it. macOS asks you to confirm on first open. Check that the developer name in the prompt matches the publisher.

6. Optional: ask macOS about the signature

   Replace the path with your app. The first command prints accepted or rejected. The second prints signing details, which include the signing authority. Output differs by app.

   spctl --assess --verbose /Applications/VaultApp.app
   codesign --display --verbose=4 /Applications/VaultApp.app

What a matching checksum proves, and what it does not

• A match proves your file equals the file the publisher listed. It does not prove the publisher is trustworthy.
• If an attacker controls the page, they can change both the file and the checksum. Where you can, take the value from a second trusted place, such as the project's source repository.
• A checksum says nothing about what the app does once you run it.

If macOS blocks the app

Apple lets you override a block. In System Settings > Privacy & Security, an Open Anyway button appears after you try to open the app. Apple also warns: "Overriding security settings to open an app is the most common way that a Mac gets infected with malware." Its advice is to look for a version in the Mac App Store or choose another app.

Do not override for a vault app unless you have confirmed the source and the checksum. Apple says to override only if you are certain the app comes from a trustworthy source.

Red flags

• The page tells you to turn off Gatekeeper or other security settings before you install.
• The download comes from an ad, a mirror, a forum post or a message.
• There is no developer name, no privacy policy and no way to contact anyone.
• The app asks for more access than a file vault needs.
• It is a cracked or "free" copy of a paid app.
• The file you got is a different version from the one on the official page.

After you install

A safe download is not a safe vault. Run the hands-on test with dummy files, read the App Privacy information if the app is in the App Store, and find out what recovery it offers. Forgot vault password explains the options.