How to Remove the Quarantine Flag on macOS: 3 Simple Methods

Introduction / Why This Is Needed

macOS automatically adds a special com.apple.quarantine attribute (quarantine flag) to files downloaded from the internet via browsers, email clients, or messengers. This mechanism, implemented in Gatekeeper, prevents potentially harmful software from running.

However, you may sometimes encounter situations where:

• Your own script or program is blocked, even though you are confident in its safety.
• A file was downloaded from a trusted source, but macOS still shows an error like "Developer cannot be verified" or "File is damaged."
• You need to quickly deploy your own application on multiple Macs without code signing.

Removing the quarantine flag disables this protection for a specific file or folder, allowing its contents to run without warnings. Important: Only do this for files whose origin you have fully verified and trust.

Prerequisites / Preparation

Before you begin, ensure:

1. You have access to Terminal — it's located in Applications → Utilities or via Spotlight (Cmd+Space, type "Terminal").
2. You know the full path to the file or folder you want to remove the attribute from. You can drag the file into the Terminal window to paste the path automatically.
3. You have write permissions for the target folder. If the file is in a system directory (e.g., /Applications), you may need sudo (administrator password).
4. You understand the security risks: removing the quarantine flag disables one of macOS's protective mechanisms. Never remove the attribute from files from unverified sources.

Step-by-Step Instructions

Method 1: Remove the Flag for a Single File

This is the most common scenario, when you need to remove quarantine from a specific executable, script, or application bundle.

1. Open Terminal.
2. Enter the command, replacing <full_path_to_file> with the actual path:

   xattr -d com.apple.quarantine /full/path/to/file
   

   For example:

   xattr -d com.apple.quarantine ~/Downloads/my-script.sh
   

   What the command does:
   • xattr — utility for working with file extended attributes.
   • -d — delete flag.
   • com.apple.quarantine — the attribute name responsible for quarantine.
3. Press Enter. If the file is writable, you will see no output — this is normal. An Operation not permitted error means the file is protected by SIP or requires administrator privileges. In this case, try adding sudo before the command (enter the administrator password).

Method 2: Remove the Flag for All Files in a Folder

If you downloaded an archive with multiple files or an application folder, it's convenient to remove the attribute recursively.

1. In Terminal, run:

   xattr -dr com.apple.quarantine /path/to/folder
   

   
   Example:

   xattr -dr com.apple.quarantine ~/Downloads/MyApp.app
   

   
   Key flags:
   • -r — process all nested files and folders recursively.
   • -d — delete the specified attribute.
2. For the current directory (if you are already in the target folder) use a dot:

   xattr -dr com.apple.quarantine .
   

Method 3: Bulk Removal by Extension or Pattern

Sometimes you need to remove quarantine only from specific file types (e.g., all .sh scripts). This can be done with find.

1. Run the command:

   find /path/to/folder -name "*.sh" -exec xattr -d com.apple.quarantine {} \;
   

   
   How it works:
   • find searches for files by pattern (-name "*.sh").
   • -exec executes the xattr -d com.apple.quarantine command for each found file.
   • {} is replaced with the filename.
   • \; terminates the -exec command.
2. Remove the attribute from all files containing "app" in the name:

   find ~/Downloads -name "*app*" -exec xattr -d com.apple.quarantine {} \;
   

Verifying the Result

After removing the attribute, confirm that the quarantine flag is indeed gone:

1. For a single file:

   xattr -l /path/to/file
   

   
   The output should not include a line for com.apple.quarantine. If the attribute was deleted, you'll see only other attributes (if any) or empty output.
2. For a folder (recursive check):

   find /path/to/folder -exec xattr -l {} \; | grep com.apple.quarantine
   

   
   If the command outputs nothing — the attribute has been removed from all files.
3. Try running the file. The Gatekeeper warning should disappear. If it remains, the issue might be elsewhere (e.g., missing signature or notarization).

Potential Issues

"Operation not permitted" error when running xattr

• Cause: The file is in a protected system folder (e.g., /System, /usr) and SIP (System Integrity Protection) is enabled. Or the user lacks write permissions.
• Solution:
  • Do not disable SIP for a single file — it significantly reduces system security.
  • If the file is in /Applications or your home folder, try running the command with sudo (enter the administrator password).
  • Move the file to another folder (e.g., ~/Applications or ~/Downloads), remove the attribute, then move it back.

Quarantine flag reappears after re-downloading

• Cause: macOS adds the attribute automatically on each download via Safari, Chrome, etc.
• Solution: Remove the flag after each download or configure your browser to disable the check (not recommended). For frequent scenarios, create a wrapper script.

Gatekeeper warning persists even after removing the flag

• Cause: The file is unsigned or hasn't passed notarization (Apple's official verification). Removing com.apple.quarantine only disables one type of check.
• Solution:
  • Add the file to exceptions: System Settings → Privacy & Security → Security → click Open Anyway next to the file.
  • Or temporarily disable Gatekeeper (for test environments only): sudo spctl --master-disable. Warning: this disables all signature checks for all apps. Re-enable it: sudo spctl --master-enable.

find command doesn't find files or removes too much

• Cause: Incorrect path or pattern.
• Solution:
  • Check the path: ls /path/to/folder — ensure the folder exists.
  • Refine the pattern: find /path/to/folder -name "*.app" (applications only).
  • First run find without -exec to see the file list: find /path/to/folder -name "*.app".

Attribute is removed, but file won't run with "File is damaged" message

• Cause: The file is actually corrupted or has an incorrect format (e.g., incomplete download).
• Solution:
  • Check the checksum (if provided by the source).
  • Re-download the file.
  • Ensure the file is intended for your macOS version (Intel vs Apple Silicon).

Remember: Removing the quarantine flag is a security bypass. Use this method consciously, only for files you created yourself or received from a completely trusted source. For regular work with unsigned software, consider setting up a dedicated development environment or using a virtual machine.