Are Mac cleaner apps safe, or are they all scams?

“Mac cleaner” is one of the few software categories where the default assumption is that the product is a scam, and that assumption is not unfair. A decade of pop-up ads warning that your Mac was infected, apps that were themselves adware, and legitimate tools sold with dishonest numbers got the category where it is.

Some of these apps are fine. Telling which is which takes about ten minutes, and it does not require trusting anybody’s review — including this page, which is on the site of one of the apps in question.

What actually goes wrong

Four distinct failure modes, worth separating because they call for different checks.

1. The app is malware. The classic case is MacKeeper, which spent years being distributed through scareware ads, was famously hard to uninstall, and settled a class action over its marketing. It has changed hands and cleaned up its practices since, but the pattern it established is alive: an ad or a redirect claims your Mac is infected, the “scan” finds hundreds of problems on any machine, and the fix costs money. macOS has no mechanism for a web page to scan your disk. Any page that reports finding problems on your Mac is lying about something it cannot do.

2. The app deletes something it should not. This is the real risk with legitimate software. A cleaner is a program with Full Disk Access whose job is deleting files, and a wrong rule means a lost licence file, a broken app, a mail database, or in the worst historical cases, folders of documents. It is rare, and it is the risk you are accepting.

3. The app inflates its numbers. Counting purgeable space as “recovered” is the common one, because macOS hands that space back on its own. So is counting the same file under two categories, or counting a cache that will rebuild in an hour. The space was never really yours to reclaim.

4. The app is a subscription you forgot about. Not a safety issue, but it is where most of the anger in the reviews comes from.

Things a cleaner cannot do, whatever it claims

If an app claims any of these, that alone is enough to disqualify it.

• Scan your Mac from a web page. Not possible. Browsers cannot read your filesystem.
• Make your Mac faster by clearing caches. Caches exist to make things faster. Deleting them makes the next launch slower, not quicker. Freeing space matters below about 10% remaining, and above that the effect on speed is close to nothing. What actually makes a Mac slow.
• “Clean” purgeable space. macOS owns that decision. An app doing this is thinning snapshots, which is one command. Why you cannot delete purgeable space.
• Fix hundreds of “registry errors” or “problems”. macOS has no registry. There are no hundreds of problems.
• Recover 50 GB on a Mac that is a month old. There is nothing there yet.

The ten-minute test

Do this before granting anything Full Disk Access.

Where did you hear about it? If the answer is a pop-up, a redirect, a warning banner, or an ad that appeared after a page told you something was wrong — stop. No further checks needed. Legitimate cleaners do not need scareware to sell.

Is it notarized, and where is it downloaded from? Get it from the developer’s own domain or the Mac App Store, never a download portal. Then check what Apple thinks of the copy you have:

spctl -a -vvv /Applications/TheApp.app
codesign -dv --verbose=4 /Applications/TheApp.app 2>&1 | grep -E 'Authority|TeamIdentifier'

accepted and source=Notarized Developer ID means Apple has scanned the build and the developer is identifiable and revocable. It is not a quality judgment — plenty of mediocre software is notarized — but unsigned code from a download portal is an immediate no.

Does it show you the files? Run a scan. If it reports “System Junk: 18 GB” with a Clean button and no way to see the actual paths, do not use it. Every trustworthy cleaner will show you the list, because showing the list is the only thing that lets you check the claim.

Read fifty of those paths. They should be under ~/Library/Caches, ~/Library/Logs, ~/Library/Saved Application State, derived data, package caches and the Trash. If you see anything under ~/Documents, ~/Desktop, ~/Pictures or /System preselected, quit and delete the app.

Where does it put what it deletes? The Trash should be the default, so a mistake is recoverable for as long as you leave it there.

Watch what it sends. Little Snitch or Lulu (free) will show every connection the app makes. Licence checks and update checks are normal. A stream of requests while you are scanning is not.

Check the uninstall route before you commit. A cleaner should remove itself cleanly, including its helper tool and launch agent. If there is no uninstaller and no documented removal, that is the MacKeeper pattern.

Why they want Full Disk Access

This one causes justified suspicion, so it is worth being precise.

macOS puts several locations behind that permission: the Trash, Mail’s container, Safari’s data, and every sandboxed app’s container under ~/Library/Containers. An app without Full Disk Access cannot read them and cannot even see their size. That is not optional or embellishment — a cleaner without it will under-report by a large margin and quietly appear to be finding nothing.

So the request is legitimate, and it is also exactly why the rest of this page matters. You are granting an app the ability to read everything, on the strength of your judgment about the vendor. Make the judgment deliberately. If you would rather not grant it to anything, DaisyDisk’s sandboxed Mac App Store build is a real option, at the cost of an incomplete picture.

And the obvious disclosure

This is on the CleanSpace site, so apply the test above to CleanSpace.

It is notarized and distributed only from securemacapps.com. Every scan shows the full path list with real sizes, for free, forever — there is no version of it that asks you to trust a number you cannot check. Removals go to the Trash by default. Nothing under Documents, Desktop, Pictures, Movies or Music is ever cleaned automatically, and iCloud Drive, iOS backups, Messages, Mail’s database, Photos and Calendars are excluded outright. Every deletion passes one gate, and a path that is not explicitly recognized is refused rather than permitted. There is no account, no analytics and no telemetry, and the licence is verified on your Mac against a key compiled into the app, so Little Snitch will show you a network request only when you activate, start the trial or renew.

None of that is a reason to trust us in particular. It is a list you can verify in ten minutes, which is the only kind of reason worth acting on. Run the same test on CleanMyMac, on DaisyDisk, on the free tools, and on ours.

And if the app fails any of the checks above, no amount of good reviews should get it Full Disk Access on your machine.