Show file extensions on Mac to spot fake files

A file called Invoice.pdf in your Downloads folder looks harmless — until you realise its full name is Invoice.pdf.app and Finder is only showing you the first half. Turning on file extensions is the single fastest way to unmask this trick: once every suffix is visible, a program pretending to be a document has nowhere left to hide. Open Finder → Settings → Advanced and switch on Show all filename extensions, and the disguise falls off on every file at once.

Why a hidden extension is a security problem

macOS decides what a file does from its extension, not its icon or the part of the name you can see. By default Finder hides "known" extensions, which is tidy right up until an attacker uses that habit against you. The classic move is a double extension: name a small app Statement.pdf.app, give it a PDF-style icon, and a Mac with extensions hidden displays it as Statement.pdf. You think you're opening a document; you're actually launching code.

The same trick works with other executable types you can double-click. Watch for these suffixes hiding at the true end of a name:

• .app — a full application bundle.
• .command and .sh — shell scripts that run in Terminal.
• .pkg and .dmg — installers that can drop files anywhere on disk.
• .scpt and .workflow — automation that can act on your behalf.

None of these are malicious by themselves. The problem is only ever the mismatch — an executable wearing a document's name. Make extensions visible and that mismatch becomes impossible to miss.

Turn on extensions for every file

The Finder route is the one to trust, because it's the exact switch macOS reads:

1. Click the desktop or any Finder window, then press Command+Comma to open Finder → Settings.
2. Click the Advanced tab.
3. Turn on Show all filename extensions.

The change is instant and applies to every folder, including Downloads, where risky files usually land. It works identically on macOS 13 Ventura, 14 Sonoma, and 15 Sequoia. If you prefer the Terminal, the same setting has a key you can flip and reverse:

# Show every extension, then relaunch Finder
defaults write NSGlobalDomain AppleShowAllExtensions -bool true
killall Finder

# Undo — go back to hidden extensions
defaults write NSGlobalDomain AppleShowAllExtensions -bool false
killall Finder

How to read a suspicious download

With extensions on, vetting a file takes seconds. Look at the very last suffix — that, not anything before it, is what the Mac will do when you double-click. A real invoice ends in .pdf; a booby-trapped one ends in .pdf.app or .pdf.dmg. When something looks off, right-click and choose Get Info: the Kind line spells out the true type in plain English ("Application" versus "PDF document"), and it can't be spoofed by the icon.

Two habits make this second nature. First, be suspicious whenever the icon and the extension disagree — a document icon on a .app is a red flag, not a coincidence. Second, remember that Gatekeeper will usually warn you before an unsigned app runs; if you see an "unidentified developer" prompt for a file you thought was a PDF, stop and check the name. Extensions give you the information, and Gatekeeper gives you the pause to act on it.

When a download still won't run

If a file you trust triggers a security warning, that's macOS doing its job rather than a broken download. Our guide on opening an app from an unidentified developer walks through the safe way to override it — after you've confirmed the extension is what you expected.