Home › System Files › .macho
Mach-O

What is a .macho file?

The binary format macOS and iOS use for executables, dynamic libraries (.dylib), kernel extensions (.kext), and frameworks.

Use caution
Type System
By Carnegie Mellon / NeXT / Apple
MIME application/x-mach-binary

Drop any file to identify it

No upload. No signup. No sending your file halfway across the internet.
We tell you what it is, right here in your browser.

Need to convert it? fwip it →

What is it

Mach-O (Mach Object) is Apple's executable format — the macOS/iOS equivalent of Linux's ELF. Every native macOS app, every command-line tool in /usr/bin, every .dylib library, every .kext kernel extension, and the macOS kernel itself is a Mach-O file. The format originated with NeXTSTEP in the late 1980s and Apple inherited it when buying NeXT in 1996.

Five magic-byte variants exist: 32-bit and 64-bit, big-endian and little-endian (legacy from PowerPC days when Macs used big-endian PPC chips), and "universal" (a.k.a. fat binary, magic `CA FE BA BE`) which packages multiple architectures into one file. Modern Apple Silicon Macs run universal binaries containing both arm64 and x86_64 slices, transparently picking the right architecture at launch. The `lipo` CLI extracts or combines architectures; `otool` inspects Mach-O headers and linked libraries.

macOS's sandboxing, code signing, and Gatekeeper systems all build on top of Mach-O. When you run an app for the first time, macOS checks its embedded code signature against the developer's certificate via Gatekeeper. Stripped, ad-hoc-signed, or unsigned Mach-O files trigger a Gatekeeper warning ("can't be opened because the developer cannot be verified"). Don't run Mach-O binaries you didn't build yourself or didn't get from a trusted source — App Store, signed installer pkg, or a reputable package manager like Homebrew.

Technical details
Full Name
Mach-O Executable
MIME Type
application/x-mach-binary
Developer
Carnegie Mellon / NeXT / Apple
Magic Bytes
FE ED FA CE / FE ED FA CF / CE FA ED FE / CF FA ED FE / CA FE BA BE
Safety
.macho requires caution. Mach-O is a container format — safety depends on the binary's contents, not the format. macOS Gatekeeper checks code signatures on launch; don't bypass the warning for binaries from untrusted sources.
What opens it
otool (CLI)
FREE macOS
lipo (CLI)
FREE macOS
Hopper Disassembler
$99 macOS
Ghidra
FREE All

* Inspect Mach-O headers and linked libraries * Inspect / extract architecture slices

FAQ
What's a universal binary?
A Mach-O file containing multiple architecture slices (e.g. both arm64 and x86_64) so the same binary runs natively on Apple Silicon and Intel Macs. macOS picks the right slice automatically at launch. The downside is roughly double the file size. Use `file path/to/binary` to see which architectures are inside.
Why does the universal binary magic look like CAFEBABE?
Apple's engineers had a sense of humour. `CA FE BA BE` is also Java's class file magic (Java used it first, in 1995). The two formats don't conflict in practice because Java class files don't run as native macOS executables, and Mach-O fat binaries don't get confused with .class files — but the collision is famously awkward.
Why did Gatekeeper block this Mach-O binary?
Either the binary isn't code-signed at all, is signed with an ad-hoc (unauthenticated) signature, or the signing developer isn't recognised by Apple. Right-click the binary in Finder and choose Open to bypass the warning once, or run `xattr -d com.apple.quarantine path/to/binary` from the terminal. Don't bypass Gatekeeper for anything you didn't trust enough to download knowingly.
Related formats
.exe
Windows Executable
ELF
ELF Executable
.dmg
Apple Disk Image
.app
macOS Application Bundle