Learn
Is OpenCore Legacy Patcher safe?
The honest answer has two parts. The software itself is trustworthy: open source, signed by its developers, notarized by Apple, used by millions. Running a patched macOS involves real trade-offs, though, and you should know them before you start.
On this page 8 sections
Short answer
Yes, if you download it from the official GitHub releases and understand the trade-offs. OCLP does not modify your Mac's firmware, and every change can be undone. To work, it lowers some macOS security protections (System Integrity Protection) on most patched Macs. Apple does not support the result, and macOS updates remove its patches until you re-apply them. The biggest practical risk is downloading a fake copy from another site.
Is the app itself safe?
- Open source. All of its code is public on GitHub (18,858 stars, 2,072 forks), and so are the projects it builds on: Acidanthera's OpenCore, Lilu and WhateverGreen.
- Signed and notarized. In our run, the 3.0.0-rc.5 installer showed
signed by a developer certificate issued by Apple for distribution,Developer ID Installer: Mykola Grymalyuk (S74BDJXQMD)andNotarization: trusted by the Apple notary service. Mykola Grymalyuk (khronokernel) is a lead developer of the project. The app inside is signed with the matching Developer ID Application certificate, with the hardened runtime enabled. - No telemetry. Crash analytics were disabled on the server years ago and removed from the app in 2.3.0 (changelog). The app connects to GitHub (updates), Apple's software catalog and AppleDB (installers), and Dortania's GitHub pages for KdkSupportPkg and MetallibSupportPkg manifests when root patching needs them.
- Widely used. The installer of version 2.4.1 alone was downloaded about 2.9 million times from GitHub in the year it was current.
What the installer adds to your Mac, from our install run on macOS 15:
/Applications/OpenCore-Patcher.app (symbolic link to the app below)
/Library/Application Support/Dortania/OpenCore-Patcher.app
/Library/PrivilegedHelperTools/com.dortania.opencore-legacy-patcher.privileged-helperThe package's install script sets the SUID bit on the privileged helper, which lets the app run its patching commands as administrator without asking for your password each time, creates the link in Applications, and asks Gatekeeper to pre-scan the app. Our run found no launch daemons or agents installed by the package. The uninstaller removes all of it (see Uninstall).
What OCLP changes on your Mac
| Part of your Mac | What OCLP does | Undo |
|---|---|---|
| Firmware (boot ROM) | Nothing. OCLP never flashes or patches firmware. | — |
| EFI partition | Installs OpenCore: a bootloader, drivers (kexts) and a config.plist. It makes macOS see a supported Mac and boots it. | Delete the EFI folder from the EFI partition |
| macOS system volume | After the install, root patches add or replace drivers and frameworks Apple removed (graphics, Wi-Fi, audio…). This breaks the system volume's seal. | Revert Root Patches in the app, or reinstall macOS |
| Security settings | Lowers System Integrity Protection where root patches need it, and on some Macs relaxes Apple Mobile File Integrity, via OpenCore's settings. | Return to native macOS and boot without OpenCore |
| Your files | Nothing. Your user data is not touched. | — |
The security trade-off: SIP and the sealed system
System Integrity Protection (SIP) stops even administrator programs from changing macOS system files. Root patching has to change system files, so OCLP turns off the SIP flags it needs. From the source (sip_data.py), for patched Macs on Ventura and newer that is:
CSR_ALLOW_UNTRUSTED_KEXTS 0x1
CSR_ALLOW_UNRESTRICTED_FS 0x2
CSR_ALLOW_UNAUTHENTICATED_ROOT 0x800On Big Sur and Monterey, Macs with Metal graphics that need no root patches can keep SIP fully on (Dortania, Post-Installation). From Ventura on, every unsupported Mac needs lowered SIP.
What this means in practice: malware running with your administrator password could modify system files that SIP would normally protect. Your other protections stay: Gatekeeper, XProtect, the firewall, FileVault (supported again on Tahoe with 3.0.0), app sandboxing and Apple's security updates. Keep macOS updated, install software only from sources you trust, and do not run as an administrator for daily work if you are cautious.
Is OpenCore Legacy Patcher legal?
OCLP is legal open-source software. Apple's macOS license allows installing macOS on Apple-branded computers; OCLP only runs on real Macs and downloads macOS from Apple's own servers. Unlike a Hackintosh, nothing runs on non-Apple hardware. It does mean running macOS on hardware Apple does not support, so Apple will not help with problems on a patched Mac. (This is not legal advice.)
Real risks, and how to avoid them
| Risk | How likely | How to avoid it |
|---|---|---|
| Fake or modified downloads | Real: the developers have warned about a look-alike site and re-uploads | Only download from GitHub; check the signature |
| Mac does not boot after an update | Occasional, mostly before patches are re-applied | Keep the OCLP app updated, read the release notes, keep a bootable USB installer and a backup |
| Missing graphics, Wi-Fi or sound after an update | Every major and point update removes root patches | Run Post-Install Root Patch after each update; keep Ethernet handy |
| Features that never work | Depends on the Mac (Apple Intelligence on every Intel Mac, apps that need Metal on non-Metal Macs) | Check your Mac's page and What works |
| Data loss during install | Low, same as any macOS install | Back up first; do not erase the whole disk on T1 MacBook Pros |
| Pre-release instability | Real for 3.0.0 builds until final | Use 2.5.1 with Sequoia on a Mac you depend on |
Fake OpenCore Legacy Patcher sites
In December 2023 the developers published a warning (issue #1120) about a website that presented itself as OCLP's official site, re-hosted the app and emailed other sites in the project's name. The official links are only the GitHub repository and the documentation at dortania.github.io. Watch for:
- Sites that host the
.pkgthemselves, or offer a.dmg,.zipor.exe. - “Premium”, “pro” or paid versions.
- Download pages that ask you to disable Gatekeeper or run a script first.
- Anyone emailing you on behalf of the OCLP team. The developers state that the project does not email or contact users.
This site (oclp.dev) is an independent guide: we do not host the app, and every download link points to GitHub.
Can you undo it?
Yes, completely: revert the root patches, remove OpenCore from the EFI partition, uninstall the app, and if you want, reinstall the last macOS Apple supports for your Mac. Step by step: How to uninstall OpenCore Legacy Patcher.
Common questions
Can OpenCore Legacy Patcher brick my Mac?
Is OCLP a virus? My antivirus flagged it.
Does OCLP collect data?
Is it safe for online banking?
Keep going
Something wrong or out of date on this page? Email hello@oclp.dev and we will fix it (see our corrections policy).