I wonder if Homebrew is safe for Mac users...

Do you have any bad experience with this software (like malware for example)?


Homebrew on its own acts like a command-line App Store.

  • It's safe, if you know what you're downloading.
  • It uses SHA256 to fingerprint the downloaded instructions as a validity / tamper detection verification check.
  • It’s open, so you could validate what it’s downloading and how it works.
  • It refuses to use sudo to intentionally be safer.

If you are concerned about downloading hijacked binaries, verify the SHA/SHA1 sum of the binary you've downloaded against the SHA/SHA1 sum published by the developer, usually on their webpage.

Despite a long track record of people not pushing malware or bad code to the system, it would be good hygiene to start validating downloads.

  • 2
    I think one thing that people might dislike (security-wise) with homebrew is that it alters permissions for usr/local, /usr/local/bin for example. – Jim Aho Nov 4 '18 at 18:24
  • 2
    See this article for security concerns: applehelpwriter.com/2018/03/21/… – Jim Aho Nov 4 '18 at 19:12
  • 1
    PLEASE verify the SHA/SHA1 as outlined. In this day we're getting increasing issues with security and everyone should be doing their part. If the SHA does not match notify the developer immediately. Welcome to the new "safe". – Ligemer Jun 26 '19 at 20:52
  • 1
    As of Nov 2016, Homebrew is using SHA256. SHA1 was deprecated. docs.brew.sh/Checksum_Deprecation – Marcy Nov 29 '19 at 21:12
  • 1
    Brew issued in 2018 security incident disclosure after this article by Eric Holmes – Sergey Smolnikov Mar 14 '20 at 8:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .