Full Disk Access explained: when an app should not need it

23 August 2026 · 6 min read

Full Disk Access is the permission that switches off the folder-by-folder protections macOS puts around your personal data. An app with it can read your Mail and Messages databases, Safari history, Time Machine backups, other users’ home folders, and everything in Desktop, Documents and Downloads without a single further prompt. Backup software, anti-malware tools and terminal apps used for development have a real claim to it. A time tracker, a note app, a menu bar utility or a converter does not. Here is what the permission opens, how to spot an app that is over-asking, and how to revoke it cleanly.

What is locked without it

Since macOS Mojave, parts of your home folder are protected by what Apple calls TCC (Transparency, Consent, and Control). Without any grant, an app cannot read:

Desktop, Documents, Downloads. Each triggers a prompt the first time an app touches it, and the grant is listed under Files and Folders.
iCloud Drive, removable volumes, network volumes. Same per-folder prompts.
Mail (~/Library/Mail), Messages (~/Library/Messages, including the chat database with every conversation), Safari (history, bookmarks, saved tabs), Time Machine backups, Home app data, and a handful of other databases.
Other users’ home folders, even with an administrator account.
The Trash of other users and some system caches.

The per-folder prompts are the normal route. An app that needs your Documents folder asks, you agree, and it gets Documents and nothing else. The protected databases in the third bullet cannot be unlocked by any prompt at all.

What Full Disk Access changes

Full Disk Access (System Settings, Privacy & Security, Full Disk Access) is the master key for the file side of that list. An app on it:

Reads Desktop, Documents, Downloads, iCloud Drive and removable drives without prompting, now and forever.
Reads the protected databases: the full text of your email and iMessage history, your browser history, your backups.
Reads other users’ files on the same Mac.

Two things it does not change: it does not grant Accessibility, Screen Recording or Input Monitoring (those are separate switches), and it does not bypass the App Sandbox for apps that are sandboxed. A sandboxed app with Full Disk Access can read the protected locations only in the ways the sandbox allows, which in practice means through Open dialogs and the folders it has been given. The apps that gain the most from it are non-sandboxed apps, which are also the ones with the fewest other limits.

There is one more property worth knowing. Full Disk Access cannot be requested with a dialog. An app cannot pop up “allow?” the way it can for the camera. It has to send you to System Settings and ask you to add it by hand, with a plus button or by dragging the app in. That friction is a feature: if you are adding an app to this list, you should be able to say in one sentence why.

Apps with a real claim

The sentence is easy for some categories:

Backup and cloning software. It has to read everything to copy everything.
Anti-malware and security scanners. Same reason.
Terminal, and terminal-style apps (editors with integrated shells, some developer tools). Without it, commands like ls ~/Documents fail in a shell, and many developers grant it to Terminal on day one.
Disk space analyzers that need to measure every folder.
Sync and migration tools that move whole home folders.
Mail and Messages utilities that explicitly read those databases, such as archive or search tools. Here the permission is the feature.

In each case, the app’s core purpose is reading files it did not create. That is the test.

Apps that should not need it

Then there are the requests that fail the test. Common ones:

A time tracker. Its job is to know which app is in front and for how long. That is public information. If it wants Full Disk Access, it is either reading something it has not told you about or asking broadly to avoid per-folder prompts. Neither is a good reason.
A note-taking or to-do app that wants to “find your files.” It should use the Files and Folders prompts, per folder.
A menu bar utility with a feature list that does not mention your files at all.
A launcher or search tool. Some have a legitimate case for indexing, but it should be scoped to folders you choose, not the whole disk.
Any app that says it “just works better” with it. It works the same; it prompts less. That is your convenience traded for its reach.

Punchcard is an example of a tracker built to never appear on this list. It asks for no macOS permissions at all: not Full Disk Access, not Accessibility, not Screen Recording. It reads nothing in your home folder except its own database at ~/Library/Application Support/Punchcard/punchcard.sqlite, which is a location every app can write to without permission. Its receipt is app names and minutes. It cannot tell you which files you opened, which is exactly what not having the permission means.

How to audit the list on your Mac

Open System Settings, then Privacy & Security, then Full Disk Access.
Read every entry. Apps you added by hand will be here, along with some that guided you through it during setup.
For each one, say the sentence: “This app needs to read files it did not create because…” If you cannot finish it, switch it off.
Quit and relaunch the app. Most apps read the permission state at launch.
Use the app normally for a day. If something breaks, you will get a prompt for the specific folder it needed, under Files and Folders, which is the narrower grant you wanted all along.

To remove an entry completely, select it and click the minus button. From Terminal, tccutil reset SystemPolicyAllFiles com.example.bundleid resets the grant for one app.

A note on Terminal and what it means

Many people grant Full Disk Access to Terminal early and forget. It is worth knowing what that implies: any command-line tool you run in that Terminal inherits the access, including scripts you paste from the internet and command-line installers. The permission attaches to Terminal, not to the tool. If that makes you uneasy, revoke it and let the per-folder prompts do their job; they appear for shell commands too.

For the broader map of what every permission unlocks, see what-mac-apps-can-see-about-you-permission-by-permission.html, and for where apps keep their own data (the part Full Disk Access is not needed for), see where-mac-apps-keep-your-data-and-how-to-find-it.html.

Questions

Why did macOS not prompt me when an app asked for Full Disk Access?

Because there is no prompt for it by design. The app shows its own instructions and sends you to System Settings. If you did not add it yourself (or follow an app’s walkthrough to do so), the app does not have it.

Does Full Disk Access let an app read my passwords?

Not from the Keychain, which is protected separately and prompts per item. But it can read browser history, mail and message text, and any password you have saved in a plain document, which is often worse.

I granted it to a backup app. Is my Messages history in the backup now?

Yes, along with everything else in your home folder, which is the point of a backup. Make sure the backup destination is encrypted, because the backup inherits none of the protections the original had.

Is Full Disk Access the same as running an app as root or with sudo?

No. It grants read access to protected user data; it does not grant system-level privileges. An app can have Full Disk Access and still be unable to modify system files.