CleanMyMac review: Is it safe and worth it?

What notarization promises, and what it does not

Apple’s own wording is narrow. When an app is notarized, Apple says it “checked it for malicious software and none was detected.” Gatekeeper then verifies at first launch that the software comes from an identified developer and has not been altered since.

That is an automated scan for known malicious content. It is not a review of whether an app deletes files you needed, and Apple does not inspect what the cleaning modules do at runtime.

MacPaw states it more strongly than Apple does. Its own safety page says that Apple “has reviewed its code and confirmed it contains no known malware before distribution.” Apple’s sentence is the one to trust: a scan found nothing, which is a floor rather than an endorsement.

You can check the copy on your own Mac. Open Terminal and run:

spctl -a -vv /Applications/CleanMyMac.app

A genuine copy returns accepted, source=Notarized Developer ID, and the MacPaw Way Ltd developer identity.

pkgutil --check-signature /Applications/CleanMyMac.app

The real risk is the fake download page

In March 2026, Malwarebytes documented a site at cleanmymacos[.]org that copied the CleanMyMac download page and served SHub Stealer instead of the app. Malwarebytes states plainly that the site “is unconnected to the legitimate software or the developers, MacPaw.”

The lure is a technique called ClickFix. Instead of handing over a disk image, the page tells the visitor to open Terminal, paste a command, and press Return. The command pulls down an obfuscated script that harvests saved passwords, browser cookies, Keychain contents, Telegram sessions, and shell history, then backdoors Exodus, Atomic Wallet, Ledger Wallet, Ledger Live, and Trezor Suite to capture recovery phrases. It also scans for 102 wallet browser extensions.

ClickFix exploits no macOS vulnerability. The person at the keyboard runs the code under their own account, so it works on every macOS version, and Gatekeeper never gets a say.

What Full Disk Access hands over

CleanMyMac needs Full Disk Access for most of its cleaning, and the permission is worth understanding before you grant it. Apple’s description is broader than most people expect: the app can access all files on your computer, “including data from other apps (for example, Mail, Messages, Safari, and Home), data from Time Machine backups, and certain administrative settings for all users on this Mac.”

Grant it in System Settings → Privacy & Security → Full Disk Access, then switch CleanMyMac on. On macOS 12 Monterey and earlier, the route is System Preferences → Security & Privacy → Privacy → Full Disk Access.

Two more permissions follow. The background agent behind CleanMyMac Menu asks for Login Items & Extensions, and the app asks to send notifications. The Cloud Cleanup module goes further still: it connects to iCloud, Google Drive, OneDrive, or Dropbox over OAuth, which puts your cloud accounts inside the app’s reach as well as your disk.

Granting this access means the app can read that data. It does not mean the data goes anywhere. The point is that the permission is broad, so it deserves a deliberate decision rather than a click‑through.

What the scan reported

Smart Care on my test Mac found 11.3 GB of junk to clean, no threats, 2 performance tasks, 6 app updates, and 8 duplicate downloads.

That 11.3 GB is a real measurement of files on the disk. What it is not is 11.3 GB of permanent savings. Most of it sits in caches, and caches are working files: apps rebuild them as you use them, so part of that space returns within days.

Howard Oakley, who writes the Eclectic Light Company blog and has argued against cleaner apps since 2016, makes the sharper version of this point. Cache folders, he notes, are “controlled by macOS not the app”, and the system empties them on its own schedule. His older objection still stands too: without a top‑level undo, a cleaner’s mistake is yours to live with.

The durable wins are elsewhere. Old installer packages and disk images, app leftovers, duplicates, and large forgotten files stay gone once deleted, because nothing regenerates them.

Cleanup risk, category by category

Not every category in a cleanup carries the same risk. This is how I would sort them.

• Low risk: caches, logs, temporary files, Trash bins, old installer packages. macOS rebuilds what it needs, and it never includes user data.
• Medium risk: language files, mail attachments, universal binaries. Removing localizations means an app loses those languages until you reinstall it, and purged mail attachments download again only while the message is on the server.
• Higher risk: anything under Large & Old Files and My Clutter. These are your own documents, chosen by size and date rather than by importance, so review the list instead of accepting the selection.

Protection, Performance, and Applications

The Protection module carries a “Powered by Moonlock” badge, which is MacPaw’s own cybersecurity division rather than a third‑party engine. It runs a signature scan against a list of known macOS threats. It is on‑demand rather than real‑time, and it does not replace XProtect, the scanner Apple builds into macOS.

sudo periodic daily weekly monthly

Applications is the strongest module and the one that competes most directly with dedicated uninstallers. It removes an app together with its support files, launch agents, caches, and preferences, and its File Leftovers tool finds files belonging to apps you deleted long ago. Since July 2026, the scan has run in the background, so you can start reviewing apps before it finishes.

Space Lens and My Clutter

Space Lens draws a treemap of the disk and lets you pick which volume to scan, so external drives are covered. It is the module I would miss most, because finding a 40 GB folder by clicking through Finder is genuinely tedious work.

My Clutter handles large files, duplicates, similar images, and the Downloads folder, with a selector for which user account to scan.

Cloud Cleanup is the newest addition and the one to think hardest about. It cleans files in connected cloud accounts, which means granting the app OAuth access to iCloud, Google Drive, OneDrive, or Dropbox.

What “one‑time” actually covers

The one‑time license is the single thing buyers get angriest about, and the misunderstanding is understandable. MacPaw’s own purchase‑options page is clear on the terms: a one‑time purchase “includes only updates and fixes for your current major version of CleanMyMac,” and a one‑time license of CleanMyMac X “doesn’t include an upgrade to the latest CleanMyMac.” The license itself has no expiry date, and you can use it “as long as it’s compatible with your Mac and macOS version.” The subscription, by contrast, includes upgrades to future major versions.

So the license does not expire. Its compatibility does, when macOS moves on and your major version stops being supported.

That is not hypothetical. A Reddit thread with roughly 300 upvotes was started by a buyer whose “lifetime” license was about three years old when he was told macOS Tahoe 26 was the last release his version supported. MacPaw’s support reply described the new version as “a new product with fundamental changes, advanced features, and a comprehensive redesign.” Other users in the thread were blunter. Belifant called it “just a one time purchase for a single version of an app,” and 1toomanyat845 added that it lasts “for lifetime of that version number. It’s teeny print.”

Do the arithmetic before choosing. At $119.95 against $39.95 a year, the one‑time license breaks even at three years — which is roughly how long the last major version lasted. With the 40% competitor discount applied, the subscription math changes again.

Where it falls short

Malware detection is the weakest part of the product. Moonlock’s page says AV‑TEST has tested its engine in a vendor‑neutral lab, without publishing a score there, and CleanMyMac carries no ongoing public certification from AV‑TEST or AV‑Comparatives. AllAboutCookies went further in its hands‑on test and reported that “CleanMyMac failed all three EICAR tests and has no third‑party testing,” with its malware monitor missing files downloaded during testing. EICAR is a harmless standard test file that antivirus software is supposed to flag by definition.

There are also no scheduled scans and no real‑time protection. Treat it as an optimizer with a bundled scanner rather than an antivirus.

The speed claims deserve the same skepticism. Since OS X 10.9 Mavericks, macOS has managed memory with compression and kernel‑level pressure handling. Forcing “free” RAM back, which is what the purge command does, can make the system re‑read data it had cached. On my M1 test Mac with 8 GB of RAM, Memory Pressure in Activity Monitor → Memory barely moved before and after running the optimization tasks. This is a fair criticism of every Mac cleaner, not of CleanMyMac alone.

False positives happen in this category. CleanMyMac once blocked a legitimate Flash Player installer as a threat, which Adobe’s community forum documented at the time. Flash is long dead, so the specific case is history, but the pattern is not: signature databases in cleaner apps do flag legitimate installers now and then.

Method 1: Use CleanMyMac’s own uninstaller

CleanMyMac can remove itself, and on my test Mac it did so cleanly:

1. Open CleanMyMac and go to Applications → Uninstaller.
2. Select CleanMyMac.app in the list. It showed 436 MB on my Mac.
3. Click Uninstall.
4. Confirm in the dialog that warns the app will quit and be removed.

CleanMyMac warns you that you are about to remove the app you are currently using, then quits itself and finishes the job. On my test Mac that left nothing behind in the Library folders.

Method 2: Remove it by hand

~

~/Library

1. Quit CleanMyMac with Command+Q.
2. Move

   /Applications/CleanMyMac.app

   Copy

   to the Trash.
3. In Finder, press Shift+Command+G and visit each location below, removing items that carry the CleanMyMac name.
4. Open System Settings → General → Login Items & Extensions and remove any MacPaw entries left behind.
5. Empty the Trash and restart.

~/Library/Application Support

CleanMyMac

~/Library/Caches

com.macpaw.CleanMyMac*

~/Library/Preferences

com.macpaw.CleanMyMac*.plist

~/Library/LaunchAgents

com.macpaw.CleanMyMac*.plist

/Library/PrivilegedHelperTools

com.macpaw.CleanMyMac*.helper

/Library/LaunchDaemons

com.macpaw.CleanMyMac*.plist

sudo launchctl bootout system/<label>

systemextensionsctl list

App Cleaner & Uninstaller by Nektony does the same sweep in one window if you would rather not visit six folders, and its Remaining Files section catches leftovers when the app is already in the Trash.

Cancel the subscription

Where you cancel depends on where you bought it:

• MacPaw Store: sign in to your MacPaw Account, open CleanMyMac, and click Cancel Subscription. The status changes to Inactive within a few minutes.
• Mac App Store: open System Settings → [your name] → Media & Purchases → Manage Subscriptions, then cancel CleanMyMac. The App Store app offers the same route under Account Settings → Subscriptions.
• Setapp: cancel in your Setapp account rather than through MacPaw.