Command line and power tools

Extended attributes, explained

Updated 2026-07-31 · 4 min read

Files on a Mac carry hidden key-value metadata. Several macOS behaviours that look like magic are just xattrs.

See them

ls -l@ file.pdf          # names, inline with ls
xattr -l file.pdf        # names and values

The ones you will actually meet

com.apple.quarantine — set on downloads; triggers the "downloaded from the internet" gate on first open. Removing it skips the gate (for files you trust):

xattr -d com.apple.quarantine app.dmg

com.apple.metadata:kMDItemWhereFroms — the download's origin URLs, readable:

xattr -p com.apple.metadata:kMDItemWhereFroms file.pdf | xxd -r -p | strings

Every downloaded file remembers where it came from. Genuinely useful for a folder of mystery PDFs.

com.apple.metadata:_kMDItemUserTags — Finder tags live here, which is why tags survive copies between Macs but die on exFAT and most cloud round-trips.

com.apple.ResourceFork — the legacy fork, still present on some old files.

Copying and stripping

cp preserves xattrs on modern macOS; -X strips them. ditto always preserves; rsync needs -X. Uploads to most web services silently strip everything — tags and provenance do not survive the cloud.

Strip all attributes from a file:

xattr -c file

Writing your own

xattr -w com.example.note "signed copy, keep" contract.pdf

Legitimate for private tooling; invisible to everything else, and gone the first time the file transits a non-Mac system. For metadata that must survive, the filename remains the only truly portable field.

Common questions

What is com.apple.quarantine?

The attribute marking downloaded files, causing Gatekeeper's first-open prompt. Deletable with xattr -d for trusted files.

Do extended attributes survive copying?

Across APFS/HFS+ with Apple tools, yes. exFAT, many syncs and most uploads strip them.