What is a PKG File?macOS installer

📦 What is a PKG File?

On a Mac, a PKG file is an installer package, a single file that carries a program along with the instructions macOS needs to set it up. Its .pkg ending is the giveaway, and double-clicking it hands the whole thing to the built-in macOS Installer.

Picture it as a guided setup wrapped into one tidy file. Rather than making you copy pieces into place by hand, a PKG holds the finished software plus a script that knows exactly where each part should go, which folders to create and what to configure along the way. When you run it, the Installer reads those instructions, asks for your admin password and puts everything where it belongs. That is why installing many Mac programs is just a matter of opening a PKG and clicking through a few screens.

If you have used Windows, the closest thing you already know is an MSI installer, and a PKG plays the same role on macOS that MSI plays there. Developers reach for the format when a program needs more than a simple drag into the Applications folder, for example when it has background components, system settings or several parts that must land in specific places. Behind its friendly click-through face, a PKG is really an organised bundle of files and setup logic, and the sections below open it up.

📌 PKG File Quick Facts

🧩 What a PKG Contains

A PKG is not the running program itself, it is the delivery box that carries the program and knows how to unpack it correctly onto your Mac.

Inside you will find the software's actual files, the executables and supporting pieces the app needs, kept together with everything that makes a clean install possible. Alongside them sit install scripts, small programs that run during setup to do jobs like creating folders, setting permissions or registering a background service. There is also metadata, a set of notes describing the package such as its name, version and where its contents should be placed. Some packages carry a signature too, a stamp that lets macOS confirm the package really came from the developer it claims and has not been altered.

Technically all of this is held in a XAR archive, a container format with a neat directory structure inside, which is why tools that understand archives can peer into a PKG. That combination of payload, scripts and description is what separates a true installer from a simple folder of files. The payload is the software, the scripts carry out the setup, and the metadata ties it together so macOS can install, verify and later remove the program cleanly.

📥 How to Install a PKG File

Installing a PKG on a Mac is designed to be easy, and there are two routes, the everyday double-click and a terminal command for those who prefer it or need to automate the job.

The simple way

Just double-click the PKG. The macOS Installer opens and guides you through a short series of screens, showing what will be installed and asking you to agree and continue. Partway through it asks for your administrator password, since placing software on the system needs permission, and after a moment the program is installed and ready. This click-through path suits almost everyone almost all of the time.

The terminal way

People who manage many Macs, or who want to script an installation, can run a PKG from the command line instead. The installer command does the work, taking the package and a target, and it is handy when clicking through screens on machine after machine is not practical.

# Install a package onto the main drive
$ sudo installer -pkg /path/to/app.pkg -target /

# You will be asked for your admin password

🔐 Signed, Notarized and the "Unidentified Developer" Message

Before a PKG installs, macOS runs a security check, and knowing how it works explains the warning many people hit when a package will not open.

Apple's protection here is called Gatekeeper. When you open a package that came from outside the App Store, it looks for two things, a Developer ID signature that proves who made the package and confirms it has not been tampered with, and notarization, which means Apple has already scanned the package for known malware. A package that carries both installs without fuss. One that is missing either is stopped, and you see a message saying it is from an unidentified developer or that macOS cannot check it for malicious software.

That warning is a caution rather than a dead end. If you trust where the file came from, you can let it through by opening the Privacy and Security settings, where macOS offers a button to open the blocked package anyway, or by right-clicking the file in Finder and choosing Open. The advice, though, is the same as for any installer you download, which is to only override the block for software from a source you are sure of. A package from a developer's own site or the App Store is normally fine, while one from an unfamiliar link deserves a second thought before you wave it past the check. Developers who want their packages to sail through are expected to sign every part from the inside out and then notarize the finished installer, so a package that still triggers the warning has usually skipped one of those steps.

🔍 Looking Inside Without Installing

Sometimes you want to see what a PKG holds before committing to running it, and because it is really an archive there are a few ways to peek inside.

The quickest, when a package allows it, is to right-click it in Finder and choose Show Package Contents, which opens it like a folder to browse. Many modern packages are built as a single flat file, however, and those do not offer that option. For those, the pkgutil tool in Terminal can expand a package into a folder you can explore, and the command-line xar tool can list or pull out its parts. On Windows or Linux, where you cannot install a Mac PKG at all, an archive manager such as 7-Zip can still open it and show the files within, which is a useful way to check the contents even without a Mac.

# Expand a flat package into a folder
$ pkgutil --expand app.pkg expanded-folder

# List what a package would install
$ installer -pkg app.pkg -pkginfo

🗑️ How to Uninstall Software from a PKG

One thing that surprises people is that macOS has no single button to undo a PKG installation, because a package installs software but does not leave behind an uninstaller of its own.

For an ordinary app that a package dropped into the Applications folder, removing it is as simple as dragging that app to the Trash. The complication comes with packages that scatter pieces into system folders, since those parts are not obvious to find by hand. macOS does keep a record of what each package placed, called a receipt, and the pkgutil tool can read it. Running pkgutil with the pkgs option lists the identifiers of everything installed, and asking it for the files under a given identifier shows exactly what that package put on disk and where. The receipt itself can then be cleared with the forget option, which tells macOS to stop tracking that package, though it does not delete the files for you. These receipts live in a system folder that macOS maintains, and a companion command can read the same record to print the full list of paths a package laid down, which is what a careful manual removal works through.

# List the IDs of installed packages
$ pkgutil --pkgs

# See what one package placed and where
$ pkgutil --files com.example.app

# Clear the receipt (does not remove the files)
$ sudo pkgutil --forget com.example.app

Because tracing and deleting each piece by hand is fiddly and easy to get wrong, many people prefer a dedicated uninstaller app that reads the same receipts and removes everything for you. Whichever way you go, the key point is that clearing a receipt only stops the tracking, so the actual files still need removing to fully undo an install.

⚖️ PKG vs DMG

Grab an app for your Mac and the download tends to arrive as one of two things, a PKG or a DMG, and though both put software on your machine they go about it in quite different ways, so telling them apart is useful.

A PKG runs an installer. Opening it launches the macOS Installer, which follows the package's built-in instructions to place files, run setup scripts and configure the system, then finishes with the program installed. A DMG, short for disk image, is more like a virtual disk that appears on your desktop when opened. Inside a typical DMG you simply drag the application into your Applications folder to install it, with no guided steps. Put simply, a PKG does the work for you through a wizard, while a DMG hands you the app to place yourself.

Developers pick between them based on what the software needs. A straightforward app that only has to sit in the Applications folder is often shipped as a DMG, since dragging it across is all that is required. Something more involved, with background services, system-level pieces or setup that must happen in a set order, is better served by a PKG and its scripted install. Neither is better in general, they simply fit different jobs.

🪟 PKG vs MSI

If you move between Macs and Windows PCs, the clearest way to place a PKG in your mind is next to the Windows MSI, because the two play the same part on their own systems.

An MSI is Windows' own installer package, handled by the Windows Installer service, just as a PKG is the macOS installer package handled by the macOS Installer. Both bundle a program together with the instructions to set it up, both run a guided install, and both let system administrators roll software out across many machines in a controlled way. The differences are the ones you would expect from two separate platforms. A PKG is a XAR archive that runs only on macOS, while an MSI uses its own database-style format and runs only on Windows, so neither will install on the other's system. When a program is offered for both platforms, the developer simply provides a PKG for Mac users and an MSI, or an EXE, for Windows users.

🎮 Other Kinds of PKG File

The .pkg ending is not owned by macOS alone, and while the Mac installer is by far the most common meaning, a few other systems use the same three letters for their own package files.

The best known of these is on PlayStation. Sony uses .pkg for content downloaded from the PlayStation Store, such as games, add-ons and demos, in a proprietary encrypted form meant to run on a PlayStation console rather than a computer. These files are tied to Sony's hardware and often need an accompanying licence file to work, so they behave nothing like a Mac installer despite sharing the extension. The .pkg ending also appears on some Unix-style systems, notably Solaris, where it marks a software package in that world's own format. Because of this overlap, the safe first step with any .pkg is to consider where it came from, since a file from a Mac developer, the PlayStation Store and a Unix server are three unrelated things that happen to share a name.

❓ Frequently Asked Questions