If you have ever installed a disk cleaner, backup tool, or file manager on a Mac and seen a prompt asking you to grant Full Disk Access in System Settings, you may have wondered what you are actually agreeing to. The name sounds sweeping — and in a sense it is — but the reality is more nuanced. Full Disk Access is a deliberate, user-controlled macOS privacy permission designed to give you explicit say over which apps can reach the most sensitive corners of your file system. Understanding it takes less than five minutes, and it will make you a more confident, informed Mac user.
This guide covers everything you need to know: what Full Disk Access is, exactly which folders it unlocks, why disk cleaner apps like TrimyMac cannot function properly without it, how to grant it in a few clicks, whether it is safe, and how to revoke it at any time.
Full Disk Access is a macOS privacy permission, introduced in macOS Mojave (10.14), that grants a specific app the ability to read files in protected system and user locations that are ordinarily off-limits to third-party software. These protected locations include
~/Library/Caches, ~/Library/Application Support, Mail databases, Messages history, Safari browsing data, Time Machine backups, and certain system volumes. Without this permission, macOS silently blocks any read or write attempt to these paths, even if the user is an administrator.
What Full Disk Access Is — and Where It Came From
Before macOS Mojave, any app running with your user account could read virtually anything in your home folder and most system directories — with no prompts and no logging. Apple changed this in 2018 with the introduction of a new privacy model that placed explicit gates around sensitive data. Full Disk Access is the top-level key in that model: a toggle in System Settings that, when enabled for a specific app, removes those gates and gives it the same file-system reach that the app's process user account would have.
Full Disk Access is separate from the older, narrower permissions you may already be familiar with — like granting an app access to your Camera, Microphone, or Contacts. Those permissions each protect a single data type. Full Disk Access protects an entire tier of the file system: the locations macOS considers too sensitive to expose without an explicit user decision.
Critically, Full Disk Access is not granted automatically. An app cannot request it through a standard entitlement dialog the way camera access works. The user must navigate to System Settings, find the app in the list, and manually toggle it on. This friction is intentional — Apple treats Full Disk Access as a deliberate administrator decision, not a routine permission click.
What Full Disk Access Actually Unlocks
When you grant Full Disk Access to an app, you are giving it read and write capability to a specific set of paths that macOS otherwise blocks at the kernel level. Here is a complete picture of what those paths include, and why each one is protected.
~/Library/CachesApp cache files~/Library/Application SupportApp data & databases~/Library/MailApple Mail databases~/Library/MessagesiMessage & SMS history~/Library/SafariHistory, bookmarks, cache~/Library/Application Support/MobileSynciOS device backups~/Library/CookiesBrowser cookies/Volumes/ (Time Machine & external drives)Backup & external volumes/private/var/foldersSystem temp & runtime dataThe common thread across all of these paths is sensitivity or system-criticality. Your Mail database could contain private correspondence spanning years. Your Messages history is legally sensitive in some jurisdictions. Safari data reveals your browsing behaviour. iOS backups can contain a complete image of your iPhone, including health data, photos, and passwords. macOS requires explicit permission before any third-party app can touch any of these.
It is worth noting that Full Disk Access does not grant an app the ability to write to system volumes in a way that bypasses macOS's System Integrity Protection (SIP). SIP is a separate, deeper security layer that operates independently. An app with Full Disk Access can read sensitive user data and write to user-owned paths — it cannot modify macOS's own system files.
Why Disk Cleaner Apps Need Full Disk Access
The short answer: without Full Disk Access, macOS returns a permissions error any time a third-party app tries to enumerate or read one of the protected paths listed above. The app receives no files, no folder listings, and often no clear error message — just an empty result or a silent failure.
For a disk cleaner like TrimyMac, this is not a minor inconvenience. The most space-consuming junk categories on a Mac are almost all stored behind the Full Disk Access gate:
- App caches in
~/Library/Caches— typically 2 to 12 GB — are inaccessible without Full Disk Access. - iOS device backups in
~/Library/Application Support/MobileSync/Backup— often 10 to 40 GB — are blocked. - Mail attachment downloads cached inside Mail's container are unreadable.
- Browser data for Safari, including its cache directory inside
~/Library/Caches/com.apple.Safari, is protected. - App support folders for orphaned apps inside
~/Library/Application Supportare hidden from directory enumeration.
A disk cleaner that cannot read these paths is like a vacuum cleaner that cannot enter most of the rooms in your house. It may clean what little it can reach, but the largest sources of wasted space remain untouched. This is why TrimyMac — and any serious disk cleaner — prompts you to grant Full Disk Access on first launch.
How to Grant Full Disk Access to TrimyMac
Granting Full Disk Access takes about 30 seconds. The steps differ slightly between macOS Ventura and later (which use System Settings) versus older macOS versions (which used System Preferences), but the logic is the same.
-
1
Open System Settings
Click the Apple menu in the top-left corner of your screen, then select System Settings. On macOS Monterey or earlier, this is called System Preferences. TrimyMac can also open this pane for you automatically — look for the "Open System Settings" button in the app's onboarding flow or permission banner.
-
2
Navigate to Privacy & Security
In the left sidebar of System Settings, scroll down and click Privacy & Security. This is the dedicated privacy control panel for all permission types on your Mac, including Camera, Microphone, Contacts, Location, and Full Disk Access.
-
3
Click Full Disk Access
Scroll down the Privacy & Security panel until you see Full Disk Access in the list. Click on it. You will see a list of apps that have been granted or denied Full Disk Access. macOS utilities like Terminal and some Apple apps appear here by default.
-
4
Locate TrimyMac in the list
TrimyMac should appear in the list if it has already launched on your Mac. If it does not appear, click the + button at the bottom of the list, navigate to your Applications folder, select TrimyMac, and click Open. This adds it to the list.
-
5
Toggle the switch to On
Click the toggle next to TrimyMac to turn it on (it turns blue). macOS may ask you to authenticate with your administrator password or Touch ID. Once the toggle is on, the change takes effect immediately — you do not need to restart TrimyMac or your Mac, though closing and reopening TrimyMac ensures it picks up the new permission cleanly.
Is It Safe to Grant Full Disk Access?
This is the most important question, and the honest answer is: yes, for trusted apps — and no, for apps you did not intentionally install.
Full Disk Access is a powerful permission, and it should be granted only to apps that genuinely need it and that you have deliberately chosen to install from a trustworthy source. The key factors to consider:
What a trusted app can do with Full Disk Access
A trusted disk cleaner with Full Disk Access can read your cache directories to identify junk, read your iOS backup folder to report its size, and read Mail and Safari containers to find removable data. It uses this access to present you with information and options — it does not transmit your data to a server, read your private messages to mine them, or use the access for anything outside its stated purpose.
TrimyMac does not include a usage-analytics SDK, and it does not upload what Full Disk Access lets it read. File analysis stays on your Mac. The app does contact Lemon Squeezy for license checks and trimymac.com for update checks. There is no account required to scan or clean.
What to watch out for
The risk with Full Disk Access is real if you grant it to the wrong app. A malicious app with Full Disk Access could read your Mail database, copy your Safari cookies, or scan your iOS backup for credentials. This is precisely why Apple made Full Disk Access a manual, deliberate grant rather than a pop-up that any app can trigger.
Follow these principles and Full Disk Access is entirely safe to use:
- Only grant Full Disk Access to apps you intentionally downloaded from a developer you recognise.
- Download apps from the Mac App Store or the developer's official website — not from random download aggregators.
- Check that the app is code-signed and notarised by Apple — macOS will warn you if it is not.
- Periodically review the Full Disk Access list in System Settings and revoke access for apps you no longer use.
- Be especially cautious of browser extensions or apps that describe themselves as "system optimisers" — these are a common vector for adware.
What Happens in TrimyMac Without Full Disk Access
TrimyMac is designed to function gracefully whether or not Full Disk Access has been granted. However, the scan results are significantly less complete without it. Here is a category-by-category breakdown of what changes:
| Category | Without Full Disk Access | With Full Disk Access |
|---|---|---|
App Caches (~/Library/Caches) |
0 results | Full scan |
| iOS Device Backups | 0 results | Full scan |
| Mail Attachment Downloads | 0 results | Full scan |
| Orphaned App Support Folders | Partial — public paths only | Full scan |
| Safari Cache & Data | 0 results | Full scan |
| Xcode Artifacts (DerivedData) | Full scan | Full scan |
| System Logs & Crash Reports | Partial — user logs only | Full scan |
| Developer Tool Caches (npm, pip, Homebrew) | Full scan | Full scan |
| Trash | Full scan | Full scan |
| Old Downloads | Full scan | Full scan |
In practice, the categories that return zero results without Full Disk Access — app caches, iOS backups, and Mail attachments — are frequently the largest sources of recoverable space on a Mac. Users who scan without Full Disk Access often see a total of 200–500 MB when the true total, accessible after granting the permission, is 15–40 GB or more.
How to Revoke Full Disk Access
Revoking Full Disk Access is exactly as straightforward as granting it. You can do it at any time, and the change is immediate — TrimyMac will lose access to protected paths the moment the toggle is turned off. No files are affected by the revocation itself; it simply prevents TrimyMac from reading those paths in future scans.
-
1
Open System Settings
Click the Apple menu and select System Settings (or System Preferences on macOS Monterey and earlier).
-
2
Go to Privacy & Security > Full Disk Access
Navigate to Privacy & Security in the sidebar, then click Full Disk Access. You will see the same list you used to grant the permission.
-
3
Toggle TrimyMac off
Find TrimyMac in the list and click its toggle to turn it off (it returns to grey). macOS may prompt you to authenticate. The change takes effect immediately. If you want to permanently remove TrimyMac from the list, select it and click the – (minus) button.
If you later uninstall TrimyMac from your Mac using the app's built-in uninstaller, or by dragging it to Trash, its entry in the Full Disk Access list will be automatically removed by macOS when you empty the Trash. You do not need to manually remove it beforehand.
Ready to reclaim your disk space?
Download TrimyMac free — grant Full Disk Access once, and see exactly how much space your caches, backups, and junk are consuming on your Mac.
Download TrimyMac Free → macOS 14 Sonoma or later · Apple Silicon & Intel · Scan data stays localFrequently Asked Questions
Common questions about Full Disk Access on Mac — answered clearly and completely.
Is Full Disk Access safe to grant on a Mac?
Yes — provided you are granting it to an app you intentionally installed from a trusted source. Full Disk Access is a macOS-controlled permission that you enable manually in System Settings, so no app can obtain it without your explicit action. For apps like TrimyMac that are code-signed and notarised by Apple, files and scan results stay on the Mac, and TrimyMac connects only to check the license with Lemon Squeezy and to check trimymac.com for updates. Granting Full Disk Access is necessary for the app to scan protected folders. The key rule: only grant Full Disk Access to apps you downloaded directly from a developer's official website or the Mac App Store, and periodically review the list to revoke access for apps you no longer use.
Which apps need Full Disk Access on a Mac?
Apps that genuinely need Full Disk Access fall into a few clear categories. Disk cleaners and storage analysers need it to scan cache directories and application containers. Backup tools like Time Machine helpers and third-party backup software need it to read all user files. Security and antivirus apps need it to scan the entire file system for threats. Some migration assistants and file transfer utilities need it to read protected user data. Development tools like certain IDEs and terminal emulators may request it to access configuration files across user directories. In general, if an app's core function involves reading or managing files across your entire file system, Full Disk Access is legitimately required.
What can apps see with Full Disk Access?
With Full Disk Access, an app can read all files in your home directory including protected Library subfolders like ~/Library/Caches, ~/Library/Application Support, ~/Library/Mail, ~/Library/Messages, and ~/Library/Safari. It can also read iOS device backups, Time Machine backup data on connected drives, system log files in /var/log, temporary files in /private/var/folders, and data on external volumes. It cannot, however, bypass System Integrity Protection (SIP) to modify macOS system files, and it cannot access the Keychain without a separate explicit permission. The scope is broad, which is why this permission should only be given to apps you genuinely trust.
Should I give apps Full Disk Access?
The right answer depends on the app and your use case. You should grant Full Disk Access if: the app's core function requires it (disk cleaners, backup tools, security scanners), the app is from a developer with a clear public identity and a verifiable release channel, the app is code-signed and notarised by Apple, and you have reviewed its privacy policy and understand that it does not upload your data. You should not grant Full Disk Access to apps you downloaded from unverified sources, browser extensions, apps bundled with other software, or any utility whose developer you cannot identify. When in doubt, check whether the developer has a public website, GitHub repository, or Mac App Store presence before granting this level of access.
Does granting Full Disk Access affect my Mac's security?
Granting Full Disk Access to a specific, trusted app does not materially weaken your Mac's security. macOS still enforces System Integrity Protection, Gatekeeper, code-signing requirements, and sandboxing for all other apps. The Full Disk Access permission is scoped to one app at a time — granting it to TrimyMac does not give any other app wider access. Your Keychain data, FileVault encryption keys, and system files protected by SIP remain inaccessible to the app regardless. The practical security consideration is not whether Full Disk Access weakens macOS security in general, but whether the specific app you are granting it to is trustworthy — which is why using notarised apps from identified developers is the correct safeguard.
Why does TrimyMac show 0 results for App Caches without Full Disk Access?
The app cache directory at ~/Library/Caches is one of the paths that macOS protects with the Full Disk Access gate. When TrimyMac attempts to enumerate that directory without the permission, macOS returns an empty directory listing — not an error — so TrimyMac correctly reports 0 files found. This is macOS's intended behaviour: it silently hides the contents of protected paths from apps that have not been granted access, rather than showing an access-denied error that could be used to confirm the directory's existence. Granting Full Disk Access immediately makes the full cache directory visible to TrimyMac on the next scan.
Can I grant Full Disk Access temporarily and then revoke it?
Yes, absolutely. The Full Disk Access permission can be toggled on and off as many times as you like in System Settings > Privacy & Security > Full Disk Access. A reasonable approach for privacy-conscious users is to grant Full Disk Access to TrimyMac, run a scan, complete the cleanup, then revoke the permission until the next time you want to run a full scan. This limits the window during which the app has access to protected paths. TrimyMac will still function for scans that do not require Full Disk Access (Xcode artifacts, developer caches, old downloads, Trash) even when the permission is revoked.