You find statement_final.pdf in Downloads and have no idea whether it came from your bank, an email, or a chat. Or an installer sits on your Desktop and you want to be sure it came from the developer’s real site. On a Mac, the answer is usually already stored with the file. macOS saves a small amount of metadata when a browser or messaging app downloads something, and you can read it in a few seconds.

Method 1: Get Info in Finder

The quickest way, no Terminal needed:

Select the file in Finder.
Choose File ▸ Get Info, or press ⌘I.
Expand the More Info section.
Look for Where from.

For a file downloaded in a browser you will usually see one or two addresses: the direct link to the file, and often the page you were on when you clicked it. The second one is frequently the more useful, because download links tend to point at long, anonymous storage URLs while the page shows you which site it really was.

Method 2: Terminal with `mdls`

Get Info shows the same data Spotlight keeps in an attribute called kMDItemWhereFroms. To read it in Terminal:

mdls -name kMDItemWhereFroms ~/Downloads/statement_final.pdf

The output looks like this (an installer downloaded from a developer’s site):

kMDItemWhereFroms = (
    "https://downloads.example.com/releases/app-5.1.dmg",
    "https://example.com/download"
)

If it says (null), Spotlight has no source recorded for that file. That doesn’t always mean there is none; try the next method.

Method 3: read the extended attributes directly

The source is stored with the file itself as an extended attribute, so it survives even if Spotlight indexing is off. List a file’s extended attributes with:

xattr ~/Downloads/statement_final.pdf

You will typically see names like com.apple.metadata:kMDItemWhereFroms and com.apple.quarantine. The first holds the source addresses as a small binary property list. To print it in readable form:

xattr -px com.apple.metadata:kMDItemWhereFroms ~/Downloads/statement_final.pdf \
  | xxd -r -p | plutil -p -

xattr -px prints the value as hex, xxd -r -p turns it back into bytes, and plutil -p pretty-prints the property list.

Which app downloaded it: the quarantine attribute

The second attribute answers a different question: which app saved the file. macOS adds com.apple.quarantine to files that come from the internet, so Gatekeeper can check them the first time you open them. Read it with:

xattr -p com.apple.quarantine ~/Downloads/statement_final.pdf

The result is a few values separated by semicolons, for example:

0381;6af4fda4;Firefox;90F10793-E6BD-4849-AAF6-7F94A2AADA11

The third value is the app that saved the file: here Firefox, but you will also see Safari, Google Chrome, Slack, Mail, Messages and others. The second value is a timestamp in hexadecimal. To turn it into a date:

date -r $((16#6af4fda4))

This is useful when the Where from field is empty: a file from Messages or Mail may have no web address, but the quarantine attribute still tells you which app it came through.

Search by source

Because Spotlight indexes kMDItemWhereFroms, you can search by it. To list everything you downloaded from a particular site:

mdfind "kMDItemWhereFroms == '*github.com*'"

Limit it to one folder with -onlyin ~/Downloads. Add c after the closing quote, as in '*GitHub*'c, to ignore upper and lower case. This is a handy way to gather every invoice from one supplier’s portal, or every file a particular site gave you.

In Finder you can do the same with a Smart Folder: File ▸ New Smart Folder, click +, choose Other… from the attribute menu, enable Where from, and set it to contains the site name.

When there is no source information

Not every file has a recorded source. Common reasons:

It didn’t come from the internet. Files you created, exported or copied from a USB drive have no Where from.
The app didn’t record it. Browsers generally do; some apps and command-line tools such as curl don’t.
It was copied in a way that dropped extended attributes. Some cloud services, archive tools and file systems don’t keep them. A file that went through a zip and back, or through a drive formatted for Windows, may lose them.
Someone removed them. Running xattr -c on a file clears all its extended attributes, including the source.

In those cases, try the file’s dates (Get Info shows when it was created and modified) and search your email or chat apps for the file name.

A quick safety check for installers

Knowing where an installer came from is a good habit, and the source address helps you spot fakes:

Check Where from in Get Info. The page address should be the developer’s real domain, not a lookalike or a download portal you don’t recognise.
When you open the app, Gatekeeper uses the quarantine attribute to check it. Read the dialog rather than clicking through it.
If anything looks off, delete the file and download it again from the developer’s own site.

Avoid removing the quarantine attribute from apps to skip Gatekeeper’s check unless you know exactly what you are running.

Seeing sources for many files at once

Get Info and Terminal work one file at a time. If you want an overview of where everything in Downloads came from, a few apps can read this metadata in bulk.

Bowerbird, our Finder companion, uses the same kMDItemWhereFroms and quarantine information described above. It groups your files under Sources by where they came from, recognising common ones such as Slack, WhatsApp, GitHub, Figma, Dropbox, Mail and AirDrop, and its inspector shows the original addresses, the download date and which browser saved the file. You can also search with phrases like "images from slack" or "pdfs from github last month". Everything is read locally on your Mac.

Whichever way you look, the information is usually there. It just isn’t shown unless you ask for it.

downloads
finder
terminal
security