macOS

The gate that makes macOS clients honest

macOS gives VPN apps a framework, not raw packet access - every client is a Network Extension configuration, and the OS enforces what it declares[6]. The result is the most uniform VPN platform in consumer computing: 66 providers here, differentiated by documentation and provisioning depth rather than by architecture heroics.

The distribution split: App Store versus Developer ID

The two macOS app shapes differ more than their icons. App Store builds live in the sandbox - tighter, but with limits that push some providers' kill switches toward app-level enforcement. Developer-ID builds ship a notarized system extension with the full Network Extension surface, which is where the strongest tunnels live[6]. The provider pages note which shape their macOS client uses; when a provider ships only the App Store variant, its "kill switch" claim deserves one extra question about what the sandbox allows.

The Apple-service bypass, stated once

Some Apple connectivity traffic routes outside third-party tunnels by design - the iOS evidence applies to the same Darwin plumbing[1]3. For privacy purposes it is small and bounded; for censorship resistance it is a real, if minor, phoning-home path worth knowing before you cross a border. Operators who document it (the Apple-platform disclosure pattern again[2][5]) are the ones whose macOS clients we weight up - silence about platform exceptions is a disclosure failure, not a neutral fact.

Where Private Relay fits, briefly

Apple's two-hop Relay covers Safari and Mail inside the ecosystem[2] - free, honest about its scope, and not a VPN. The productive framing: Relay handles the browsing layer for casual users, a full VPN handles everything else, and the two coexist badly (Relay plus a third-party tunnel double-proxy Safari traffic). Choose per threat: Apple-ecosystem privacy for free, or the independent hub's operators for whole-system coverage. Either way, the check date on each review matters more here than on any other platform - Apple ships behavior changes to both layers every fall.

The testing ritual that macOS deserves

macOS tunnels die in four places: before the app starts at boot, at sleep-wake, on network change, and when a system update invalidates the extension's provisioning[3][4]. Each is testable with the leak test checklist[6]. The Apple-service bypass notes belong in the same ritual[1][2]. The platform's local-attack exposure is lower than Windows's (TunnelVision's DHCP class lands harder on Windows[4]), which makes macOS the easier platform to secure - and the easier one to grow complacent about. The account layer follows the same rules as everywhere: the no-kyc hub maps what the install anchors to.