Both builds are safe - Stow only ever reads your cards, it never writes to them. Because the apps are not code-signed yet, macOS and Windows show a one-time caution the first time you open them. Clearing it takes under a minute, and it only happens once per machine. Signed builds are on the way, which will remove these steps entirely.
M1, M2, M3 or M4. Intel Macs are not supported by this build.
- Download Stow for macOS (the
.dmg), double-click it, then drag Stow into your Applications folder. - The first time you open it, macOS may say Stow "is damaged and can't be opened". It is not damaged - this only means the app is not signed by Apple yet.
- Open the Terminal app (press Cmd + Space, type Terminal, press Return), then paste and run this line:
xattr -cr /Applications/Stow.appNothing visible happens, and that is correct. Now open Stow from Applications - it opens normally from here on.
The older "right-click, then Open" trick does not clear the "damaged" message. The Terminal line above is the one that clears it. All it does is remove the "downloaded from the internet" flag macOS adds to unsigned apps.
Whole card refuses to copy with "Operation not permitted (os error 1)"? On some Macs the unsigned build never receives the normal permission prompt for removable volumes, so macOS quietly blocks reading the card as a whole while individual folders still work. The fix: open System Settings → Privacy & Security → Full Disk Access, switch Stow on, then run the copy again. Thanks to John in the Newsshooter comments for confirming this. Signed builds will request permission properly and remove this step.
- Download Stow for Windows (the
.exe) and double-click it. It installs just for you - no admin password needed. - Windows SmartScreen may show a blue "Windows protected your PC" box. This is normal for new, unsigned apps.
- Click More info, then Run anyway. Stow installs and opens, and this step will not appear again.
Why the warnings?
Mac and Windows both flag apps from developers they have not yet verified. Verifying means buying a signing certificate that tells the operating system the app is from a known source. We are adding that for both platforms next; until then, the one-time steps above are all it takes.