Where was a file downloaded from on Mac? How to check the source of any download

By Sidhant Sinha, maker of FindGlance · Published October 21, 2026 · 13 min read

When a browser or app downloads a file, macOS usually stores the web address it came from on the file itself. That record survives renaming and moving the file, so weeks later you can still check whether an invoice came from Gmail, a script from GitHub or an image from ChatGPT.

This guide covers every reliable way to read that record, from a single file in Finder to a list of everything you ever downloaded from one site, plus what to do when the record is missing and how to remove it before you share a file.

• The download source is a Spotlight metadata attribute called kMDItemWhereFroms, stored on the file as an extended attribute.
• Finder shows it under Get Info › More Info › Where from. There are often two URLs: the file’s own address and the page you clicked it on.
• Finder searches and the mdfind command can list every file downloaded from one site, such as mail.google.com.
• Not every app writes the attribute, and some copy and zip methods drop it.
• You can delete it with xattr -d com.apple.metadata:kMDItemWhereFroms "file" before sharing a file.

What is the “Where from” information on a Mac?

“Where from” is the label Finder gives to the kMDItemWhereFroms metadata attribute, a list of one or more web addresses that records where a downloaded file came from. The browser or app that saves the download writes it; macOS does not work it out later.

The value lives in an extended attribute named com.apple.metadata:kMDItemWhereFroms. An extended attribute is a small piece of named data the file system keeps alongside a file, outside its contents. Opening or editing the file doesn’t show it, but Finder, Spotlight and Terminal tools can read it. The data is a binary property list (Apple’s compact plist format) holding an array of text strings, as Eclectic Light’s reference on kMDItemWhereFroms describes.

Why are there often two URLs?

Browsers usually save two addresses: first the direct address of the file itself, then the page you were on when you started the download (the referrer). A Gmail attachment, for example, typically shows a mail-attachment.googleusercontent.com address followed by https://mail.google.com/…. The first URL tells you which server sent the bytes. The second tells you where you were, which is usually the more useful clue. Some downloads have only one URL, for example when there was no referring page.

Is it the same as the quarantine flag?

No. A downloaded file usually also has a separate com.apple.quarantine attribute, which tells Gatekeeper that the file came from outside your Mac. It holds a timestamp, the name of the app that downloaded the file (such as Chrome) and an event ID, but not the URL. The two attributes are often present together, and removing one doesn’t remove the other.

How do I see where a file was downloaded from in Finder?

Finder’s Get Info window shows the download source of a single file in the Where from row of its More Info section. This is the quickest method and needs no Terminal.

1. Select the file in a Finder window or on the desktop.
2. Choose File › Get Info or press ⌘I, as described in Apple’s guide to getting file information on Mac.
3. Click the disclosure arrow next to More Info to expand it.
4. Read the Where from line. If it shows two addresses, the second one is usually the page you downloaded from.

If there is no Where from line, either the app that saved the file didn’t record a source or the attribute was lost along the way (see why “Where from” is missing). Finder relies on Spotlight for this field, so a file in a folder that Spotlight doesn’t index may show nothing even when the attribute is there. The xattr method below reads the file directly.

How do I check a file’s download source in Terminal?

The mdls command prints the Where from URLs of any file that Spotlight has indexed, and xattr reads the raw attribute from any file, indexed or not. Open Terminal from Applications › Utilities, type the command, then drag the file into the window to paste its path.

Read it with mdls

mdls -name kMDItemWhereFroms ~/Downloads/invoice.pdf

The output is a list in parentheses:

kMDItemWhereFroms = (
    "https://mail-attachment.googleusercontent.com/…",
    "https://mail.google.com/…"
)

Add -raw (mdls -raw -name kMDItemWhereFroms "file") to print only the list without the attribute name. If mdls prints (null), Spotlight either has no source for the file or doesn’t index its location. In testing, a file copied into /private/tmp showed (null) in mdls while xattr still found the URLs.

Read it with xattr

List a file’s extended attributes first:

xattr ~/Downloads/invoice.pdf

If com.apple.metadata:kMDItemWhereFroms appears in the list, print it. Because the value is a binary plist, xattr -p alone shows the URLs mixed with stray characters. This pipeline prints it cleanly: -x outputs hex, xxd -r -p turns the hex back into bytes, and plutil -p - prints the plist in readable form.

xattr -px com.apple.metadata:kMDItemWhereFroms ~/Downloads/invoice.pdf | xxd -r -p | plutil -p -

The result looks like this:

[
  0 => "https://mail-attachment.googleusercontent.com/…"
  1 => "https://mail.google.com/…"
]

xattr -l "file" shows every attribute at once, but binary values come out as a hex dump, so the pipeline above is easier to read.

How do I find all files downloaded from one website?

You can find every file downloaded from a website by searching the Where from attribute for part of the site’s address, either in a Finder search window or with the mdfind command. Both use the Spotlight index, so they only see folders that Spotlight indexes.

In Finder

1. In Finder, choose File › Find or press ⌘F.
2. Next to Search, click This Mac (or keep the current folder, such as Downloads, to narrow it).
3. Click the first pop-up menu in the criteria row (it usually says Kind) and choose Other….
4. Type “where” in the attribute list’s search field, select Where from, tick its checkbox if you want it in the menu next time, and click OK.
5. Set the next pop-up to contains and type part of the address, such as mail.google.com or chatgpt.com.
6. To add more conditions, such as Kind is PDF, click the + button. To keep the search, click Save to make a Smart Folder that updates by itself.

Apple documents the Other attribute list in its guide to narrowing search results on Mac. Typing http instead of a domain lists every file that has any recorded web source.

In Terminal with mdfind

mdfind runs a Spotlight query from the command line. The * wildcards match any text before and after the domain, and the match succeeds if either URL in the list contains it:

mdfind 'kMDItemWhereFroms == "*mail.google.com*"'

Useful variations:

• Limit to one folder: mdfind -onlyin ~/Downloads 'kMDItemWhereFroms == "*chatgpt.com*"'
• Just count matches: mdfind -count 'kMDItemWhereFroms == "*github*"'
• Ignore case: add c after the closing quote, as in "*Slack.com*"c
• Combine with a file type: mdfind 'kMDItemWhereFroms == "*mail.google.com*" && kMDItemContentType == "com.adobe.pdf"' finds PDFs from Gmail
• Every file with any source: mdfind 'kMDItemWhereFroms == "*"'

Search terms that usually match common sources:

List the source of every download

This short loop prints each file in Downloads that has a source, followed by its URLs:

mdfind -onlyin ~/Downloads 'kMDItemWhereFroms == "*"' | while IFS= read -r f; do
    echo "$f"
    mdls -raw -name kMDItemWhereFroms "$f"
    echo
done

To see which sites you download from most, count the last URL of each file by site:

mdfind -onlyin ~/Downloads 'kMDItemWhereFroms == "*"' | while IFS= read -r f; do
    mdls -raw -name kMDItemWhereFroms "$f" | grep -oE 'https?://[^/"]+' | tail -n 1
done | sort | uniq -c | sort -rn | head -20

If mdfind returns nothing for files you know are there, the Spotlight index may be stale. The guide to fixing Spotlight when it can’t find files covers checking and rebuilding it.

Can the quarantine events database show my download history?

The quarantine events database is a SQLite file at ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 where macOS logs downloads that get the quarantine flag: when each happened, which app did it and, sometimes, the URLs. It can help when a file has been deleted or has lost its Where from attribute.

This read-only query lists the 20 most recent entries with readable dates. The timestamps count seconds from January 1, 2001, so the query adds 978307200 seconds to convert them to Unix time:

sqlite3 -readonly ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 \
"SELECT datetime(LSQuarantineTimeStamp + 978307200, 'unixepoch', 'localtime'),
        LSQuarantineAgentName, LSQuarantineDataURLString, LSQuarantineOriginURLString
 FROM LSQuarantineEvent ORDER BY LSQuarantineTimeStamp DESC LIMIT 20;"

To match a file to its entry, read its quarantine attribute with xattr -p com.apple.quarantine "file". The fourth field, separated by semicolons, is the event ID, which matches the LSQuarantineEventIdentifier column.

For a recently deleted file, your browser’s own download history is often the better record. In Chrome, for example, the downloads page lists each file with the address it came from.

Which method should you use?

For one file, use Get Info. For many files or a single site, use a Finder search or mdfind. Use xattr when Spotlight can’t help.

Why is “Where from” missing or empty?

The Where from attribute is missing when the app that saved the file never wrote it, or when the file passed through a step that strips extended attributes. A file with no Where from was not necessarily made on your Mac.

Tests on a Mac running recent macOS showed these patterns:

• Browsers usually write it. Most files downloaded with Chrome and Edge had it, though some Chrome downloads did not; Safari has recorded it for many years. Files from the Microsoft Teams app also had it.
• Some apps don’t. Files saved from the WhatsApp desktop app, the Claude desktop app and the LocalSend file-transfer app had a quarantine flag but no Where from. Downloads made through a website in a browser are the ones most likely to have a source. For the others, the quarantine flag still names the app that saved the file: xattr -p com.apple.quarantine "file" prints something like 0087;68e793ba;WhatsApp;, where the third field is the app.
• Command-line downloads don’t. A file fetched with curl had neither a Where from nor a quarantine flag.
• Plain copying keeps it. Finder copies and the cp command preserve it. cp -X deliberately drops extended attributes.
• Zipping depends on the tool. Finder’s Compress stores extended attributes in a hidden __MACOSX folder, and Archive Utility restores them when you open the zip on a Mac. The command-line zip and unzip tools drop them, and so does opening the archive on Windows.
• Files inside downloaded archives can inherit it. In testing, files that Archive Utility extracted from a downloaded zip carried the zip’s Where from.
• External drives keep it on a Mac. On an exFAT or FAT drive, macOS stores the attribute in a hidden ._ file next to the original, which another Mac reads but Windows ignores.
• Uploading drops it. Uploading a file to a website or attaching it to an email sends only the file’s contents, so the copy someone downloads gets a new Where from pointing at your upload.

AirDrop, iCloud Drive and other sync services were not tested for this guide. If it matters, check the received file with xattr.

Does the download source travel with a file when you share it?

The Where from URLs travel with a file whenever it is copied in a way that keeps extended attributes: Finder copies, Compress archives opened on another Mac, and Mac-formatted or exFAT drives used between Macs. Uploads and email attachments don’t carry it.

That matters because the URLs can be revealing. They can include account-specific IDs, share-link tokens, internal company addresses or the name of a private page. Before handing someone a file on a drive or in a zip, it is worth removing them.

How to remove Where from metadata

1. Check which attributes the file has: xattr "file".
2. Delete the source: xattr -d com.apple.metadata:kMDItemWhereFroms "file"
3. For every file inside a folder, add -r: xattr -dr com.apple.metadata:kMDItemWhereFroms "folder"
4. Run xattr "file" again to confirm it’s gone.

To make a clean copy instead of changing the original, use cp -X original copy, which copies the contents without any extended attributes. Finder’s Get Info window may keep showing the old value for a while after removal, until Spotlight and Finder catch up.

How can the download source help you spot a suspicious file?

Checking the Where from URL before you open an unexpected file tells you whether it really came from the site you think it did. A PDF “invoice” whose source is an unfamiliar domain, or an installer that came from a file-sharing site rather than the developer’s own site, deserves caution.

1. Select the file and press ⌘I before opening it.
2. Compare both Where from URLs with the sender or company you expect. Look at the domain itself, not just a familiar word in the path.
3. If the file has no source at all and you don’t remember saving it, find out how it arrived before you open it.
4. For apps, let Gatekeeper do its job. Apple explains the first-launch warning and when to use Open Anyway in Safely open apps on your Mac.

The Where from attribute is a clue, not proof. Any app can write it, and some legitimate downloads come from content delivery networks with unfamiliar names. Use it alongside the sender, the file type and common sense.

How do I see download sources for all my files at once?

FindGlance is a native Mac app for finding and tidying files that shows images, videos, documents and other files as large thumbnails, and its Downloaded From view groups your files by the site they were downloaded from. It reads the same Where from metadata covered above, so no Terminal commands are needed.

We built FindGlance because checking sources one Get Info window at a time doesn’t scale. Here’s what it does with download sources:

• Downloaded From (⇧⌘J) groups files by source: Gmail, ChatGPT, WhatsApp, Slack, Google Drive, GitHub, Figma, Teams and any other website.
• Group By Downloaded From in View Options (⌘J) applies the same grouping to the page you’re looking at, alongside Kind, Date and Size.
• Plain-English search understands queries like “invoice from gmail” or “photos from whatsapp” and shows how it read them as adjustable filter chips.
• Every feature is free for 7 days, with no card or email; after that, FindGlance Pro is a one-time purchase.
• Everything runs on your Mac. File names, contents and URLs are never uploaded.

When a file has no Where from, FindGlance reads the app name from its quarantine flag instead, so files saved by the WhatsApp, Microsoft Teams, Claude and LocalSend desktop apps still appear under their source. Files with neither, such as ones made with curl or copied from a drive, have no source to show. FindGlance also only looks in folders you allow in its settings. FindGlance works alongside Finder rather than replacing it, and Show in Finder (⌥⌘R) takes you to any file.

Grouping by source also helps with cleanup. Old Gmail attachments and ChatGPT images pile up quickly; see how to free up storage on a Mac and find duplicate files when the same attachment was saved three times. You can download FindGlance for macOS 14 Sonoma or later and compare options on the pricing section; Pro is a one-time purchase, not a subscription.

Frequently asked questions