PKGExtractor.Private by design
HomeMACOS PKG GUIDE
MACOS PKG GUIDE

macOS PKG Extractor Guide — Inspect Without Installing

Identify an XAR container here, then inspect a macOS installer with local Mac tools. This browser does not extract installer payloads.

Reviewed October 23, 2026
Local workspace/ Package inspector
On-device processing
01 SELECT YOUR FILE
.pkg

A closer look at your PKG.

Drop a package here to read its format
and available metadata.

PKG or param.sfo · drag & drop · no uploads

Your file stays yours. Only selected byte ranges are read. Nothing is sent to a server.

02 INSPECTION RESULTS
Waiting for your file

Your package, made clearer.

Select a file to see its signature, header fields and any readable metadata.

File formatContent IDAvailable SFO fields
Source file stays unchanged No account neededHow local processing works

Identify the container first

Select your file in the inspector above. A flat macOS installer commonly uses XAR; PlayStation PKG is a different format. XAR detection confirms a container signature, not that the contents are an installer or safe to run. Only the XAR header is read here.

Inspect with the tools included in macOS

Open Terminal and use the commands below with your own paths. They inspect or expand files rather than install the application. Choose a new output directory and keep the source package. Confirm the options with pkgutil --help or man pkgutil on your Mac.

pkgutil --check-signature "/path/to/Installer.pkg"
pkgutil --payload-files "/path/to/Installer.pkg"
pkgutil --expand "/path/to/Installer.pkg" "/path/to/new-output-folder"

Replace the example paths. Check-signature reports signing information; payload-files lists archived paths; expand writes the package structure to a new directory. Expansion was checked with our own no-payload installer on macOS, not a representative payload compatibility suite.

Expand does not mean install or fully unpack

pkgutil --expand exposes the flat package structure, such as PackageInfo and archived Payload or Scripts when present. It does not mean the payload has been turned into an application folder. Payload encodings differ; this site has no browser gzip/cpio or pbzx extraction support. Do not execute extracted scripts to inspect them.

Using Windows or Linux?

The browser can identify an XAR header on these systems, but pkgutil is a macOS command. For deeper inspection, consult a tool that explicitly supports your host OS and the package’s payload encoding. The linked Go project documents macOS package handling; its compatibility with your file has not been tested here.

go-macos-pkg official documentation

If inspection fails

Check that the file is fully downloaded, the paths are correct and the output directory does not already exist. An XAR header alone cannot prove the archive is complete. A valid signature report is also not a malware assessment.

Troubleshoot a macOS PKG