macOS · outside the App Store
The App Store updates its own apps.
Nothing updates the rest.
Overdue finds the rest — every app in /Applications that lives outside the App Store — and ranks them by how long your copy has been sitting there. Months, not version numbers.
How it scans
Age is the only signal that survives a release cadence.
Ranked by age, not version numbers
“4.48.0 → 4.91.0” means nothing unless you already follow Docker's release cadence. “Yours is 11 months old” needs no such knowledge — and it is what actually predicts whether an update matters.
It borrows a catalogue; it doesn't own one
Homebrew maintains roughly 7,700 casks and publishes them as JSON. Owning that data is what made MacUpdater financially unsustainable — borrowing it is the only reason this is a one-person app.
Never quits an app you're using
Automatic updating is off by default. When it is on, an application you have open is never closed for you — it is reported as skipped, not failed, and left for you to update deliberately.
Measured, not estimated
of the 56 apps on the test machine get a definite answer. The script this replaced left a third of them unmatched.
to install a verified update. Verification takes 12.0s; the swap itself is 0.4s, because nothing is downloaded twice.
Homebrew casks read for free. Overdue maintains none of them and ships no version database of its own.
The update path
Nothing is replaced until seven checks pass.
Downloading 300 MB onto someone else's Mac and hoping is not a plan. Every gate runs in order and fails closed — the original bundle is untouched unless the replacement clears all seven.
Destination writable
Checked before downloading 300 MB, not after it fails.
Download
Streamed to a temporary file. The installed copy is never the destination.
Checksum
Matched against the catalogue's sha256. Casks marked no_check count as unpinned, never as verified.
Archive kind
Sniffed from magic bytes, because cask URLs routinely ship with no extension at all. A .pkg is refused rather than half-handled.
Signature
The replacement must satisfy anchor apple generic. Unsigned and ad-hoc bundles are refused — so anyone who can serve a download still cannot hand over a binary.
Identity
The download's bundle identifier must match the installed copy. The same developer is not the same app; a team ships many.
Trust
Two independent chains of trust, and a refusal that never offers a retry.
Trust policy
The naive rule is wrong on real machines.
Requiring the download to be signed by the same team as the installed copy looks correct until you meet an app that shipped unsigned. So there are two chains of trust, and a refusal that cannot change its answer.
| Installed copy | Checksum | Result |
|---|---|---|
| Signed, same team | either | Accepted |
| Signed, different team | either | Refused — the app changed hands, or was hijacked. A checksum can't tell you which, so it never offers a retry. |
| Unsigned | matched | Accepted, with a note explaining why |
| Unsigned | unpinned | Refused — nothing ties the file to anything. |
Pricing
Scan free forever. Pay once to update.
Your seven-day trial includes installs. When it ends, scanning, background checks and notifications keep running for free — one payment unlocks installing. No subscription, no account, and no activation server to go down.
Solo
€12once
1 Mac · yours forever
- Unlimited verified installs
- Every swap clears all seven checks
- Offline licence key — no account
- All 1.x updates included
Family
€19once
3 Macs · yours forever
- Unlimited verified installs
- Every swap clears all seven checks
- Offline licence key — no account
- All 1.x updates included
Pro
€29once
8 Macs · households & small teams
- Unlimited verified installs
- Every swap clears all seven checks
- Offline licence key — no account
- All 1.x updates included
Questions
What you get, and what happens after.
What happens when the seven-day trial ends?
Installing pauses. Scanning, background checks and notifications keep working for free — a licence unlocks installing again. Nothing is deleted, and your scan history stays intact.
Is scanning really free forever?
Yes. Overdue reads Homebrew's catalogue, which it neither maintains nor pays for, so a scan costs nothing to run. Only replacing an app requires a licence.
Does it need my admin password?
No. There is no privileged helper. If /Applications isn't writable by your account the update is refused with a clear message rather than escalating — and a .pkg installer is handed off, never run for you.
Will it quit the apps I'm using?
Not on its own. Automatic updating is off by default; when it's on, an application you have open is skipped — never force-quit — and left for you to update deliberately.
Do I need an account, or a connection to activate?
Neither. Licence keys are Ed25519-signed and verified on your Mac. There is no account and no activation server, so a key works with the network unplugged.
What if an update fails?
Overdue fails closed: your installed copy is untouched unless the replacement clears every one of the seven checks. A transient failure offers a retry; a signature mismatch never does.
What about the next major version?
Your licence covers every 1.x update. A future major version would be a separate paid upgrade — never a subscription added retroactively.
Which Macs does it support?
macOS 14 Sonoma or later, on Apple silicon and Intel. It's a small native app with no kernel extension and no background helper.
Find out which of your apps went quiet.
Seven days free, installs included. After that, scanning stays free and one payment unlocks updating — €12, €19 or €29, yours forever. No subscription, no account, and no activation server to go down.
Get Overdue