Permissions
WideSplit needs three permissions, and it needs all three for every layout. Without them it does not split the screen at all — there is no reduced mode that works with some of them. Every sentence on this page describes something you can check on your own Mac: the entries in System Settings, the processes in Activity Monitor, and — with the public tools described on the Verify page — what the running binary actually does: what its event taps listen to, which programs contain network code, what the entitlements say.
1. The three permissions
| Entry in System Settings | List | What it is for |
|---|---|---|
| WideSplit Compositor | Accessibility | keeps the pointer on the screens you see |
| WideSplit Windows | Accessibility | reads and moves window frames |
| WideSplit | Screen Recording | draws the screens WideSplit creates onto your monitor |
| — | Input Monitoring | never asked for |
The setup guide asks for them one at a time, in this order: the two Accessibility entries, then Screen Recording. Splitting starts only once all three are on. If you switch off the Compositor’s Accessibility while the screen is split, the split ends within about a second and your monitor goes back to full screen.
2. Accessibility — WideSplit Compositor
What we do: keep the pointer on the screens WideSplit shows you, so it never disappears into the covered area of the monitor, and move a window that ends up there back onto one of your screens. During setup, right after the guide opens a System Settings privacy list, the compositor scrolls that list to the WideSplit row, so you do not have to look for it. To find the row it reads, in memory, the names macOS gives the switches of that list — nothing is stored or sent — and it only moves the scroll position: never a switch, and not while you hold a mouse button.
What we never do: listen to the keyboard. Our event tap is subscribed to mouse events only — move, drag, buttons, wheel. Shortcuts go through the system hotkey API, which does not see any other key.
How to revoke: System Settings → Privacy & Security → Accessibility, switch off WideSplit Compositor — or use “Revoke permissions & uninstall…” in the WideSplit menu.
3. Accessibility — WideSplit Windows
What we do: read and move window frames, and read window titles to tell windows apart — put your windows back where they were when the split changes, and make room when you drag a window onto a screen that shows a full-screen app. The window shortcuts are off until you turn them on in Settings.
What we never do: read what a window contains. We see its position, size and title, not its content. This bundle’s event tap is subscribed to mouse events only, like the Compositor’s.
How to revoke: System Settings → Privacy & Security → Accessibility, switch off WideSplit Windows — or use “Revoke permissions & uninstall…” in the WideSplit menu.
4. Screen Recording — WideSplit
What we do: capture the screens WideSplit creates itself and draw them onto your physical monitor. Frames live in memory and on the GPU. We also read window titles, on your Mac only, to recognise a player showing protected video; titles can appear in WideSplit’s local log files and never leave the machine.
What we never do: write a frame to disk or send one over the network. The only saved image is the diagnostic screenshot you ask for by hand, to a path you choose.
How to revoke: System Settings → Privacy & Security → Screen Recording, switch off WideSplit — or use “Revoke permissions & uninstall…” in the WideSplit menu.
When you turn this permission on, macOS asks you to quit and reopen WideSplit; the guide continues where it stopped. macOS Sequoia and later also ask every application that uses screen capture to confirm this permission again about once a month, and on macOS 26 the same prompt can appear right after you first allow it — choose Allow. These prompts come from macOS, not from WideSplit.
5. Input Monitoring
What we do: nothing. WideSplit never asks for Input Monitoring.
What we never do: read your keystrokes — not with this permission and not with any other.
How to revoke: nothing to revoke; WideSplit never appears in that list.
6. Network
During the beta WideSplit talks to our website only: widesplit.app, and displaymode.pages.dev — the website’s earlier address, which forwards to widesplit.app and which the update feed still names for downloads. The menu checks for an update once a day and downloads one only after you click. Beta builds check only the end date built into them, on your Mac, and contact no licence server; the released version will add one host for the licence, named here when it exists. Nothing else leaves your Mac — no telemetry, no analytics. Frames, window titles and settings never leave the machine.
7. Signature, hardened runtime, uninstall
- Every build is signed with no entitlement exceptions: no
disable-library-validation, noallow-jit, noallow-dyld-environment-variables. Release builds add the hardened runtime, and with it nothing can be injected into a WideSplit process to borrow its permissions. Beta builds carry our local certificate and do not have the hardened runtime yet;codesign -dvtells you which one you hold. - “Revoke permissions & uninstall…” in the menu asks macOS to drop the Screen Recording and Accessibility entries, reads the result back and tells you which ones macOS kept — those you switch off yourself in System Settings, one click each. It deletes settings and logs, turns the login item off and moves WideSplit to the Trash. Nothing else was installed to remove: no launch agents, no daemons, no kernel or system extensions. The one addition is that login item, so the menu bar icon is there after you restart — switch it off in WideSplit’s settings or in System Settings → General → Login Items. macOS keeps the switched-off row in its own list; removing that row is one click in the same place.
- The certificate and the update key of every build published in the update channel are in its release manifest, so a change is visible the moment it happens — it cannot be made quietly.
8. Verify your copy
Two things can be checked separately: that the copy is the one we published (this section) and that the program does what this page says — the event tap masks, the absence of network code in the renderer, the empty entitlements. The second is the Verify page.
Anyone can check that the WideSplit on their Mac is the one we published. Two commands read the signature macOS itself checks; a third compares the download with the published checksum. Every build published in the update channel has a manifest with the values to compare against — the archive’s SHA-256, the SHA-256 of every executable inside the bundle, the bundle identifiers and the Team ID. The manifests are kept in version control, so the history of checksums is itself the proof that no binary was swapped after a release.
APP=$(ls -d /Applications/WideSplit.app /Applications/DisplayMode.app 2>/dev/null | head -1)The first line finds the app under whichever name your copy carries: builds from the beta onwards are called WideSplit, earlier ones DisplayMode. Every command below uses it, so you can paste them as they are.
The signature
codesign -dv --verbose=4 "$APP"A correct release copy prints, among other lines:
Identifier=pl.displaymode.menu
Format=app bundle with Mach-O thin (arm64)
CodeDirectory v=20400 size=… flags=0x10000(runtime) hashes=… location=embedded
Authority=Developer ID Application: <legal name> (<TEAMID>)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=<date of the release build>
TeamIdentifier=<TEAMID>Compare Identifier, TeamIdentifier and the three Authority lines with the release manifest. flags=0x10000(runtime) is the hardened runtime. The same command on /Applications/WideSplit.app/Contents/Helpers/WideSplit Compositor.app must show pl.displaymode.compositor with the same Team ID, and on …/WideSplit Windows.app pl.displaymode.windowlayout. The pl.displaymode identifiers are the project’s internal name and the one thing the rename to WideSplit deliberately left alone: macOS books a permission against an identifier, so changing it would cost every user the permissions they have already given.
Gatekeeper and notarization
spctl -a -vv "$APP"A correct release copy prints:
/Applications/WideSplit.app: accepted # older copies print DisplayMode.app here
source=Notarized Developer ID
origin=Developer ID Application: <legal name> (<TEAMID>)rejected, or an origin that is not our Developer ID, means the copy is not a release build — delete it and download again from this site.
The download
shasum -a 256 ~/Downloads/WideSplit-<version>.dmgThe value must equal the archive checksum in the manifest of that version. To go one level deeper, hash every executable in the installed bundle and compare with the list in the manifest:
find "$APP" -type f -perm -u+x -exec shasum -a 256 {} +Every build we publish is signed with our Developer ID (Team ID GRQHFN53XX) and notarised by Apple, so Gatekeeper reports it as accepted with source=Notarized Developer ID, also without a network connection. Early test builds were signed with a local certificate (“DisplayMode Local”, no Team ID); they are not published, and the Releases page lists only notarised builds.