Permissions
DisplayMode has three engines, and each asks only for what its layout needs. A one-zone layout asks for nothing. Every sentence on this page describes something you can check on your own Mac: the entries in System Settings, the processes in Activity Monitor, and — with the public tools described on the Verify page — what the running binary actually does: what its event taps listen to, which programs contain network code, what the entitlements say.
1. What each engine asks for
| Engine | Screen Recording | Accessibility | Input Monitoring | Network |
|---|---|---|---|---|
| mirror (one-zone layout) | — | — | — | — |
| zones without capture | — | yes | — | — |
| virtual-display compositor | yes | yes | — | — |
| window manager (separate bundle) | — | yes | — | — |
| licence | — | — | — | one host |
| updates (Sparkle 2) | — | — | — | second host: feed and download |
The compositor and the window manager are two separate bundles with two separate entries in System Settings: DisplayMode Compositor (Screen Recording + Accessibility) and DisplayMode WindowLayout (Accessibility only). You can revoke one and keep the other. The menu bar app itself never asks for anything.
2. Screen Recording
What we do: we stream the virtual displays we create ourselves and draw them onto your physical monitor. Frames live in memory and on the GPU.
What we never do: write a frame to disk or send one over the network. The only saved image is the diagnostic screenshot you ask for by hand, to a path you choose.
How to revoke: System Settings → Privacy & Security → Screen Recording, switch off DisplayMode Compositor — or use “Revoke permissions & uninstall…” in the DisplayMode menu.
macOS Sequoia and later ask every application that uses ScreenCaptureKit to confirm this permission again about once a month. That prompt is generated by macOS for every such app, not by anything DisplayMode does.
3. Accessibility
What we do: keep the cursor out of the invisible area between desktops, and let the window manager read and move window frames.
What we never do: listen to the keyboard. Our event tap is subscribed to mouse events only — move, drag, buttons, wheel. Shortcuts go through the system hotkey API, which does not see any other key.
How to revoke: System Settings → Privacy & Security → Accessibility, switch off DisplayMode Compositor and DisplayMode WindowLayout — or use “Revoke permissions & uninstall…” in the DisplayMode menu.
4. Input Monitoring
What we do: nothing. DisplayMode never asks for Input Monitoring.
What we never do: read your keystrokes — not with this permission and not with any other.
How to revoke: nothing to revoke; DisplayMode never appears in that list.
5. Network
The licence tool connects to one host. The menu connects to a second host once a day to check for an update, and downloads one only after you click. Nothing else leaves your Mac — no telemetry, no analytics. If you run a firewall such as Little Snitch or LuLu, those two hosts are the complete list. Frames, window titles and settings never leave the machine.
6. Signature, hardened runtime, uninstall
- Every build is signed with a hardened runtime and no exceptions: no
disable-library-validation, noallow-jit, noallow-dyld-environment-variables. Nothing can be injected into a DisplayMode process to borrow its permissions. - “Revoke permissions & uninstall…” in the menu removes the Screen Recording and Accessibility entries, deletes settings and logs, and moves DisplayMode to the Trash. No launch agents, login items or background services are ever installed, so there is nothing left behind to find.
- If the signing certificate or the update key ever changes, we announce it here at least 30 days in advance. It will never change quietly.
7. Verify your copy
Two things can be checked separately: that the copy is the one we published (this section) and that the program does what this page says — the event tap masks, the absence of network code in the renderer, the empty entitlements. The second is the Verify page.
Anyone can check that the DisplayMode on their Mac is the one we published. Two commands read the signature macOS itself checks; a third compares the download with the published checksum. Every release has a manifest with the values to compare against — the archive’s SHA-256, the SHA-256 of every executable inside the bundle, the bundle identifiers and the Team ID. The manifests are kept in version control, so the history of checksums is itself the proof that no binary was swapped after a release.
The signature
codesign -dv --verbose=4 "/Applications/DisplayMode.app"A correct release copy prints, among other lines:
Identifier=pl.displaymode.menu
Format=app bundle with Mach-O thin (arm64)
CodeDirectory v=20400 size=… flags=0x10000(runtime) hashes=… location=embedded
Authority=Developer ID Application: <legal name> (<TEAMID>)
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Timestamp=<date of the release build>
TeamIdentifier=<TEAMID>Compare Identifier, TeamIdentifier and the three Authority lines with the release manifest. flags=0x10000(runtime) is the hardened runtime. The same command on /Applications/DisplayMode.app/Contents/Helpers/DisplayMode Compositor.app must show pl.displaymode.compositor with the same Team ID, and on …/DisplayMode WindowLayout.app pl.displaymode.windowlayout.
Gatekeeper and notarization
spctl -a -vv "/Applications/DisplayMode.app"A correct release copy prints:
/Applications/DisplayMode.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: <legal name> (<TEAMID>)rejected, or an origin that is not our Developer ID, means the copy is not a release build — delete it and download again from this site.
The download
shasum -a 256 ~/Downloads/DisplayMode-<version>.dmgThe value must equal the archive checksum in the manifest of that version. To go one level deeper, hash every executable in the installed bundle and compare with the list in the manifest:
find "/Applications/DisplayMode.app" -type f -perm -u+x -exec shasum -a 256 {} +Until the first Developer ID release, builds handed to testers are signed with a local certificate (“DisplayMode Local”, no Team ID) and Gatekeeper reports them as rejected. Their manifests say so — developerId: false — and are published for the same reason: what you got is what we recorded.