Dropbox
Dropbox stores files online, keeps them in sync across devices and lets you share them with other people. It’s made by Dropbox, based in the United States.
Criminals have used its name in fake downloads or scams, so get it only from dropbox.com.
What it is
People use Dropbox to keep documents, photos and other files available across their devices. The Mac app adds a Dropbox folder to Finder and an icon to the menu bar. Files can be kept on the Mac or made online-only to save space.
The app reads and uploads files you put in Dropbox. If you enable Dropbox Backup, it also uploads the computer folders you select. It requests Keychain access to verify your account. Accessibility supports features in other apps, while Full Disk Access can help resolve syncing problems.
Dropbox supplies the Mac app through its own website. It is an established service, but fake downloads and account breaches have been reported. Files you sync or back up are stored online.
Who makes it
Dropbox is a software company founded in 2007 and based in San Francisco. Its legal name is Dropbox, Inc.. Its website is dropbox.com.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of Dropbox. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is com.getdropbox.dropbox. Download it only from dropbox.com, not from an ad or a link someone sends you.
Fakes. In September 2025, Malwarebytes reported fake GitHub download pages impersonating Dropbox and other apps to spread Atomic Stealer on Macs. The pages directed people to installation instructions that ran malicious Terminal commands.
What it connects to
In normal use, Dropbox talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
*.dropbox.com | Account access and file services. |
*.dropboxapi.com | File transfers and service requests. |
*.dropboxusercontent.com | Hosted file contents and downloads. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Accessibility | Supports the Dropbox badge in other apps, shows who has viewed files and helps prioritise syncing. |
| Full Disk Access | Dropbox recommends this when troubleshooting files that will not sync. |
| Files and Folders | Allows Dropbox Backup to access folders you choose to back up. |
Security record
Problems with Dropbox or Dropbox in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| A Lenovo sign-in verification flaw exposed about 5,000 Dropbox accounts to unauthorised access; Dropbox ended affected sessions and added a requirement to enter the Dropbox password for Lenovo sign-ins. | ↗ | |
| Attackers accessed customer details and authentication data in Dropbox Sign; Dropbox reset passwords and revoked access, and said its other products were unaffected. | ↗ |
References
- Little Snitch: Internet Access Policy developer documentation help.obdev.at
- Dropbox annual report: company history and headquarters investors.dropbox.com
- What is the Dropbox desktop app? help.dropbox.com
- Download and install the Dropbox desktop app help.dropbox.com
- Install Dropbox for Windows and Mac dropbox.com
- Dropbox Backup: an overview help.dropbox.com
- Update to the latest version of Dropbox help.dropbox.com
- Dropbox Release Notes dropbox.com
- Allow firewall and security permissions for the Dropbox desktop app help.dropbox.com
- What official domains does Dropbox use? help.dropbox.com
- How to manage Dropbox accessibility settings on Mac help.dropbox.com
- Fix Dropbox files not syncing help.dropbox.com
- Dropbox Backup FAQs help.dropbox.com
- Fake Malwarebytes, LastPass, and others on GitHub serve malware malwarebytes.com
- Dropbox accounts breached through Lenovo email verification flaw bleepingcomputer.com
- A recent security incident involving Dropbox Sign sign.dropbox.com