How do you install Python on macOS without breaking your system?

To install Python on macOS, download the current installer package from python.org, check its checksum or signature, run it, then run the Install Certificates command. Leave the Apple-provided python3 in /usr/bin untouched. Create a virtual environment for each project so packages never land in the system install.

Why not use the Python that already came with the Mac?

Python's own macOS documentation says recent macOS versions include a python3 command at /usr/bin/python3, linked to a usually older and incomplete version provided by and for Apple's development tools. It tells you never to modify or delete it, because Apple-provided and third-party software depends on it.

So you will have two working installations side by side. The python.org installer is designed for that: its default options make its python3 take precedence over the system one.

How do you install from python.org?

The Python docs describe these steps:

1. Open the macOS downloads page on python.org and pick the installer for the most recent supported version. The docs recommend the newest supported release.
2. Check the file. Each release page lists a checksum, size and Sigstore signature for every file. The installer package and its contents are signed and notarized with Python Software Foundation Developer ID certificates to satisfy Gatekeeper.
3. Double-click the .pkg, read the Read Me (it states which Python version and macOS versions are covered), accept the license and click Install. An administrator account is required, because the install is available to all users.
4. When it finishes, open the Python folder in Applications and double-click Install Certificates.command. It downloads SSL root certificates for the new Python through a short Terminal session. Success is indicated by a message that certifi was installed.

The current installers are universal2 builds that run natively on Apple Silicon and Intel Macs. A default install adds a Python folder in Applications (with IDLE and Python Launcher), a framework under /Library/Frameworks, and links in /usr/local/bin.

Recent versions can also install a free-threaded build as a separate option, with its own site-packages. Most people can leave that at the default and ignore it.

What are the alternatives?

The docs name Anaconda, Homebrew, MacPorts and ActivePython as other sources. They add convenience, such as several Python versions at once, but the docs warn they may not include the latest Python and are not maintained or supported by the core Python team. That is a trade, not a flaw: decide who you trust to ship updates.

Why do you need a virtual environment?

Installing packages into a shared interpreter is how projects start breaking each other. The Python docs describe a virtual environment as a directory holding a specific interpreter and libraries for one project, isolated by default from other environments and from the operating system install. It is disposable and not meant to be copied or checked into Git. Create one with the venv module, for example python3 -m venv .venv, then install with pip while it is active.

What does this have to do with supply chain risk?

Every pip install pulls code from the internet and runs it at your privilege level. The installer itself is signed, which is why checking it is cheap. The packages you add afterward are a larger exposure. Pin versions, keep a lock file, and review what a new dependency brings with it, including its own dependencies.

A constructed example

A developer installs a data tool with sudo pip install against the system interpreter. A later OS update ships a changed system Python, and the tool breaks along with an unrelated Apple developer script. Had the tool lived in a project venv, deleting and recreating the folder would have fixed it in a minute.

How to check or apply this

1. Run which -a python3 and see which interpreters are on your PATH and in what order.
2. Confirm the version you expect by starting python3 and reading the banner it prints.
3. Compare the download against the checksum on the release page before running it.
4. Run the certificates command, or HTTPS requests from Python may fail.
5. Create one venv per project and never use sudo with pip.
6. Scan the dependencies you install. Safeguard offers a free in-browser scan at gold.safeguard.sh/scan for up to 100 dependencies, and a CLI for local runs.

Quick check

Sources

• Python documentation, Using Python on macOS
• Python documentation, venv: creation of virtual environments

Last reviewed: 18 October 2026.