How to Turn Off System Integrity Protection on Your Mac

What System Integrity Protection Does and Why You Might Disable It

System Integrity Protection (SIP) is a Mac security feature that prevents even administrator accounts from modifying certain system files and processes. It acts as a final lock on core operating system components, kernel extensions, and system libraries — meaning that malware, buggy software, or even you cannot accidentally (or intentionally) break fundamental parts of macOS.

Most people never need to disable it. But some legitimate situations require it: installing certain older software, using specific development tools, running unsupported kernel extensions, or troubleshooting deep system problems. Disabling SIP is a deliberate choice that reduces your Mac's built-in protections, so you should only do it when you have a specific reason and understand the trade-off.

Key Takeaways

System Integrity Protection must be disabled from Recovery Mode, not from your normal Mac desktop, because the feature locks even the administrator account out of system files.
You access Recovery Mode by restarting your Mac and holding Command+R immediately after the startup sound, then navigating to Utilities > Terminal.
The command to disable SIP is csrutil disable, typed into the Terminal window in Recovery Mode, followed by a restart.
Disabling SIP removes a significant security layer, so re-enable it with csrutil enable as soon as you no longer need it off.
If you forget your Mac password or get stuck in Recovery Mode, you may need to use Apple's online account recovery or contact Apple Support to regain access.

Restart Into Recovery Mode

You cannot disable System Integrity Protection from your normal Mac desktop because SIP itself prevents you from doing so. Instead, you must restart your Mac into Recovery Mode, a special startup environment where SIP does not yet apply.

Shut down your Mac completely. Press the power button to turn it on, and immediately hold down Command+R (the Command key and the R key together). Keep holding both keys until you see the Apple logo or a spinning globe. This usually takes 5 to 10 seconds. Your Mac will boot into Recovery Mode instead of your normal system.

You will see a macOS Utilities window with several options. If it does not appear, wait a few seconds — Recovery Mode can take a moment to fully load. Do not click anything yet.

Open Terminal in Recovery Mode

From the macOS Utilities window, click the Utilities menu at the top of the screen. A dropdown will appear with several options. Select Terminal.

A Terminal window will open — a black or white box where you type commands directly to your Mac's operating system. This is where you will enter the command to disable System Integrity Protection. Do not be intimidated by the blank screen; you are simply typing a single line of text.

Type the Command to Disable SIP

In the Terminal window, type the following exactly as shown (spaces and lowercase letters matter):

csrutil disable

Press Enter. Terminal will ask you to authenticate — it may prompt you for your Mac password. Type your password and press Enter again. You will not see the password appear on screen as you type; this is normal and a security feature.

Terminal will display a message confirming that System Integrity Protection has been disabled. The message will say something like "Successfully disabled System Integrity Protection. Please restart the machine for the changes to take effect."

Restart Your Mac

Close the Terminal window and the Utilities window. You will return to the Recovery Mode desktop. Click the Apple menu in the top-left corner and select Restart. Your Mac will restart normally, and System Integrity Protection will now be off.

You can verify that SIP is disabled by opening Terminal on your normal Mac (Applications > Utilities > Terminal) and typing csrutil status. If it shows "System Integrity Protection status: disabled," you have successfully turned it off.

Re-Enable SIP When You Are Done

Once you have finished whatever task required SIP to be off, you should turn it back on. The process is identical: restart into Recovery Mode (Command+R), open Terminal from Utilities, and type csrutil enable. Press Enter, authenticate with your password, and restart your Mac.

Leaving SIP disabled permanently removes a significant layer of protection against malware and system corruption. Most people should re-enable it as soon as their specific task is complete. If you are unsure whether you still need it off, re-enable it — you can always disable it again if needed.

What to Do If You Get Stuck

If you restart into Recovery Mode and cannot remember your Mac password, or if Terminal does not appear to work, do not force-restart your Mac repeatedly. Instead, restart into Recovery Mode again and look for a "Reset Password" option in the Utilities menu. You can also sign in with your Apple ID to reset your password.

If you accidentally typed the wrong command or something went wrong, simply restart into Recovery Mode again and type the correct command. Nothing is permanently broken — you can always re-enable SIP or disable it again. If you are completely locked out, contact Apple Support with your Mac serial number (found in System Settings > General > About); they can help you regain access.

Frequently Asked Questions

Will disabling SIP make my Mac unsafe?

It removes one layer of protection, but your Mac is not suddenly vulnerable. Malware still cannot run without your permission, and most security features remain active. However, SIP is specifically designed to prevent low-level system tampering, so disabling it does increase risk. Re-enable it as soon as you no longer need it off.

Can I disable SIP for just one app or one task?

No — SIP is all or nothing. You cannot selectively disable it for specific programs. You must disable it entirely, complete your task, and then re-enable it. This is by design, to prevent malware from tricking you into leaving it off.

What if I disable SIP and then forget to turn it back on?

Your Mac will continue to work, but you will have reduced protection. You can re-enable it at any time by following the same steps: restart into Recovery Mode, open Terminal, type csrutil enable, and restart. There is no penalty for turning it back on.

Do I need to disable SIP to install software from outside the App Store?

No. You can install software from anywhere without disabling SIP. SIP only blocks modifications to core system files, not the installation of regular applications. If an installer tells you that you must disable SIP, that is a red flag — contact the software maker to ask why.

Can I disable SIP remotely or from another Mac?

No. You must physically restart the Mac in question into Recovery Mode. SIP is designed so that no remote process can disable it, even if someone has your password. This is a security feature.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.