How to uninstall Yubico Authenticator on Mac
Yubico Authenticator is Yubico's desktop app for managing a YubiKey and the one-time-password accounts on it, from developers.yubico.com. Per that page, the one-time passwords are stored on the YubiKey itself, not in the app, so removing the app does not delete your accounts and there is nothing to export from the Mac. Do not factory reset the key to tidy up; the app's reset option erases the key's data. The only thing you may want to keep is a custom icon pack if you loaded one: Yubico's custom icons page has you load a zip from your computer, so keep that zip. This guide covers the official disk image and the Homebrew cask yubico-authenticator.
Quit and remove the app
- Quit Yubico Authenticator with Command + Q. It starts a helper,
authenticator-helper, from inside the app. In the test, Status grouped five processes under one row, three of them macOS's own (two Metal shader compiler processes and the smart card service); leave those alone. - Open Finder, go to Applications and drag Yubico Authenticator to the Trash.
The app registered no login item or launch agent in the test.
Where the data lives
Press Shift + Command + G in Finder to open each path. Skip any path that is not on your Mac.
| Location | What it holds | What to do |
|---|---|---|
~/Library/Containers/com.yubico.yubioath |
The app's sandbox, its own settings and files; your accounts are on the key, not here | Remove after the app is gone. Mole selects it by default. macOS can refuse the move, see below. |
~/Library/Application Scripts/com.yubico.yubioath |
A folder macOS creates for sandboxed apps, empty in the test | Remove. Mole selects it by default. |
The com.yubico.yubioath folder inside the folder that getconf DARWIN_USER_CACHE_DIR prints |
Mole's temporary cache row, 290 KB in the test | Remove. Mole selects it by default. |
If macOS refuses to move the container with a permission error, it is protecting sandboxed app data. Quit the app first, then either grant Mole Full Disk Access in System Settings › Privacy & Security › Full Disk Access and let it try again, or leave the container where it is; it holds no accounts.
Check the result
pgrep -il 'yubico|authenticator-helper'
launchctl list | grep -i yubi
ls -d /Applications/Yubico\ Authenticator.app ~/Library/Containers/com.yubico.yubioath ~/Library/Application\ Scripts/com.yubico.yubioath
- No output from
pgrepmeans neither the app nor its helper is running. A printed line is a process still alive; quit it, or restart the Mac once. - No output from
launchctlmeans no Yubico job is loaded for your user. A line namingcom.yubico.yubioathmeans a job is still registered. - For
ls -d, "No such file or directory" means that path is gone. A printed path is still on disk; a surviving container is expected if macOS refused it.
If you installed it with Homebrew
brew uninstall --cask yubico-authenticator
The cask has no uninstall step, so this command removes the app only. Its zap list holds two paths, ~/Library/Application Scripts/com.yubico.yubioath and ~/Library/Containers/com.yubico.yubioath, so running brew uninstall --cask --zap yubico-authenticator yourself deletes the container and does not read Mole's checkboxes. Mole adds --zap only when its whole removal scope passes its zap gate: an unchecked or shared path, a path outside the reviewed boundary, an unknown stanza or an unsupported directive turns it off, and Mole then removes the rows you selected itself. Because brew inherits Mole's permissions and the container is protected, Mole asks for Full Disk Access before it runs a zap. The Homebrew install was not tested.
What Mole lists
Mole selects the app, ~/Library/Application Scripts/com.yubico.yubioath, ~/Library/Containers/com.yubico.yubioath and its temporary cache row. With Full Disk Access Mole can move the container; without it, Mole's report names Full Disk Access and offers a retry. Mole does not talk to the YubiKey and does not read or change anything stored on it.
What this test covered
On November 9, 2026, the test downloaded Yubico Authenticator 7.4.1 (a Universal disk image) from Yubico's developer site, whose checksum matched the Homebrew cask, copied the app to Applications without running brew install and opened it once. It then quit the app and removed it with a source-built Mole with every review row ticked. Mole moved the app, the Application Scripts folder and the temporary cache folder to the Trash. The container stayed because the test build ran without Full Disk Access and macOS refused the move. Status showed one Yubico Authenticator row with 5 processes. Mole found no update feed for the app, and no update was run. Working with a YubiKey, the custom icon pack, a Homebrew-managed uninstall and Mole's notarized release build were not tested.