Quick Look extension · Apple silicon · macOS 15+
SpacePane adds Quick Look previews for the files your Mac can't read yet. When macOS uses SpacePane for the type, you see what's really inside: hidden characters, risky archive entries, secrets that shouldn't travel. One key, read-only, and it all stays on your Mac.
How it works
SpacePane plugs into the standard Quick Look feature of macOS. There's no new app to switch to and nothing to learn.
Get it from the Mac App Store. It runs on a Mac with Apple silicon and macOS 15 Sequoia or later.
‹ Login Items & Extensions
Quick LookAn illustration, not your real settings. Try the switches.
Privacy
Every preview is made on your Mac. Files are only ever read, scripts never run, and likely secrets, such as passwords, tokens and keys, turn into ••••, even in the source view.
Safety Lens
Most previewers show what a file looks like. SpacePane also tells you what to check first: hidden characters, risky archive entries, secrets, notebooks that won't reproduce. It's worked out on your Mac, and nothing is opened or run.
Safety
These look like four ordinary lines. Switch to Invisibles to see what isn't ordinary.
Hidden-content detector
Some characters take up no room on screen but still change what a file says or does. SpacePane counts them and warns you. A message hidden in Unicode Tags is decoded into plain, inert text you can read safely, and direction-changing controls, the “Trojan Source” trick (CVE-2021-42574), are called out too.
In instruction files for AI coding tools, such as AGENTS.md, CLAUDE.md and .cursorrules, it takes extra care, because hidden text there can steer an assistant. The Invisibles view then shows every hidden character as a visible marker, like ⟨U+202E RLO⟩.
What it looks for
Archive risk report
SpacePane reads an archive's list of contents and says in plain words what looks risky: paths that would land outside the destination folder (../), links that point out of the archive, encrypted entries, apps, installers and scripts, disguised names like invoice.pdf.app, direction-changing characters in names, archives inside archives and unusual compression ratios. Entries are listed and flagged, never extracted.
Secret inventory
Beyond hiding likely secrets, the preview counts them by kind and tells you which lines they were on: an access key, a token, a private key, a password field. If such a file sits in iCloud Drive, Dropbox, Google Drive, OneDrive or Box, it warns you that the file is being copied to the cloud. Copy Concealed Text puts a version with the secrets replaced by dots on your clipboard, ready to paste into a ticket or an AI chat.
Notebook health
SpacePane reads the execution numbers saved in a notebook and flags cells that ran out of order (like 5 → 2 → 9), skipped numbers, code cells that never ran and cells that saved an error, with a hint when the saved results may not reproduce from top to bottom. Nothing runs.
Before you run it
Script effects
Coming in an updateShell scripts, .command files, AppleScript, PowerShell and batch files get a plain list of what they would do if you ran them: download and run code, decode hidden commands, remove the quarantine mark, ask for your password, add a login item or use administrator rights. Each finding points at its line. Comments and quoted text don't count, and nothing runs.
Auto-run settings
Coming in an updateA VS Code task set to run when the folder opens, Claude Code hooks, MCP servers and the keys they receive, dev-container commands, npm install scripts and launch agents can all start programs without asking. SpacePane lists them. It also flags password and one-time-code exports saved as plain text, and certificates that have expired.
AI model files
Coming in an updateGGUF and safetensors files show their architecture, size, quantization, context length, license and chat template from the header alone, and say when a download looks incomplete. PyTorch and pickle files list every function that loading them would import, sorted by what it can do. Nothing is loaded, and a file with no findings is never called safe.
Add-ons and packages
Coming in an updateMCP bundles, VS Code extensions and Firefox or Chrome extensions show what they run, which permissions and sites they ask for, where they update from and whether they carry native code or invisible characters. npm and Python packages show the scripts that run on install and the files that run each time Python starts.
Understand
CSV and TSV Profile
The Profile view shows each column's type, missing values, distinct count, range, mean and most common values, with a small chart of how the values are spread. Quality notes call out mixed types, ragged rows, duplicate headers and leading zeros a spreadsheet would drop. Columns that hold secrets stay concealed, statistics included. Large files are profiled from their first rows.
Why now
Calm context, not alarms. These are the kinds of surprises the Safety Lens is built to notice.
Invisible instructions have been hidden in rules files for AI coding assistants, where a person reviewing the file sees nothing odd.
Source: Pillar Security(opens in a new tab)Code written in invisible characters turned up in editor extensions and software packages in 2025 and 2026.
Source: Koi(opens in a new tab)Right-to-left filename tricks have made a malicious Mac app look like a PDF.
Source: Macworld(opens in a new tab)Infostealers made up most newly reported Mac malware in 2025, and they often arrive inside archives and disk images.
Source: Threat Cluster(opens in a new tab)These are checks for you to review, not a verdict. A file with no findings isn't guaranteed safe, and a finding doesn't mean a file is malicious.
Presentations
staging.env
Environment File - 398 bytes
InformationShow More
Tags
A simplified browser copy of SpacePane's previews. Dropped files stay on your device. The sample secrets are made up.
Features
Archives, diagrams, data files, packages, ebooks and 3D models get their own native previews, with tools, thumbnails and settings to match.
RAR, 7z, bzip2 and xz join ZIP, TAR and GZIP. Entries are listed and risky paths flagged; nothing is extracted.
Choose how deep to look and whether hidden items show. Switch between Files and Tree views, with sortable, filterable tables.
App bundles, IPA, APK and AAB, provisioning profiles, certificates, installer packages, disk images and torrents are read, never run.
Extended Markdown with math and Mermaid fences, LaTeX, BibTeX in APA, MLA, Chicago and IEEE styles, AsciiDoc, reStructuredText, Org and Fountain screenplays.
Mermaid flowcharts, sequence, pie, state, class and ER diagrams, plus draw.io files, drawn without a web view or scripts.
Parquet with row samples, Avro, Arrow, NumPy and HAR; a map-free Plot for GeoJSON, GPX and KML; a schema grid for SQLite.
Syntax profiles for 84 languages, plus INI, logs, JSONC and JSON5, five more caption formats and minified JSON shown formatted. Large text opens from its first lines.
EPUB and FictionBook, CBZ comics, MHTML web archives and notebook figures, with a Pages view to flip through them.
SpacePane draws content thumbnails for many formats, with likely secrets concealed. Some formats keep the generic icon or the system thumbnail.
Live reload when the file changes, Go to Line, Copy All, an outline filter with row copy, temporary zoom and an info symbol that says “Preview by SpacePane”.
When macOS uses SpacePane for the type, STL, OBJ, PLY and 3MF models open in a 3D viewer with orbit, zoom and standard views.
12 color schemes with separate light and dark choices, behavior switches, and a Quick Look conflicts scan that shows which other apps also preview a type.
Version 1.0 ships in English. Translations into 13 more languages are drafted, and each will be added when its review is done.
Formats
Make it yours
Pick a theme, a color scheme and a text size here, and the live preview above follows along.
Choose one for Light and one for Dark. Each sets the page background and every syntax color.
High Contrast and Increase Contrast always keep the Standard colors.
Font family, size, weight, line and character spacing, ligatures, line numbers, per-role syntax styles and the color schemes for Light and Dark. Save up to 32 profiles and share them as small theme files.
Themes can't run codeFile type choices stay separate from your look.
Native
Selectable text, keyboard navigation, Go to Line, zoom, and Light and Dark appearance.
Previews use the platform's own Quick Look extensions, so when macOS uses SpacePane for the type, they open in the Quick Look window you already know. A preview that stays open reloads when its file changes, and a small info symbol (ⓘ) in its header says “Preview by SpacePane” (hover over it, or use VoiceOver). Large or malformed files hit size, depth and time limits instead of freezing Finder.
Samples