Notarization gets confused with App Review, and the confusion sets the wrong expectation. App Review is a human evaluating your app against the guidelines and takes about a day. Notarization is an automated security check that usually finishes in minutes. So if you are staring at a notarytool submission wondering whether to expect hours, the honest answer is that it normally does not take long at all, and a long wait usually means something specific is happening. Here is the real timing and what changes it.
Short answer
The Apple Notary Service is automated and usually completes within a few minutes, often around a minute or two, with most submissions finishing well under fifteen minutes. Per Apple's notarization documentation, most uploads are notarized quickly, but some are held for in-depth analysis and take longer, sometimes tens of minutes. This is not human App Review; it is an automated scan for malware and a check of your signing and hardened runtime. Submit with xcrun notarytool submit --wait so the tool blocks until it gets a result, then staple the ticket. If it runs far beyond an hour, suspect a service issue or a submission that is being held or has errored.
What you should know
- It is automated, not human review: notarization is a machine check, not App Review.
- Usually minutes: most submissions finish in a couple of minutes, under fifteen typically.
- In-depth analysis takes longer: some uploads are held and run for tens of minutes.
- Use notarytool with --wait: it blocks until the result is ready and reports status.
- Hours is abnormal: a multi-hour wait usually points to a service issue or a held submission.
What is notarization checking?
An automated security pass, not your app's design or content. The Notary Service scans the software for malicious components and verifies that it is properly signed with a Developer ID and built with the hardened runtime, then issues a ticket if it passes. It does not judge whether your app meets the App Review Guidelines, whether the UI is acceptable, or whether the features are appropriate, because those are human App Review concerns for App Store distribution. Notarization is the gate for Mac software distributed outside the Mac App Store, and for notarized iOS apps distributed outside the App Store where that is permitted, and its job is the security check, which is why it can be fully automated and therefore fast.
How long does it actually take?
For most submissions, minutes. The table sets expectations by scenario.
| Scenario | Typical time |
|---|---|
| Normal submission | About one to a few minutes |
| Most uploads overall | Under fifteen minutes |
| Held for in-depth analysis | Tens of minutes, occasionally longer |
| CI/CD pipeline | Often around twenty minutes end to end |
| Stuck for many hours | Abnormal; likely a service issue or held submission |
The pattern is that notarization is quick by design, and the longer cases are the exception. Apple also notes that as the system sees more of your submissions, it learns to recognize them, so repeated notarizations of the same app tend to get faster rather than slower.
Why is mine taking longer?
A few specific causes account for most long waits. The most benign is in-depth analysis, where a submission is held for extra scanning and takes tens of minutes instead of one or two. A second is a large upload or a busy CI environment, which adds time around the notarization itself. A third is a genuine service incident, which Apple posts about on its system status, where submissions sit "In Progress" far longer than normal across many developers at once. A fourth is a submission that has actually failed, where the wait ends in an error rather than success, which is why you should read the log with xcrun notarytool log to see the reason. Using --wait keeps you from guessing, since the tool reports the final state.
What to watch out for
The first trap is conflating notarization with App Review and budgeting a day for what usually takes minutes, or the reverse, expecting App Review to be as fast as notarization. The second is polling manually instead of using --wait, which makes a normal few-minute job feel uncertain. The third is forgetting to staple the ticket with xcrun stapler staple after notarization succeeds, so the app can be validated offline. For the security side that notarization only partly covers, a pre-submission scan such as PTKD.com (https://ptkd.com) reads the compiled binary against OWASP MASVS and checks the app's storage, network, and signing posture, which is a broader check than the notary's automated malware and signing pass. Notarization confirms the package is safe to distribute; it does not audit how your app handles data.
What to take away
- The Apple Notary Service is automated and usually finishes in minutes, with most submissions under fifteen, not the day that App Review takes.
- It checks for malware and verifies signing and the hardened runtime; it does not evaluate guidelines like human App Review.
- Submit with
xcrun notarytool submit --wait, read the log on failure, and staple the ticket on success; a multi-hour wait usually means a held submission or a service issue. - For a deeper look at your app's security than the notary performs, use a pre-submission scan such as PTKD.com against OWASP MASVS.
