IINA is the video player many Mac users install the day they get a new machine. It plays almost anything you throw at it, because underneath it is mpv, one of the most capable open-source playback engines, wrapped in an interface that looks and behaves like a native macOS app. Force Touch, picture-in-picture, the Touch Bar, colour schemes and trackpad gestures all work the way you would expect.
Beyond plain playback it handles subtitles well: it can search for them online and match local subtitle files automatically. It has playlists, chapters, video thumbnails on the seek bar, unlimited playback history and a separate Music Mode for audio files. Keyboard, mouse, trackpad and gesture controls are all customisable, and power users can bring their own mpv configuration files and scripts. There is a command-line tool and browser extensions too.
The project started in 2016, is GPL-3.0 licensed, and has about 47,000 stars and 211 contributors. Version 1.5.1 came out on 6 November 2026, so it is actively maintained.
- Repository: github.com/iina/iina
- Licence: GPL-3.0 (GNU General Public License v3.0)
- Language: Swift. Stars: 47.1K. Forks: 2,988. Last push: Nov 10, 2026.
- Scan: safe, Nov 10, 2026, commit 685a40e
Who it is for
Anyone on a Mac who wants one free player for every video and audio format, people who watch with subtitles, and mpv users who want mpv's engine with a proper Mac interface.
Getting started
1. Download the app from the official site
https://iina.io2. Or pick a specific stable or beta release
https://github.com/iina/iina/releases/latest3. Optional: nightly builds with the newest features (may be buggy)
https://iina.io/nightly/Our scan covers the source code, not the prebuilt app. The README says nightly builds are made automatically for every commit and might be buggy or unusable, so stick to the stable release unless you want to test.
Safety scan
We cloned iina/iina at commit 685a40e on Nov 10, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secret hits, no pattern hits and no committed binaries across 1,184 files and about 89,000 lines, mostly Swift.
- No lockfile, so there was nothing to check against known vulnerability databases. The playback engine, mpv and its libraries, is not in the repository: when you build IINA yourself, other/download_libs.sh fetches prebuilt copies from iina.io. If you use the release app, those libraries are already inside it.
- The hosts the code talks to are what you would expect for a video player: OpenSubtitles and Assrt for subtitle search, Apple's developer documentation, mpv.io, GitHub, and iina.io. The app checks for updates through the Sparkle feed at iina.io/appcast.xml, as many Mac apps do.
- 3 workflows, none using pull_request_target. The one third-party action is pinned to a tag rather than a commit. A licence and contributing guide are present; no security policy, Dependabot or CodeQL in the repository.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 3 workflows. None use pull_request_target. 1 of 1 third-party action pinned to a tag rather than a commit. |
| Network hosts | 37 distinct hosts referenced from source; most often developer.apple.com, mpv.io, github.com, opensubtitles.stoplight.io. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has licence file, contributing guide. Missing security policy, automated dependency updates, CodeQL. |
| OpenSSF Scorecard | 4.1 out of 10, as of Nov 9, 2026. |
By the numbers
| Stars | 47.1K |
|---|---|
| Forks | 2,988 |
| Contributors | 211 |
| Commits | 4,372 |
| Open issues | 1,872 |
| Open pull requests | 115 |
| Releases | 55 |
| Latest release | v1.5.1 |
| Licence | GPL-3.0 |
| Main language | Swift |
| Project age | 9 years |
| Last push | Nov 10, 2026 |
| Tracked files | 1,184 |
| Lines of code | 88.9K |
| Checkout size | 22 MB |
Lines by language: Swift 61.4K, C/C++ header 22.3K, JSON 2,305, Objective-C 904, Shell 777, YAML 288.
Questions
Is IINA free?
Yes. IINA is free and open source under GPL-3.0, with no paid tier, account or ads.
Does IINA work on Windows or Linux?
No. IINA is built only for macOS. On Windows or Linux, mpv, the engine underneath IINA, runs directly.
Can IINA find subtitles for me?
Yes. It can search for subtitles online and match subtitle files sitting next to your video automatically. You can also load a subtitle file yourself and adjust its timing.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.