Compare
The real cost of
code signing.
What you actually pay to ship a signed desktop app on macOS and Windows. Real numbers from real providers.
The number
Expect $398 to $598 in year one for both platforms combined. In years two and beyond you keep paying that same range because both certificate types are annual. Windows dominates the bill, costing $299–$499 for an Extended Validation certificate that avoids the SmartScreen warning your users would otherwise hit on first launch.
The bill, by platform.
One annual fee to Apple. One larger annual fee to a Windows cert provider. That is the entire cost of code signing for most apps.
macOS
macOS signing is cheap and straightforward. One annual fee to Apple covers everything, including notarization.
- Apple Developer Program$99/yr
Required. No workaround. Individual or organization account both cost the same.
- Notarization serviceIncluded
Automated Apple service that scans your signed binary. No additional charge.
- Hardware tokenOptional
Some enterprises use YubiKey for extra key security. Not required for most indie shops.
Windows
Windows signing is where most of the cost lives. You almost certainly need EV to avoid the SmartScreen warning that scares off first-run users.
- Standard (OV) Code Signing$200–500/yr
Still triggers SmartScreen for new publishers. Kernel-mode signing already requires EV. Skip this tier unless you know why you want it.
- Extended Validation (EV) Code Signing$299–$599/yr
Bypasses SmartScreen from day one. This is what almost every commercial desktop app buys.
- Hardware tokenUsually included
EV certificates are shipped on a hardware token you plug into your CI signing machine. Sometimes bundled, sometimes $50–$100 extra.
- ProvidersSSL.com is cheapest
SSL.com $299–$499/yr for EV. DigiCert and Sectigo run $400–$600. GlobalSign in the middle.
Multi-year total cost.
Assumes SSL.com EV for Windows at $399/yr. No spike in year one; both certificates are pure annual renewals.
Where Prod0 fits
Prod0 does not sell certificates. You buy them from Apple and a Windows cert provider yourself. What Prod0 does is remove the other 90 percent of the work: notarization pipeline, secure certificate storage in CI, per-artifact signing, latest.yml manifest generation, and the code-signing steps for every release. Certificates end up being your only real code-signing cost.
Ways to save.
Renew certificates early
Windows EV renewals go faster than fresh issuance because your organization is already validated. Renew 30 days before expiry to avoid rush fees.
Use SSL.com for Windows EV
SSL.com is consistently the cheapest EV provider ($299–$499/yr). DigiCert and Sectigo are pricier without offering meaningfully more.
Wait to buy Apple Dev until close to release
Apple Dev membership is $99/yr and starts the day you enroll. If you enroll six months before shipping, you burn half a year of validity.
Skip standard (OV) Windows signing
OV still triggers SmartScreen for new publishers. If you were considering OV to save money, you will burn more in lost first-run conversions than you save.
Common questions
Do I need EV or can I do OV?
You almost certainly need EV. Standard (OV) code signing still triggers Windows SmartScreen warnings for new publishers, which is the single biggest first-run friction on Windows. OV made sense years ago; today it is a false economy.
Is Windows Defender SmartScreen really that bad?
Yes. Unsigned or OV-signed installers get a full-screen 'Windows protected your PC' warning on first launch. Users have to click 'More info' and then 'Run anyway.' Conversion drops significantly. EV code signing bypasses this entirely from day one.
What's the difference between Apple signing and notarization?
Signing proves who built the app. Notarization is Apple's automated malware scan on top. Both are required for a modern macOS app to run without warnings. The $99/yr Apple Developer Program covers both.