Mac processes, explained
A process is a program running on your Mac, and most of the names you see in Activity Monitor belong to macOS itself. Each page below says what one process does, whether it is safe, why it can use a lot of CPU, and when it is worth a closer look.
System processes
kernel_task
kernel_task is the macOS kernel's own process.
launchd
launchd is the first process that runs when macOS boots (PID 1) and serves as the system's init and service management framework.
coreaudiod
coreaudiod is the central audio management daemon on macOS.
loginwindow
loginwindow manages your macOS login session from start to finish.
distnoted
distnoted is the macOS daemon that delivers distributed notifications between processes.
cfprefsd
cfprefsd manages the macOS preferences system.
powerd
powerd is the macOS daemon responsible for system power management.
syslogd
syslogd is the macOS system logging daemon that collects, stores, and manages log messages from the kernel, system services, and applications.
notifyd
notifyd is the macOS daemon that provides the low-level notify(3) notification mechanism used for lightweight inter-process communication.
UserEventAgent
UserEventAgent is a macOS daemon that loads system-provided plug-ins to handle high-level system events that launchd can't monitor directly (its man page).
coreduetd
coreduetd is a macOS daemon that collects usage patterns to power proactive features such as Siri Suggestions.
softwareupdated
softwareupdated is the macOS background daemon responsible for checking, downloading, and preparing system software updates.
Network processes
cloudd
cloudd is the background daemon that handles CloudKit operations on macOS.
bird
bird is the macOS daemon responsible for syncing files between your Mac and iCloud Drive.
nsurlsessiond
nsurlsessiond is the macOS background daemon that handles URL-based download and upload tasks on behalf of applications.
symptomsd
symptomsd is a macOS system daemon.
rapportd
rapportd is the macOS daemon that handles local device discovery and communication for Continuity features such as Handoff and taking iPhone calls on your Mac (its man page names Phone Call Handoff).
sharingd
sharingd is the macOS daemon that handles AirDrop file transfers, Shared Computers discovery in Finder, and parts of the Handoff system.
bluetoothd
bluetoothd is the macOS daemon that manages all Bluetooth hardware and connections.
wifid
Many guides describe wifid as the Mac's Wi-Fi management daemon.
airportd
airportd is the macOS daemon responsible for managing the Wi-Fi hardware and wireless network connections.
mDNSResponder
mDNSResponder is the macOS daemon that implements Bonjour, Apple's zero-configuration networking protocol.
Security processes
trustd
trustd is the macOS daemon responsible for evaluating certificate trust chains.
sandboxd
sandboxd supports the macOS App Sandbox, the security technology that restricts what an app can reach (files, the network, hardware devices and other processes) based on the entitlements the app declares.
syspolicyd
syspolicyd implements macOS Gatekeeper — the security feature that verifies applications are from identified developers or the Mac App Store before allowing them to run.
tccd
tccd manages the macOS TCC (Transparency, Consent, and Control) framework — the privacy permission system that controls which apps can access your camera, microphone, screen recording, contacts, calendar, location, and other sensitive resources.
XProtect
XProtect is the malware protection built into macOS.
MRT
MRT (Malware Removal Tool) is Apple's built-in tool for removing known malware that has already been installed.
Storage processes
Sync processes
accountsd
accountsd is the macOS daemon that manages all internet accounts configured in System Settings, including iCloud, Google, Microsoft Exchange, Yahoo, and other email/calendar/contacts providers.
CalendarAgent
CalendarAgent is the macOS background process that manages calendar data synchronization between the Calendar app and your configured calendar services, including iCloud, Google Calendar, Microsoft Exchange, and CalDAV servers.
Display processes
Media processes
CoreLock's free scan checks running apps, network, permissions, startup items, AI agents and your Downloads folder. No account needed.
Download CoreLock Free