nsurlsessiond carries out background downloads and uploads that apps hand to macOS, so they can finish even after the app quits; it's part of macOS, not malware. Heavy network use from it usually means one of your apps is syncing or downloading something, and it stops when the transfer is done.
Last reviewed · 2 sources
One Mac, macOS 26.5 (25F71) on Apple silicon, read with ps and codesign on October 29, 2026
| Path | /usr/libexec/nsurlsessiond |
|---|---|
| Runs as | your user account and _nsurlsessiond, a macOS system account |
| Signed by | Apple (Software Signing), identifier com.apple.nsurlsessiond |
nsurlsessiond is the macOS background daemon that handles URL-based download and upload tasks on behalf of applications. When an app uses Apple's NSURLSession API for background transfers, nsurlsessiond takes over the actual network operations so transfers can continue even if the originating app is closed or suspended.
High bandwidth usage from background downloads you didn't explicitly initiate
Persistent network connections that prevent the Mac from sleeping
Unexplained data usage on metered connections
High CPU usage when processing many simultaneous background transfers
Open Activity Monitor, select nsurlsessiond, and click the 'Open Files and Ports' section in the inspector. Network connections listed there can help you identify which servers (and thus which apps) are causing the activity.
nsurlsessiond often handles macOS and App Store update downloads in the background. Go to System Settings > General > Software Update and the App Store's Updates tab to see if downloads are in progress.
To control when large downloads happen, open the App Store app, choose App Store > Settings and turn off Automatic Updates, and in System Settings > General > Software Update click the info button next to Automatic Updates to choose what macOS downloads on its own.
If nsurlsessiond is stuck, restart it with 'killall nsurlsessiond' in Terminal. It will be automatically restarted by launchd and will resume any legitimate pending transfers while clearing any stuck sessions.
nsurlsessiond handling background transfers for macOS updates and app downloads is normal. Be concerned if you see it transferring large amounts of data to unknown servers with no updates pending and no apps actively downloading. Find out which app started the transfers (step 1): nsurlsessiond only carries them out.
cloudd is the background daemon that handles CloudKit operations on macOS. CloudKit is Apple's framework for syncing dat...
bird is the macOS daemon responsible for syncing files between your Mac and iCloud Drive. It handles the upload and down...
trustd is the macOS daemon responsible for evaluating certificate trust chains. Whenever your Mac needs to verify an SSL...
nsurlsessiond is a system daemon that performs background network transfers on behalf of applications. When apps need to download or upload files in the background (even after you quit the app), nsurlsessiond handles the actual network operations. Any app can hand it background transfers through Apple's URLSession API.
nsurlsessiond consumes data when handling background downloads or uploads. Any app that asks macOS for a background transfer, such as an update or a sync, shows up as nsurlsessiond rather than under its own name, so check which apps are syncing or updating, and System Settings > General > Software Update for a download in progress.
Yes. nsurlsessiond is a standard Apple system process present on every Mac. It provides the background transfer capability that apps rely on for downloads and uploads. It is code-signed by Apple and protected by System Integrity Protection. The process itself is safe, though the transfers it performs are on behalf of other apps.
CoreLock's scan of running apps, network, permissions, startup items, AI agents and Downloads is free, with no account.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser