nsurlsessiond (NSURLSession Daemon) is a safe macOS network process. nsurlsessiond is the macOS background daemon that handles URL-based download and upload tasks on behalf of applications. When an app uses Apple's NSURLSession API for background transfers, nsurlsessiond takes over the actual network operations so transfers can continue even if the originating app is closed or suspended. nsurlsessiond handling background transfers for macOS updates and app downloads is normal. Be concerned if you see it transferring large amounts of data to unknown servers with no updates pending and no apps actively downloading. This could indicate an application is exfiltrating data in the background.
NSURLSession Daemon
nsurlsessiond is the macOS background daemon that handles URL-based download and upload tasks on behalf of applications. When an app uses Apple's NSURLSession API for background transfers, nsurlsessiond takes over the actual network operations so transfers can continue even if the originating app is closed or suspended.
High bandwidth usage from background downloads you didn't explicitly initiate
Persistent network connections that prevent the Mac from sleeping
Unexplained data usage on metered connections
High CPU usage when processing many simultaneous background transfers
Open Activity Monitor, select nsurlsessiond, and click the 'Open Files and Ports' section in the inspector. Network connections listed there can help you identify which servers (and thus which apps) are causing the activity.
nsurlsessiond often handles macOS and App Store update downloads in the background. Go to System Settings > General > Software Update and the App Store's Updates tab to see if downloads are in progress.
Go to System Settings > App Store and disable 'Download newly available updates in the background' if you want to control when large downloads occur, particularly on metered connections.
If nsurlsessiond is stuck, restart it with 'killall nsurlsessiond' in Terminal. It will be automatically restarted by launchd and will resume any legitimate pending transfers while clearing any stuck sessions.
nsurlsessiond handling background transfers for macOS updates and app downloads is normal. Be concerned if you see it transferring large amounts of data to unknown servers with no updates pending and no apps actively downloading. This could indicate an application is exfiltrating data in the background.
CoreLock monitors all active network connections made by nsurlsessiond, identifies which applications initiated the transfers, and flags connections to suspicious or unknown destinations that don't match expected Apple or app-specific servers.
Download CoreLock Freecloudd is the background daemon that handles CloudKit operations on macOS. CloudKit is Apple's framework for syncing dat...
bird (sometimes called 'birdd') is the macOS daemon responsible for syncing files between your Mac and iCloud Drive. It ...
trustd is the macOS daemon responsible for evaluating certificate trust chains. Whenever your Mac needs to verify an SSL...
nsurlsessiond is a system daemon that performs background network transfers on behalf of applications. When apps need to download or upload files in the background (even after you quit the app), nsurlsessiond handles the actual network operations. It's used by macOS itself for software updates and by third-party apps for background sync.
nsurlsessiond consumes data when handling background downloads or uploads. Common triggers include macOS software updates downloading in the background, App Store app updates, iCloud sync operations, and third-party apps performing background data transfers. Check System Settings > General > Software Update to see if an update is downloading.
Yes. nsurlsessiond is a standard Apple system process present on every Mac. It provides the background transfer capability that apps rely on for downloads and uploads. It is code-signed by Apple and protected by System Integrity Protection. The process itself is safe, though the transfers it performs are on behalf of other apps.
Download CoreLock to identify suspicious processes, detect threats, and keep your Mac running smoothly.
Download CoreLock FreeAvailable for macOS and Windows