Mac Background Processes Explained: What They Are

Open Activity Monitor, look past the apps you launched yourself, and you find a wall of names: bird, trustd, mdworker_shared, kernel_task, launchd, dozens more you have never seen before. Nothing on the screen tells you which ones matter.

The short answer: almost every process on a Mac is macOS doing work you asked for indirectly, such as syncing your files, indexing them for Spotlight, keeping security checks current, or drawing the screen. The names decode into a few families once you know the pattern, and the fastest way to judge one is to look at who owns it: processes running under your own account are yours to watch and usually safe to quit, while the ones owned by root or by an underscore name like _mds_stores belong to macOS and come straight back anyway. On this site every process that people search for has its own plain-English guide, and this page is the map to all of them.

How to see and manage background processes on a Mac

• Activity Monitor shows what is running right now. Open it from Applications > Utilities. The View menu switches the list between All Processes, My Processes, which is just your account, and Other Users' Processes, the fastest way to see which side of the line a busy process sits on.
• System Settings decides what may run at all. In System Settings > General > Login Items & Extensions, the Login Items list shows apps that open at login, and the background list shows apps that can automatically run in the background to sync data and check for updates. Turning one off there prevents that item from launching in the background, which is where you go when a background helper belongs to an app you have already stopped using.

The four families

On the day we wrote this, our test Mac, running macOS 27.0.1, had 733 processes, and 604 of them were children of one process: launchd. That single fact explains most of the list.

• The kernel. kernel_task represents macOS's kernel, the code underneath everything else. Its famous 500% CPU reading usually reflects macOS limiting the CPU available to other processes to reduce heat, not a fault, and our kernel_task guide explains the whole mechanism.
• Daemons. System services that launchd starts on demand, often as root or under a dedicated system account such as _mds_stores or _windowserver. launchd is the manager: it is always PID 1, and our launchd guide shows how to read its job list. WindowServer, the process that draws every pixel on screen, is one of these, and our WindowServer guide covers why it grows with every display and window you add.
• User agents. The same launchd machinery, running in your session under your account. These are the background processes that belong to your files and your apps: iCloud Drive's bird, CloudKit's cloudd, the Spotlight service corespotlightd, the background transfer service nsurlsessiond, the security service trustd, the Photos analyser photoanalysisd, and the File Provider coordinator fileproviderd.
• Helpers and workers. Short-lived processes an app or service starts when it has a job and stops when it is done. Spotlight's mdworker_shared workers appear whenever files change and disappear after, as detailed in our mdworker_shared guide.

The families overlap on purpose: cloudd and nsurlsessiond each run as two copies on our Mac, one under our user and one under root or a system account, because the same service does work both for your session and for the system as a whole.

Who owns what

The account a process runs under is the single most useful fact about it. Activity Monitor shows it in the User column; if the column is not visible, choose View > Columns and tick it. See Apple's Activity Monitor guide. Here are the processes we have written guides for, with the ownership we measured on macOS 27.0.1:

Two honest notes about that table. First, the account is a strong clue rather than a verdict: in the table above the root and underscore accounts all belong to macOS, but a service like trustd runs copies on both sides. Second, the split matters practically, because an app can only measure what its account is allowed to read. Activity Monitor shows every process. MacStats can measure the processes running under your account, but macOS does not let it read the CPU or memory use of system-owned ones, so those never appear in its lists. Our guide to each process says which side of that line it sits on.

Reading the name

Three patterns decode most of the list:

• A name ending in d is usually a daemon, a service with no window that waits for work: bird, cloudd, trustd, fileproviderd, nsurlsessiond.
• A user name starting with an underscore is a system account, created for one service so it cannot touch your files: _mds_stores, _windowserver, _spotlight, _nsurlsessiond.
• A path under /System/Library, /usr/libexec, or /sbin is Apple's code. A process with a familiar name running from your user folder, /Library, or /Applications is the one worth investigating. To see a process's path and its open files in Activity Monitor, double-click it and open the Open Files and Ports tab.

Can you quit them?

You can quit almost anything, and macOS will usually start it again, which is the honest reason quitting is not a fix. We have tested this rather than assumed it: when we quit bird, a new copy was running 11 seconds later; when we sent fileproviderd a normal quit signal, macOS started a new copy in under a second. The processes that own your files come back because the files still need them. The system-owned ones belong to macOS, quitting them takes more than a click, and they start again when macOS needs them.

What actually helps depends on which process is busy, which is why each guide says so for its own process: let a sync finish, keep folders that change constantly out of synced storage, and give a new Mac the night to index and download.

When a process is actually a problem

The name is almost never the problem; the pattern is. A process worth your attention shows one of these:

• Sustained CPU with no cause, when nothing is syncing, indexing or rendering, for hours rather than minutes.
• Memory pressure going yellow or red, which our memory pressure guide explains from the kernel's own numbers, and growing swap, which our RAM guide puts in context.
• A Mac that is slow every day, which our slow Mac guide turns into a diagnosis, and heat you can feel, which our overheating guide traces from thermal state to cause.

If a process is unfamiliar, look it up before you judge it. Every entry in the table above has a guide with the measurements behind it.

See your own processes in your menu bar

MacStats lives in your menu bar and lists the processes running under your account in its Top CPU and Top RAM lists, which often includes the iCloud and Spotlight services from the table above when they are busy. With MacStats Pro, clicking one gives you a plain-English explanation of what it is doing and whether you need to act. System-owned processes such as WindowServer and kernel_task are macOS's own, and for those Activity Monitor remains the built-in place to look.

Know what your Mac is doing before the fans tell you.

Download MacStats for Free

Frequently asked questions

What are background processes on a Mac?

They are the programs macOS and your apps run without a window: system daemons started by launchd, per-user agents that sync and index your files, and short-lived helpers. Almost all of them are macOS doing work you asked for indirectly.

How many processes should a Mac have running?

It varies with the apps you use, and the number itself is not a problem. Our test Mac had 733, of which 604 were children of launchd. Judge processes by what is consuming CPU and memory, not by the count.

Is it safe to quit background processes on a Mac?

The system-owned ones come straight back because macOS still needs them. The user-owned ones also come back when their work is needed: in our tests, bird restarted within 11 seconds and fileproviderd within one. Quitting is not a fix for anything.

Why are there so many processes on my Mac?

Because macOS splits work into small services: launchd starts each one only when it is needed, and apps run helpers for each job. Even a freshly started Mac with no apps open runs hundreds of them.

How do I find out what a specific process is?

Look it up in one of our guides, listed in the table above. In Activity Monitor, double-click the process and check the path under Open Files and Ports: Apple's code runs from /System/Library, /usr/libexec or /sbin. In Terminal, man processname often explains it in one line.

Are background processes on a Mac viruses or malware?

Almost never. The vast majority are genuine macOS services running from system directories such as /System/Library, /usr/libexec or /sbin. If you spot an unfamiliar process, double-click it in Activity Monitor and check Open Files and Ports. Third-party background items run from /Applications, /Library or your user Library, so check the process details rather than trusting the name alone.

Which background processes are slowing down my Mac?

The ones at the top of the CPU column that stay there without a cause you can name, such as a sync or a Photos analysis in progress. High memory with high memory pressure, not high memory alone, is the sign to act on.