What Is nsurlsessiond and Why Is It Using My Wi-Fi?

Your internet slows to a crawl, or your provider warns you about your data cap, and Activity Monitor's Network tab shows a process called nsurlsessiond at the top, having moved gigabytes.

The short answer: nsurlsessiond is the macOS service that carries out background downloads and uploads on behalf of other apps, such as iCloud, Photos, the App Store and macOS updates. It is safe and it is not the cause, only the courier. To calm it, find out which app handed it the transfer, then pause that sync or schedule that update.

What nsurlsessiond is

Apple's manual page calls it "the background NSURLSession daemon" and says it is "a per-user daemon that performs tasks for background-configured NSURLSessions."

In plain terms: when an app wants a transfer to keep going even if the app itself quits, it asks macOS to run it in the background. nsurlsessiond is the process that does that work. Because so many apps use it, the network traffic it shows belongs to whichever app asked, not to nsurlsessiond itself.

Why there are two of them

On our test Mac, running macOS 27.0.1, ps showed two copies:

You can see them yourself in Terminal:

ps -axo user,pid,etime,comm | grep nsurlsessiond

Both had been running for more than a day while moving no data at all, which is normal: it sits idle until something needs it. Do not worry if you see only one. Its launch configuration lets macOS end the per-user copy when it is idle (EnablePressuredExit), and it starts again when an app needs a transfer.

What it is usually downloading

• iCloud Drive. New or changed files in iCloud Drive upload in the background, and files you open download. The iCloud Drive process itself is bird.
• iCloud Photos. Photos and videos from your iPhone download to the Mac, and new ones upload.
• Software updates. macOS and App Store updates can download in the background before you install them.
• Other apps. Any app can hand it a large download or upload, for example a podcast app or a cloud backup.

Activity Monitor and Terminal's nettop both show the traffic under nsurlsessiond, not under the app that asked for it. So the practical question is which of the above has a lot to transfer right now. Our guide to monitoring network activity on a Mac shows how to see live, per-process traffic with nettop.

Is nsurlsessiond safe?

Yes. It is part of macOS and runs from /usr/libexec/nsurlsessiond. The ps command above shows the full path in its last column. A process with this name running from anywhere else would be worth investigating.

How to stop nsurlsessiond using so much data

• Find the app behind it. In Finder, press Command-Shift-G and go to the folder below. The folders inside are named after the apps that have used background transfers. On our test Mac they included com.apple.cloudd (iCloud), com.apple.amsengagementd (the App Store) and com.google.Chrome. Some may be left over from earlier transfers, so treat them as a shortlist, then check whether that app is syncing or updating.

  ~/Library/Caches/com.apple.nsurlsessiond/Downloads

• Schedule macOS updates. In System Settings > General > Software Update, open the options next to Automatic Updates and turn off Download new updates when available. Updates then download only when you choose.

• Pause the sync in the app doing it, while you need the bandwidth for something else.

• Quit it as a last resort. In Activity Monitor, select the copy running under your name, click the stop button and choose Quit. When we tried this on macOS 27 it exited cleanly and macOS did not start it again straight away. It starts again when an app next asks for a background transfer, and that transfer carries on then.

Watch your bandwidth from the menu bar

Activity Monitor shows that a transfer is happening once you open it. MacStats puts a live internet usage meter in the menu bar, your Mac's upload and download speed, so a background transfer is obvious the moment it starts.

MacStats shows traffic for the whole Mac, not for each app. When the menu bar shows a spike, Activity Monitor's Network tab or nettop tells you which process it is, and if it is nsurlsessiond, the list above tells you where to look.

See a background download the moment it starts.

Download MacStats for Free

Other background processes that often top Activity Monitor are Spotlight's mdworker_shared and the Photos agent photoanalysisd.

Frequently asked questions

What is nsurlsessiond on a Mac?

It is the macOS service that performs background downloads and uploads for other apps, such as iCloud Drive, iCloud Photos, the App Store and software updates. Apple describes it as a per-user daemon for background NSURLSession tasks.

Is nsurlsessiond a virus?

No. It is part of macOS and runs from /usr/libexec/nsurlsessiond. A process with that name running from anywhere else would be worth investigating.

Why is nsurlsessiond using so much data?

Because another app has handed it a large transfer: usually iCloud Drive or iCloud Photos syncing, or a macOS or App Store update downloading. The traffic is shown under nsurlsessiond, but it belongs to that app.

Can I quit nsurlsessiond?

Yes. In our test on macOS 27 it quit cleanly and did not restart straight away. It starts again when an app next asks for a background transfer, so quitting only pauses the work.

How do I stop macOS downloading updates in the background?

In System Settings, go to General, then Software Update, open the options next to Automatic Updates and turn off Download new updates when available.