What Is trustd and Why Is It Running on My Mac?

If you ever open Activity Monitor and look at the Network tab, you might spot a background process called trustd sending and receiving small amounts of data. Sometimes, it might even spike and use a noticeable chunk of your CPU.

Given its cryptic name and active network connection, it is easy to assume trustd might be spyware or malware.

But you do not need to worry. trustd is actually one of the most important security features built directly into macOS. Here is a plain English breakdown of what it does and why it needs to talk to the internet.

The Gatekeeper of Digital Certificates

trustd stands for Trust Daemon.

Whenever your Mac connects to a secure website (like your bank), or whenever you download a new application, your Mac needs to verify that the website or app is actually who they claim to be. They prove their identity using digital certificates.

The trustd process is the bouncer for your operating system. Its only job is to evaluate those digital certificates and decide if they can be trusted.

If you download an app from a random website, trustd checks the developer certificate against Apple's database. If the certificate is valid, the app opens. If the certificate was revoked by Apple because the developer was caught making malware, trustd steps in and blocks the app from running.

Why Does trustd Use the Network?

If trustd is just checking certificates, why does it need internet access?

Digital certificates expire, and sometimes they get revoked early if a security breach happens. To make sure it has the most up-to-date security information, trustd has to occasionally connect to Apple's servers to download the latest list of revoked and compromised certificates.

That small trickle of data you see in the Activity Monitor Network tab is just trustd updating its security rulebook.

Why Is trustd Using High CPU?

Under normal circumstances, trustd runs quietly in the background. But occasionally, it might spike and consume a large amount of CPU.

This usually happens when:

• You just installed a major macOS update: trustd has to verify a massive amount of new system files and updated certificates all at once.
• You are dealing with a captive Wi-Fi network: If you are at a hotel or airport and the Wi-Fi requires you to log into a web portal before granting internet access, trustd can sometimes get confused trying to verify certificates on a restricted connection.
• A third-party app is misbehaving: If an app is aggressively trying to make secure network connections and failing, trustd has to repeatedly evaluate those failed certificates, causing high CPU usage.

If trustd gets stuck at high CPU, a simple restart of your Mac is usually enough to clear the logjam.

Stop Googling Every Process

trustd is a perfect example of a system process that looks scary but is actually keeping you safe. Unfortunately, Activity Monitor provides zero context. It just shows you the name and the numbers.

We built MacStats to fix this broken experience.

MacStats is a menu bar monitor that tracks your CPU, RAM, thermal state, and network speed. When a process starts acting weird, you do not have to copy and paste its name into Google.

You just click the process in the MacStats menu and use the AI Process Explainer. MacStats translates the technical jargon into a plain English summary, telling you exactly what the process is and whether it is safe to quit.

Stop wondering where your internet bandwidth went. Download MacStats for Free and monitor your network speeds in real time.

Frequently asked questions

Is trustd a virus?

No. trustd is an official Apple security process built into macOS. It evaluates digital certificates to ensure the apps you run and the websites you visit are safe.

Why is trustd connecting to the internet?

trustd needs to connect to Apple servers to download the latest lists of revoked and expired digital certificates. This ensures your Mac is protected against newly discovered security threats.