What Is trustd and Why Is It Running on My Mac?

Activity Monitor shows trustd, sometimes three times over, and now and then it uses some CPU or shows up with a network connection. The name sounds like security software, which makes an unexplained process feel more worrying, not less.

The short answer: trustd is the macOS service that decides whether a certificate can be trusted, for example when an app makes a secure connection to a website. Its manual page says it does this "for all processes on the system", as both a daemon and a launch agent, which is why several copies run under different accounts. Activity from it follows the secure connections other apps make. It is part of macOS and is not something to remove.

See the copy that runs as you

When apps on your account make many secure connections, the trustd copy for your login session can become busy. MacStats lists the busiest processes running under your account in the Top CPU and Top RAM lists of its Detailed dashboard, and that trustd copy can appear there. The copies that run under system accounts are macOS's own, and macOS does not let MacStats read their usage, so they never appear in its lists.

Monitoring is free on Apple silicon Macs running macOS 13 or later. MacStats Pro adds the Process Explainer, which puts a process in your lists into plain English. Use Activity Monitor's All Processes view to see every trustd copy.

Download MacStats free

What trustd does

Secure connections, such as an https:// website, rely on certificates that prove who is on the other end. Before an app trusts a connection, macOS checks the certificate chain, its expiry and whether it has been revoked. trustd is the service that performs that check. Its manual page, man trustd in Terminal, calls it the "Daemon and LaunchAgent that performs trust evaluations".

Apple's Platform Security guide on TLS describes how those evaluations work. Macs are "periodically updated with a current list of revoked and constrained certificates", and that information "is consulted whenever a network API function is used to make a secure connection".

Why there are several trustd processes

"Daemon and LaunchAgent" describes two kinds of copy. On our test Mac, running macOS 27.0.1, ps showed three, all from /usr/libexec/trustd and all started by launchd:

The exact number varies with the services running: when we checked again later the same day, the _locationd copy had exited and one was running under _cmiodalassistants instead. A process called trustd that runs from anywhere other than /usr/libexec/trustd is the one worth investigating. In Terminal, ps -axo user,pid,args | grep '[t]rustd' lists each copy with its account and path.

Why trustd uses the network

Apple's guide says that if a certificate authority has revoked too many certificates to list individually, a trust evaluation "may instead require that an online certificate status response (OCSP) is needed". Because trustd performs the evaluations, short connections from it to certificate status services are expected.

In a two-second nettop sample on our test Mac, none of the three copies had a network connection. Expect occasional, brief activity, not a constant stream.

Why trustd uses CPU

Each check is small, but the number of checks follows the secure connections other processes make. Opening many websites at once, a large sync or download, or an app that connects repeatedly can all make trustd busier for a while.

• Check what else is connecting. In Activity Monitor's Network tab, look for the app with the most activity at the same time.
• Give it a few minutes. Activity from a burst of connections settles when the burst ends.
• Restart if it stays busy for no reason. If trustd stays high with nothing connecting, restarting the Mac starts every copy fresh.

Quitting it is not a fix. When we quit the copy running under our account, the next secure connection started a new one within seconds.

Our guide to background processes on a Mac explains how to tell your own processes from system ones.

Frequently asked questions

Is trustd a virus?

No. It is a macOS service that runs from /usr/libexec/trustd and evaluates certificate trust. A process with that name running from anywhere else would be worth investigating.

Why are there several trustd processes?

Its manual page describes it as both a daemon and a launch agent. On our test Mac, one copy ran under the _trustd system account and one under the logged-in user, with others under system service accounts such as _locationd. The number varies.

Why is trustd connecting to the internet?

Apple says a trust evaluation can require an online certificate status response when a certificate authority has revoked many certificates. trustd performs those evaluations, so brief connections are expected.

Can I quit trustd?

You can, but it changes little. When we quit our own copy on macOS 27, the next secure connection started a new one within seconds. Find the app making the connections instead.