What is launchd on Mac?

What launchd does

launchd (/sbin/launchd) is PID 1. The kernel starts it, and it starts everything else: system daemons, your login session, apps you open, XPC services, and scheduled jobs. It replaces what init, cron and inetd do on other Unix systems. Each job is described by a property list (.plist) that says what to run and when: at boot, at login, on a schedule, when a file changes, when a socket gets a connection, or “keep it alive” always.

You may also see one launchd per user session in older guides; on current macOS the per-user domains are managed by PID 1 itself.

Why it uses CPU

launchd on its own does almost nothing. When it shows real CPU, the common causes are:

• A crash loop: a job with KeepAlive that exits immediately, so launchd restarts it every few seconds. Old updaters and uninstalled apps that left their plist behind are classic culprits.
• A job on a tight timer: StartInterval of a few seconds, or WatchPaths on a folder that changes constantly.
• Spawning lots of short processes: a build or a script launching thousands of commands goes through launchd’s process bookkeeping.

How to find the job and fix it

List jobs in your session and look at the second column (last exit status). Non-zero numbers that keep changing mean crashes:

launchctl list | awk '$2 != 0' | grep -v com.apple

Check the three third-party folders:

ls ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons

Find what a job runs:

plutil -p ~/Library/LaunchAgents/com.example.updater.plist

Stop and remove one you don’t want (replace the label and file):

launchctl bootout gui/$(id -u)/com.example.updater
rm ~/Library/LaunchAgents/com.example.updater.plist

For items in /Library, use sudo launchctl bootout system/<label> and sudo rm. Also review System Settings › General › Login Items & Extensions, which shows apps allowed to run in the background.

Crash reports from a looping job land in ~/Library/Logs/DiagnosticReports, which helps confirm which one it is.

When to worry

PID 1 is always launchd and always Apple’s; nothing can replace it on a Mac with System Integrity Protection on. What can be malicious is a job launchd runs. Plists that run something from /tmp, /Users/Shared, a hidden folder or a random-looking name in ~/Library/Application Support deserve a close look:

codesign -dv --verbose=2 /path/to/the/program

Seeing it in Stat Space

Stat Space’s Apps tab lists startup items from the three LaunchAgents and LaunchDaemons folders, with a link to Login Items settings. Its orphan sweep finds dev processes (node, python, vite and similar) that were re-parented to launchd after their terminal or agent closed, and stops them only after you confirm. It never touches system processes.