What is nsurlsessiond on Mac?
nsurlsessiond is a download manager that apps hand their background transfers to. If it’s at the top of the network list, it’s downloading for someone else: a macOS update, Photos, iCloud, the App Store, Music or a third-party app.
Updated
- Process
nsurlsessiond- Comes from
- macOS
- Safe?
- Safe. A system download service; quitting it pauses transfers, which resume later.
What nsurlsessiond does
When an app starts a background transfer with Apple’s URLSession API, the app doesn’t do the download itself. It hands the request to nsurlsessiond (/usr/libexec/nsurlsessiond), which keeps the transfer going even if the app quits, retries on network changes, and wakes the app when the file is ready. There is one instance for the system and one per user.
So nsurlsessiond’s network use is really someone else’s:
- macOS and app updates, together with softwareupdated and the App Store
- iCloud Photos originals and other iCloud assets
- Music, TV and Podcasts downloads
- on-device models for Apple Intelligence, dictation and Siri
- third-party apps that download in the background
Why it gets busy
- A new macOS release, often several GB, downloading automatically.
- Signing in to iCloud on a new Mac, especially with Photos set to Download Originals.
- Apple Intelligence or other model assets downloading after you enable a feature.
- An app with a large background sync.
How to find the app behind it
The log usually names the requesting app’s bundle ID:
/usr/bin/log stream --process nsurlsessiond --style compact | grep -oE '<[A-Za-z0-9.-]+>|com\.[A-Za-z0-9.-]+' | sort | uniq -c | sort -rn | head
See live throughput and connections:
nettop -P -p nsurlsessiond
Check for a pending macOS update:
softwareupdate --list
How to make it calm down
- Pause the source: in Photos choose Optimize Mac Storage, pause Music downloads, or postpone the update in System Settings › General › Software Update › Automatic Updates (ⓘ).
- On a metered connection, turn on Low Data Mode for that network in System Settings › Wi-Fi › Details (or the network’s Details for Ethernet or iPhone hotspot).
- Quit nsurlsessiond in Activity Monitor for a quick pause. Transfers resume when it relaunches.
When to worry
The real binary is /usr/libexec/nsurlsessiond, signed by Apple:
codesign -dv --verbose=2 /usr/libexec/nsurlsessiond 2>&1 | grep -E 'Identifier|Authority'
Large uploads (not downloads) that you can’t explain are worth tracing to an app. Usually it’s iCloud Photos or a backup tool, but the log above will tell you.
Seeing it in Stat Space
Stat Space’s network module shows up and down speed in the menu bar and keeps daily usage per interface for 90 days. With Pro, per-app network shows upload and download per app with totals since launch, which makes a multi-GB background download easy to catch before it eats a hotspot allowance.
Questions
Why is nsurlsessiond using so much data?
It downloads on behalf of other apps. The usual big ones are macOS updates, iCloud Photos originals, Apple Intelligence or dictation models, Music downloads and Xcode components.
Can I block nsurlsessiond?
You can with a firewall like Little Snitch or LuLu, but many apps’ background downloads then silently fail. Pausing the source app is the cleaner fix.
Does Low Data Mode stop it?
It reduces it. Apps that respect Low Data Mode defer background transfers, and macOS postpones automatic update downloads. Not every app honors it.
Know what your Mac is doing, without adding to it.
Free, no account. Pro is $9.99 once for the first 100 buyers.