What is WindowServer on Mac?

What WindowServer does

WindowServer is the macOS display server. It lives at /System/Library/PrivateFrameworks/SkyLight.framework/Resources/WindowServer and runs as the _windowserver user. Apps draw their own content, but WindowServer composites all those windows together, applies shadows, blur and transparency, moves the cursor, runs Mission Control and Spaces animations, and pushes the final frame to each display. It also tracks which app is frontmost and which is hung.

Because it does work on behalf of every app, its CPU is the sum of how much the whole desktop is changing.

Why it uses a lot of CPU

• Displays: two or three external screens, a 5K/6K panel, or a scaled “More Space” resolution. A 120 Hz ProMotion screen redraws twice as often as 60 Hz.
• Transparency and blur: the menu bar, Dock, sidebars and Control Center all blur what’s behind them, which has to be recomputed when content moves.
• Something redrawing nonstop: a web page with animations, a progress spinner, a terminal tailing logs, a menu bar app updating many times a second.
• Screen sharing and recording: Zoom, Teams, OBS and Screen Sharing capture frames through WindowServer.
• Lots of windows and Spaces: hundreds of Finder or browser windows across many desktops.
• Animated wallpapers: the Sonoma-and-later aerial wallpapers animate on the desktop and lock screen.

How to make it calm down

1. Quit apps one at a time and watch WindowServer’s CPU in Activity Monitor. A big drop names the culprit, often a browser tab or an Electron app.
2. Turn on System Settings › Accessibility › Display › Reduce transparency, and optionally Reduce motion.
3. Use the default resolution for external displays (System Settings › Displays), not a scaled one.
4. Switch to a still wallpaper.
5. Close windows you don’t need, and merge extra Spaces.
6. If you use Stage Manager, try it off for a while; see WindowManager.

To sample what WindowServer is busy with when it spikes:

sudo spindump WindowServer 5 -file ~/Desktop/ws.txt

When to worry

Malware has no reason to pose as WindowServer, but you can confirm it’s Apple’s:

ps -o user,pid,command -p $(pgrep -x WindowServer)
codesign -dv --verbose=2 /System/Library/PrivateFrameworks/SkyLight.framework/Resources/WindowServer

The user should be _windowserver and the authority Software Signing. Worry instead if WindowServer sits above 60% with nothing on screen moving: that usually means a broken display, cable or dock, or a GPU issue worth a restart and an update.

Seeing it in Stat Space

Because WindowServer’s load is caused by other apps, it helps to see both at once. Stat Space’s Apps tab groups every helper under its app (all of Chrome’s renderers under Chrome, for example), so the app driving WindowServer is easier to spot. It also flags apps that WindowServer marks as not responding, with a Force Quit button, so you don’t have to restart the whole session.