macOS processes

What is nsurlsessiond on Mac?

Q: Is nsurlsessiond a virus?

No. It is part of macOS, in /usr/libexec, and it has a man page. Open it with man nsurlsessiond.

nsurlsessiond is part of macOS. It does background downloads and uploads for apps. Its traffic belongs to the app that asked for the transfer.

Process: nsurlsessiondApplies to: All current macOS versions. Seen on macOS 27.2.Checked: 29 October 2026

Where you see it

nsurlsessiond is in the list in Activity Monitor › Network, in nettop or in Kilobat.
A firewall or network monitor asks if nsurlsessiond can connect.
A hotspot or data plan runs out, and nsurlsessiond has the most bytes.

What it is

The nsurlsessiond man page calls it “the background NSURLSession daemon”. It is a per-user daemon. It does the tasks of apps that use background URL sessions.

Apps use background sessions for long transfers. Apple's documentation says that these tasks continue when the app is suspended. Because macOS does the transfer, Activity Monitor shows the traffic under nsurlsessiond, not under the app.

The program is /usr/libexec/nsurlsessiond, signed by Apple. The man page says that it has no options and that users should not run it manually.

Why it uses the network

Downloads for apps. Any app can give a download to it. Kilobat's documentation names Music and Podcasts as common examples.
Uploads for apps. Apple's documentation says that background sessions can do HTTP and HTTPS uploads too.
Transfers that waited for a better time. Apple says that the system can delay a large discretionary transfer, for example until the Mac has power and Wi-Fi.

Is it normal?

Yes. nsurlsessiond traffic is a usual part of macOS. The amount depends on what the apps asked for.

Look closer when it moves gigabytes on a hotspot, or when it never stops. Then find the app that asked for the transfer.

See how much it uses

Open Activity Monitor from Applications > Utilities. Click Network.
Type nsurlsessiond in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
In Terminal, watch only this process. Press d to show the change per second, and q to quit.
```
nettop -p nsurlsessiond -P
```
Activity Monitor and nettop do not show which app asked for the transfer. Think about what you started just before, for example a podcast download.

Reduce or pause it safely

Find the app that asked for the download. Pause or cancel the download in that app.
Turn off automatic downloads in the settings of that app.
On a hotspot or a capped network, turn on Low Data Mode. Choose Apple menu > System Settings > Wi-Fi. Click Details next to the network, then turn on Low data mode.
Apple's documentation lets each app decide whether it uses a Low Data Mode network. Some apps continue. See Use Low Data Mode on a Mac.
Do not quit nsurlsessiond in Activity Monitor. It is part of macOS, and other features depend on it. It works for many apps at the same time.

With Kilobat

Open the Kilobat app list and search for nsurlsessiond. Its row shows the live rate and the bytes it moved.
Kilobat puts this service in the System downloads group, with one line about what it does. Expand the group to see each service.
With the network filter on, click the service. The panel names the apps that the downloads were for, for example “For Music”.
Without the filter, macOS shows only the service. Then Kilobat cannot say which app a download was for.
In Terminal, see the same live list. Press / and type the name to search.
```
kilobat status --watch
```
Show its traffic over one day. Names match kilobat report --summary.
```
kilobat bandwidth nsurlsessiond day
```
Through MCP, an AI agent gets the same history with get_app_bandwidth and the name nsurlsessiond.
The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

Questions

Is nsurlsessiond a virus?

No. It is part of macOS, in /usr/libexec, and it has a man page. Open it with man nsurlsessiond.

Why does nsurlsessiond use data when no app is open?

Background transfers continue when the app is suspended. Apple designed them for this. The app does not have to stay open.

How do I find which app nsurlsessiond downloads for?

macOS tools show only the service. Kilobat with its network filter on names the app, for example “For Music”.

Sources

nsurlsessiond(8), man page installed with macOS 27.2
Apple Developer: Downloading files in the background
Apple Developer: URLSessionConfiguration background(withIdentifier:)
Apple Developer: URLSessionConfiguration isDiscretionary
Apple Developer: URLSessionConfiguration allowsConstrainedNetworkAccess
Apple Support: View network activity in Activity Monitor on Mac
nettop(1), man page installed with macOS 27.2
Kilobat docs: System downloads

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with man <name> in Terminal.