Updates and downloads

What is nsurlsessiond?

nsurlsessiond is the macOS daemon that runs background transfers for apps. When an app asks macOS to download or upload in the background, the bytes show under nsurlsessiond, not under the app.

Process: nsurlsessiondMade by AppleApplies to: macOS 14 Sonoma and later. Checked on macOS 27.2.Checked: 1 November 2026

Short answer

Part of macOS. It does background downloads and uploads that apps hand to macOS, so its traffic belongs to those apps.

Block with care

Blocking it stops the background downloads and uploads of every app that hands transfers to macOS. Pause the one app instead.

Path
/usr/libexec/nsurlsessiond
launchd label
com.apple.nsurlsessiond com.apple.nsurlsessiond_privileged
Signing identifier
com.apple.nsurlsessiond

What it is

The man page calls it “the background NSURLSession daemon”. It runs the transfers of apps that use background URL sessions. It is a per-user daemon, and macOS starts it on demand.

The program is /usr/libexec/nsurlsessiond, signed by Apple. launchd starts one copy for each user, labelled com.apple.nsurlsessiond. A second copy, com.apple.nsurlsessiond_privileged, works for the system.

Apple's developer documentation says that background transfers continue while the app is suspended. macOS does the transfer for the app. Because of this, Activity Monitor and nettop show the traffic under nsurlsessiond.

The man page says that it has no options and that users should not run it manually.

Why it uses the network

  • Downloads for apps. Any app can give a long download to macOS. Podcast episodes, music, app content and large files are common examples. The app can quit or sleep while the download runs.
  • Uploads for apps. Apple's documentation for background sessions covers uploads as well as downloads. The bytes then go up under nsurlsessiond, not under the app.
  • Transfers that waited for a better time. An app can mark a transfer as discretionary. Apple says that the system then picks a good time, for example when the Mac is on power and Wi-Fi.

How much is normal

Some nsurlsessiond traffic is a normal part of macOS. The amount depends only on what your apps asked for. With no pending transfers, it is quiet.

Expect a burst after you subscribe to a podcast or add music for offline listening. An app that downloads its content on first launch can cause one too.

Look closer when it moves gigabytes on a hotspot, or when it never stops. Then find the app that asked for the transfer.

When it uses a lot, and why

  • Discretionary transfers start together. Transfers that waited for power and Wi-Fi can all start when you connect the charger or join your home network. Apple documents this behaviour for discretionary sessions.
  • Media for offline use. Podcast and music apps download episodes and songs in the background. A new subscription or a downloaded playlist can add up quickly.
  • Downloads scheduled for later. Apple lets an app give a download a start time. The transfer then begins at that time or later, often when nobody is watching. Transfers that an app starts while it is in the background always run when the system chooses.

Is it safe to block?

Block with care

Blocking it stops the background downloads and uploads of every app that hands transfers to macOS. Pause the one app instead.

What breaks if you block it

  • Background downloads in apps that use it, such as podcast episodes and media for offline use, wait or fail.
  • Background uploads from those apps wait or fail.
  • Each app decides what to show when the transfer fails, so the error may not name the network.

Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it.

Reduce its use

  1. Find the app that asked for the download. Think about what you started just before, for example a podcast subscription.

  2. Pause or cancel the download in that app. Turn off its automatic downloads in its settings.

  3. On a hotspot or a capped plan, turn on Low Data Mode. Choose Apple menu › System Settings › Wi-Fi. Click Details next to the network, then turn on Low Data Mode.

  4. Apple lets each app decide whether it uses a Low Data Mode network. Some apps continue. See Use Low Data Mode on a Mac.

  5. Don't quit nsurlsessiond in Activity Monitor. It works for many apps at the same time, and macOS starts it again.

See how much it uses

  1. Open Activity Monitor from Applications › Utilities. Click Network.

  2. Type nsurlsessiond in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started.

  3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

    nettop -p 'nsurlsessiond' -P

With Kilobat

  1. In the Kilobat app list, search for nsurlsessiond. It is in the System downloads group, with one line about what it does.

  2. With the network filter on, click the service. The panel names the apps that the downloads were for, for example “For Music”.

  3. Without the filter, macOS shows only the service. Then Kilobat can't say which app a download was for.

  4. In Connections, click ⓘ on one of its rows. The popover shows this answer without going online.

  5. Ask the same question in Terminal. Add --json for scripts and agents.

    kilobat explain nsurlsessiond

  6. Show its traffic over one day.

    kilobat bandwidth nsurlsessiond day

  7. With Kilobat Pro, the Travel profile on a metered network pauses system downloads that can wait. See the hotspot data saver.

The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the network filter, Protection and the hotspot data saver.

Questions

Is nsurlsessiond a virus?

The genuine macOS nsurlsessiond is in /usr/libexec, signed by Apple and has a man page. Open it with man nsurlsessiond; check the process path and signature if unsure.

Why does nsurlsessiond use data when no app is open?

Background transfers continue while the app is suspended or closed. Apple designed them for this, so the app does not have to stay open.

How do I find which app nsurlsessiond downloads for?

Activity Monitor and nettop show only the service. Kilobat with its network filter on names the app, for example “For Music”.

Sources

Checked on 1 November 2026.