--- title: "secd: what it is, why iCloud Keychain uses the network, and whether to block it · Kilobat" url: "https://kilobat.app/processes/secd" description: "secd controls access to the keychain on a Mac. Why iCloud Keychain sync can show under it, and what breaks if you block it." --- Security and accounts # What is secd? `secd` is the keychain agent of macOS. Every app that uses the keychain talks to it. With iCloud Keychain on, your passwords, Wi-Fi passwords and other synced items travel between your devices through iCloud. Process: `secd` · Made by Apple · Applies to: macOS 14 Sonoma and later. Checked on macOS 27.2. · Checked: 1 November 2026 ## Short answer Part of macOS. It controls access to keychain items. With iCloud Keychain on, your passwords and other synced items travel between your devices. Don’t block Don't block it. Apps that use the keychain depend on it, and iCloud Keychain sync stops. Path `/usr/libexec/secd` launchd label `com.apple.secd` Signing identifier `com.apple.secd` ## What it is The man page calls `secd` the “centralised keychain agent”. It controls access to and modification of keychain items, and anyone who needs the keychain talks to it. The program is `/usr/libexec/secd`, started for each user as `com.apple.secd`. Apple Platform Security says that synced keychain items are exchanged through CloudKit or iCloud key-value storage. Each item is encrypted so that only devices in your circle of trust can read it, not Apple. Apple doesn't say which process does the iCloud Keychain upload. This page links `secd` to it because it is the keychain agent. ## Why it uses the network - **iCloud Keychain sync.** Apple says that iCloud Keychain keeps website logins, credit cards and Wi-Fi network information up to date across your devices. - **Only marked items.** Apple says that only items marked as synchronizable sync. Safari data and Wi-Fi passwords are; most items that other apps add are not, unless the app asks. ## How much is normal Small, occasional sync traffic is usual with iCloud Keychain on. Keychain items are small. Adding a device makes the devices exchange items so that all of them have the same keychain. With iCloud Keychain off, synced items stay on the Mac. ## When it uses a lot, and why - **A new device joins.** Apple says that as new devices join, each peer syncs with the new one so that all have the same items. - **Not large.** Even a big keychain is small next to photos or files. ## Is it safe to block? Don’t block Don't block it. Apps that use the keychain depend on it, and iCloud Keychain sync stops. What breaks if you block it - Passwords, passkeys and Wi-Fi passwords stop syncing with your other devices. - New devices can't join your iCloud Keychain. - Apps on this Mac that read the keychain may fail if keychain access is affected. Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it. ## Reduce its use 1. To stop syncing passwords on this Mac, choose Apple menu › System Settings. Click your name, then iCloud. 2. Click Passwords, then turn off “Sync this Mac”. 3. Don't quit `secd` in Activity Monitor. Apps that use the keychain depend on it. ## See how much it uses 1. Open Activity Monitor from Applications › Utilities. Click Network. 2. Type `secd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started. 3. In Terminal, watch only this process. Press d to show the change per second, and q to quit. ``` nettop -p 'secd' -P ``` ## With Kilobat 1. In the Kilobat app list, search for `secd`. Its row shows the live rate and what it moved today. 2. In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online. 3. In Terminal, ask the same question. Add `--json` for scripts and agents. ``` kilobat explain 'secd' ``` 4. Show its traffic over one day. ``` kilobat bandwidth 'secd' day ``` 5. Through MCP, an AI agent asks `explain_connection` with the process name. It gets the same facts. The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the [network filter](https://kilobat.app/docs/blocking#filtering), [Protection](https://kilobat.app/docs/blocking#protection) and the [hotspot data saver](https://kilobat.app/save-hotspot-data). ## Hosts it contacts Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac. - [*.apple-cloudkit.com](https://kilobat.app/hosts/apple-cloudkit-com): Apple's CloudKit service. Apps sync their iCloud data through it, and Apple lists api.apple-cloudkit.com for app notarization on macOS. ## Questions **Can Apple read my iCloud Keychain?** Apple says that each synced item is encrypted so that only devices in your circle of trust can decrypt it, not Apple. **Do all keychain items sync?** No. Apple says that some items, such as iMessage keys, stay on the device. Third-party apps' items don't sync by default. ## Sources - secd(8), man page installed with macOS 27.2 - launchd property list com.apple.secd, macOS 27.2 - [Apple Platform Security: Secure keychain syncing](https://support.apple.com/guide/security/secure-keychain-syncing-sec0a319b35f/web) - [Apple Support: Set up iCloud Keychain to autofill information on Mac](https://support.apple.com/guide/mac-help/set-icloud-keychain-autofill-information-mac-mh43699/mac) Checked on 1 November 2026. ## Related - [akd](https://kilobat.app/processes/akd): Part of macOS, not documented by Apple. It is the AuthKit daemon, and its launchd services cover Apple Account sign-in and Sign in with Apple. - [cloudd](https://kilobat.app/processes/cloudd): Part of macOS. It syncs the iCloud data of apps that use CloudKit, so its traffic belongs to those apps.