Nearby devices

What is sshd?

sshd is the OpenSSH server that macOS uses for Remote Login. When another computer logs in to this Mac with SSH, or copies files with SFTP or scp, the session goes through sshd.

Process: sshdAlso seen as: sshd-session, sshd-keygen-wrapperMade by OpenSSH project, shipped by AppleApplies to: macOS 14 Sonoma and later. Checked on macOS 27.2.Checked: 1 November 2026

Short answer

Part of macOS. It is the SSH server for Remote Login, so other computers can log in to this Mac with SSH or copy files with SFTP.

Safe to block

Safe to block if nobody logs in to this Mac remotely. It's cleaner to turn off Remote Login in Sharing settings.

Path
/usr/sbin/sshd /usr/libexec/sshd-keygen-wrapper
launchd label
com.openssh.sshd
Signing identifier
com.apple.sshd com.apple.sshd-keygen-wrapper

What it is

The man page calls sshd the OpenSSH daemon. It listens for connections from clients and forks a new daemon for each one, which handles encryption, authentication and the session.

On macOS, launchd starts it as com.openssh.sshd, through /usr/libexec/sshd-keygen-wrapper.

Apple's Remote Login article says that it lets you access the Mac from another computer with SSH or SFTP. Apple lists TCP port 22 for SSH, SFTP and scp.

Why it uses the network

  • Remote sessions. Commands typed in an SSH session, and their output, travel between the two computers.
  • File copies. SFTP, scp and rsync over SSH copy files to or from this Mac through sshd.
  • Tunnels. An SSH client can forward ports through the connection, so other traffic travels inside it.

How much is normal

With Remote Login off, macOS's built-in SSH service normally does not listen on port 22. Another service can still use that port.

An interactive session uses little data. File copies use as much as the files.

If you didn't turn on Remote Login, a management profile from your organization may have. Ask your administrator.

When it uses a lot, and why

  • File transfers. Copying a large folder with scp, SFTP or rsync over SSH sends every byte.
  • Port forwarding. Traffic that a client tunnels through SSH counts as sshd traffic on this Mac.
  • Login attempts. If port 22 is reachable from the internet, other computers can try to log in. Each attempt is small, but they can be frequent.

Is it safe to block?

Safe to block

Safe to block if nobody logs in to this Mac remotely. It's cleaner to turn off Remote Login in Sharing settings.

What breaks if you block it

  • SSH, SFTP and scp to this Mac stop working.
  • Tools that connect to this Mac over SSH, such as remote editors and deploy scripts, fail.

Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it.

Reduce its use

  1. Choose Apple menu › System Settings › General › Sharing.

  2. Turn off Remote Login if you don't use it.

  3. If you need it, click the Info button next to Remote Login. Choose “Only these users” and add only the users who need it.

  4. Don't make port 22 reachable from the internet unless you need it.

See how much it uses

  1. In Terminal, list the SSH connections to this Mac now.

    sudo lsof -nP -i :22

    Needs an administrator password.

  2. Open Activity Monitor from Applications › Utilities. Click Network, then search for sshd.

With Kilobat

  1. In the Kilobat app list, search for sshd. Its row shows the live rate and what it moved today.

  2. In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online.

  3. In Terminal, ask the same question. Add --json for scripts and agents.

    kilobat explain 'sshd'

  4. Show its traffic over one day.

    kilobat bandwidth 'sshd' day

  5. Through MCP, an AI agent asks explain_connection with the process name. It gets the same facts.

The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the network filter, Protection and the hotspot data saver.

Questions

Is sshd running on my Mac by default?

Remote Login is off unless you or your organization turned it on. Check System Settings › General › Sharing.

Does this page cover the ssh command?

No. ssh is the client that you run to connect to other computers. Kilobat writes reports after typed SSH sessions.

Sources

Checked on 1 November 2026.