Core networking

What is timed?

timed keeps the Mac's clock correct. It uses NTP, the Network Time Protocol, so it sends small requests to a time server, by default Apple's.

Process: timedMade by AppleApplies to: macOS 14 Sonoma and later. Checked on macOS 27.2.Checked: 1 November 2026

Short answer

Part of macOS. It keeps the clock correct with NTP, so it sends small requests to a time server such as time.apple.com.

Don’t block

Don't block it. A wrong clock makes valid certificates look expired, so secure websites and apps fail.

Path
/usr/libexec/timed
launchd label
com.apple.timed
Signing identifier
com.apple.timed

What it is

The man page says that timed “maintains system clock accuracy by synchronizing the clock with reference clocks via technologies like NTP”. It first appeared in macOS 10.13.

It reads the NTP server from /etc/ntp.conf. The Date & Time settings change that server.

The program is /usr/libexec/timed. Its launchd property list, com.apple.timed, runs it as the _timed user, every hour, and when Airplane Mode changes.

Why it uses the network

  • Clock synchronization. It asks a time server for the correct time. Apple lists UDP port 123 for NTP.
  • Regular checks. Its launchd property list starts it every hour and when Airplane Mode changes. Each start can mean a short exchange with the time server.
  • Apple's time servers. Apple lists time.apple.com for all its devices, and time-macos.apple.com for macOS only.

How much is normal

The requests are tiny. A time request and its answer are a few small packets.

Its launchd property list asks for a run every hour, so you see short, regular bursts.

If you set another time server in Date & Time, its requests go there instead.

When it uses a lot, and why

  • Never heavy. NTP packets are small. If timed shows large traffic, measure it with the steps below and look at what else runs.

Is it safe to block?

Don’t block

Don't block it. A wrong clock makes valid certificates look expired, so secure websites and apps fail.

What breaks if you block it

  • The clock drifts. Secure websites can then show certificate errors, such as ERR_CERT_DATE_INVALID.
  • Sign-ins and other features that check the time may fail.
  • Apple doesn't list a fallback for macOS without NTP.

Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it.

Reduce its use

  1. There is nothing to reduce. Keep it on. See “This Connection Is Not Private” and certificate warnings on a Mac.

  2. To change the time server, choose Apple menu › System Settings › General › Date & Time.

  3. On a network that blocks NTP, set a time server that the network allows.

  4. Don't quit timed in Activity Monitor. macOS starts it again.

See how much it uses

  1. Open Activity Monitor from Applications › Utilities. Click Network.

  2. Type timed in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started.

  3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

    nettop -p 'timed' -P

With Kilobat

  1. In the Kilobat app list, search for timed. Its row shows the live rate and what it moved today.

  2. In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online.

  3. In Terminal, ask the same question. Add --json for scripts and agents.

    kilobat explain 'timed'

  4. Show its traffic over one day.

    kilobat bandwidth 'timed' day

  5. Through MCP, an AI agent asks explain_connection with the process name. It gets the same facts.

The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the network filter, Protection and the hotspot data saver.

Hosts it contacts

Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac.

time.apple.comApple's time servers. Macs use NTP on UDP port 123 to set their date and time from them.Apple →

Questions

What happens if the clock is wrong?

Secure websites can show certificate errors, such as ERR_CERT_DATE_INVALID in Chrome. See NET::ERR_CERT_DATE_INVALID in Chrome on Mac.

Why do I see timed every hour?

Its launchd property list, com.apple.timed, has a start interval of 3600 seconds. That is one hour.

Can I use my company's time server?

Yes. Set it in Date & Time. timed reads the server from /etc/ntp.conf, which that setting changes.

Sources

Checked on 1 November 2026.