cfprefsd on Mac: the preferences daemon, why it spikes, and which app is to blame

What cfprefsd does

cfprefsd is short for Core Foundation preferences daemon. On a Mac, apps do not write their own settings files directly. They call the CFPreferences or NSUserDefaults API, which hands the change to cfprefsd, and cfprefsd writes it into the right .plist file inside ~/Library/Preferences (for your settings) or /Library/Preferences (for system-wide ones). Centralizing this means two apps cannot corrupt the same file by writing at once, settings are cached in memory so reads are fast, and any app watching a setting is told immediately when it changes.

That is why there are usually two copies in Activity Monitor: one running as you, handling your apps, and one running as root, handling system services. Both should be idle almost all the time. Changing a setting in System Settings, launching an app, or switching Wi-Fi networks produces a flicker of activity that is over before you can read the number.

Apple's own documentation for the daemon is one line long: it "provides preferences services for the CFPreferences and NSUserDefaults APIs" and has no configuration options. There is nothing to tune, and nothing you can do to it directly. Everything that makes it busy comes from the apps that talk to it.

What normal looks like

cfprefsd is a mirror. Its CPU tells you how often something is asking it to read or write settings, so the useful question is always "what is asking?":

Memory is the other symptom people hit. A poster on Mac-Forums in 2022 found cfprefsd was the process using most of their RAM and that swap was being used constantly; the thread they were pointed to explained how to see which files it was writing. Memory growth comes from the same cause as CPU: a huge or constantly changing preferences file held in cache.

Why cfprefsd is using CPU right now

cfprefsd never gets busy on its own. Something is calling it in a loop, and in practice it is one of these:

1. An app with a preferences bug. The classic pattern is an app that saves its state every time a timer fires or a window moves, hundreds of times a second. Developers see this in their own bug trackers: a Godot engine issue from 2020 reported that cfprefsd "regularly jumps to 100%" and that merely launching the app was enough to trigger it. Any app can do this: editors, launchers, menu bar utilities, older versions of chat apps.
2. A menu bar helper or background agent. Small utilities that poll something every few milliseconds and store the result in defaults. Because they have no window, they are easy to forget about.
3. A corrupt or enormous plist. If one preferences file is damaged, cfprefsd can fail to parse it, retry, and fail again. The historic case was the Bluetooth preferences file on older macOS versions, which pinned cfprefsd above 90 percent until it was cleared.
4. A sync tool fighting over Preferences. Dropbox, iCloud Drive or a backup tool syncing a folder that contains plists can trigger a write, a change notification, and another write, forever.
5. Right after a migration or update. Hundreds of apps re-reading and rewriting their defaults at once. This case ends on its own within an hour.

What it is not: malware. cfprefsd is an Apple component on every Mac, and no cleaner app will fix a write loop in someone else's software.

Is it safe to quit cfprefsd?

Yes. Quitting cfprefsd from Activity Monitor is harmless: launchd restarts it within a second, apps reconnect automatically, and settings that were already written stay written. It is one of the few system daemons where force quit does no damage. It is also one of the least useful things you can do, because the app that was hammering it is still running and starts again as soon as the new cfprefsd is up. People who force quit it report the CPU dropping for a few seconds and climbing straight back.

Quit the app instead. If you do not know which app, the steps below find it in a few minutes. What you should not do is delete preferences files at random in your Library folder: you will lose settings, and unless you hit the one bad file you will not fix anything. Leave System Integrity Protection and Terminal out of it entirely.

Type any process name above to check whether it is one you can quit, one that relaunches, or one to leave alone. For cfprefsd the answer is "quit the app, not the daemon."

What to do, in order

1. Quit apps one at a time

   Open Activity Monitor, sort by CPU and keep it visible. Quit your open apps one by one, starting with anything recently installed or updated, and watch cfprefsd after each. When it drops to zero, you have found the app. Do not forget menu bar utilities; quit those from their own menus.

2. Check background items

   If quitting visible apps did not help, open System Settings, General, Login Items & Extensions. Turn off background items you do not recognize or need, one at a time, watching cfprefsd. Our background items page explains what each kind is.

3. Update the app that did it

   Preferences write loops are bugs, and they usually get fixed. Update the app from the App Store or its own updater. If it is already current, report it to the developer with the words "cfprefsd 100 percent CPU"; they will know what it means.

4. Reset that app's preferences, carefully

   If updating does not help and the app still pins cfprefsd, quit the app, then move only that app's .plist file from ~/Library/Preferences to the Desktop and relaunch the app. It will recreate clean defaults. Put the file back if nothing improved, so you keep your settings.

5. Restart if it is everything at once

   Right after a migration or a big update, many apps rewrite settings at the same time. Give it an hour on power. If cfprefsd is still high afterwards, restart the Mac; that clears a corrupt cached state in one go.

When to worry

cfprefsd costs you fan noise and battery while it loops, and it can make the Mac feel laggy because every app waiting on a setting is queued behind the loop. It does not damage data. The question is only how long you tolerate it before hunting the app:

The hard part is catching which app started it, because cfprefsd takes the blame in Activity Monitor and the real culprit may show only a few percent. Safe to Quit watches processes over time and shows what was busy alongside what, which usually points straight at the app.