nsurlsessiond on Mac: what it is, why it is high, what to do

What nsurlsessiond does

Apple gives apps a way to say "download this, even if I am closed," and the thing that actually does the downloading is nsurlsessiond. The name comes from NSURLSession, the networking framework; the d means daemon. When you start a 5 GB macOS update and go to lunch, nsurlsessiond fetches it. When Photos uploads a weekend of video to iCloud, nsurlsessiond carries it. When Mail downloads a large attachment, when the App Store updates ten apps overnight, when iCloud Drive pulls a folder down to a new Mac: the same process, every time.

Third-party apps use it too, and some use it heavily. Microsoft Office, Adobe's updaters, Dropbox-style sync tools and many games hand their big transfers to it. That is why the name appears in Activity Monitor with no obvious app attached: the app that asked may not even be running.

It runs per user and as a system daemon, so you may see two or three copies. That is normal.

Why nsurlsessiond is using CPU right now

1. A transfer is actually running. A macOS or App Store update, iCloud Photos uploading after an import, iCloud Drive syncing a big folder, Mail fetching a mailbox. Moving MB per second takes CPU for encryption and writing to disk. This is the common case and it ends by itself.
2. A new Mac or a fresh sign-in. Everything downloads at once for a day. Expect it to be busy on and off.
3. A transfer that keeps failing and retrying. A file that cannot upload (too large for iCloud, a permissions problem, a corrupt item), a server that keeps rejecting the connection, a network that drops out. nsurlsessiond retries with backoff, logs each failure, and in the worst cases runs hot with almost nothing moving. One Catalina user saw it "taking 60% of CPU" with no transfer they could identify.
4. The certificate validation loop. nsurlsessiond is the process that fetches certificate revocation data for trustd. On a network where that connection is blocked or slow (VPN, firewall, captive portal), both run hot and syslogd joins in to write the logs. Jeff Johnson's 2021 investigation found that "the issue can be temporarily solved by preventing nsurlsessiond from connecting to valid.apple.com," which tells you where the loop lives, though blocking Apple's servers is not a fix anyone should keep.
5. A third-party app that downloads constantly. One developer forum report found it had "consumed excessive data (75GB+) while Microsoft Office was installed." An updater or telemetry component stuck in a loop looks exactly like this: gigabytes a day, no visible app.

What it is not: malware. It is part of macOS and cannot be replaced. Any page offering to "remove nsurlsessiond" is selling a cleaner.

What normal looks like, and what is not

CPU alone does not tell you much here. Pair it with the Network tab in Activity Monitor, which shows bytes received and sent per process:

To see the traffic: Activity Monitor, Network tab, sort by Rcvd Bytes or Sent Bytes. nsurlsessiond at the top with a number that keeps growing is a live transfer. Then ask which app: check System Settings, General, Software Update for a download in progress; Photos for an "Uploading" line at the bottom of the Library; Finder's iCloud Drive for progress circles; and the App Store's Updates page.

On a laptop, large transfers pause when the Mac sleeps, so a 20 GB upload that only runs while the lid is open can take days of calendar time and look like a process that never stops.

Is it safe to quit nsurlsessiond?

Yes, nothing breaks. It restarts a moment later and the transfer resumes from where it stopped, because background transfers are designed to survive exactly this. It is also pointless for the same reason: the work is still queued. People who force quit it every hour are watching the same upload restart every hour.

The Terminal advice in some videos, disabling the daemon with launchctl, breaks App Store updates, iCloud sync and Mail attachments all at once. Skip it. The decision tree is the general rule:

The thing to pause is the app at the source: iCloud Photos, iCloud Drive, the App Store update, or the third-party tool. Pause that and nsurlsessiond has nothing to do.

What to do, in order

1. Look at the Network tab

   Activity Monitor, Network, sort by Rcvd Bytes. If nsurlsessiond is moving data steadily, something is transferring. Find it: Software Update, Photos (bottom of Library), Finder iCloud Drive, App Store Updates, Mail activity window (Window, Activity).

2. Let it finish, or pause the source

   An update or a photo upload ends on its own. If you need the bandwidth now, pause iCloud Photos in Photos, Settings, iCloud (Pause for one day), or pause the App Store update. Resume later.

3. Check the network path

   If CPU is high with almost no traffic, turn off any VPN, DNS filter or firewall app and leave any Wi-Fi with a login page. If nsurlsessiond and trustd both calm down, the validation loop was the cause.

4. Restart

   Clears a transfer stuck in retry and resets the daemon. The most reliable fix for the stuck case.

5. Find the app that uses the data

   If gigabytes a day keep moving with no Apple app to blame, look for third-party updaters: Office, Adobe, Google, game launchers. Quit or update them one at a time and watch the Network tab. One of them will be it.

6. Sign out of iCloud and back in, last resort

   Only if a specific iCloud upload has been stuck for days after a restart. System Settings, your name, Sign Out, keep a copy of data when asked, then sign back in. Expect a day of re-sync afterwards, which is why this is last.

When to worry

nsurlsessiond is not a security problem, but what it moves can be worth a look:

• Data caps. On a metered or tethered connection, a looping updater can burn gigabytes a day. The Network tab catches it. Pause iCloud Photos and large updates when on a phone hotspot.
• Battery. Uploads on battery drain fast. Do big syncs on power.
• Stuck for days. If the same file never finishes uploading to iCloud, open iCloud.com, check whether it is there, and consider moving it out of the synced folder. Files over iCloud's size limit never finish.
• High CPU with trustd and syslogd. The certificate loop. Fix the network, restart.

Safe to Quit records each process's network traffic alongside its CPU over hours, so a transfer that runs all night shows up as a line you can read in the morning, with the app that started it, instead of a number you happened to catch.