rapportd on Mac: what it is, why it wants incoming network connections, and whether to allow it

What rapportd does

Continuity is the set of features that make your Apple devices behave like one: copy on the iPhone and paste on the Mac, start an email on the iPad and finish it on the Mac, use the iPad as a second display, move the mouse off the edge of the Mac onto the iPad, use the iPhone as a webcam, unlock the Mac with a Watch. Every one of those needs the Mac to know which of your devices are nearby and to open a fast, encrypted link to them. rapportd is the daemon that does the finding and the linking. The name comes from Apple's private Rapport framework.

It uses Bluetooth Low Energy to notice a device in range, then your local Wi-Fi network for the heavier traffic, which is why it needs to accept incoming connections: your iPad connects to your Mac directly when you start Sidecar. The connections are peer-to-peer, between devices signed in to the same Apple Account, and encrypted. Nothing is routed through the internet. On a 2025 Apple Community thread about Little Snitch alerts, a longtime regular summed it up: rapportd is part of normal operations, associated with Apple's Continuity and iCloud-related features.

Why rapportd is using CPU right now

Most of the time it is not CPU that brings people here; it is a prompt. Both are covered:

1. The macOS firewall just got turned on, or macOS was updated. With the firewall on, macOS asks about any process that listens for incoming connections. rapportd listens on a local port, so it asks. Updates can replace the binary, which resets the earlier answer and prompts again.
2. Little Snitch or another outbound firewall. Those tools flag rapportd's connections to other devices on the local network and to Apple. The 2019 and 2025 Apple Community threads quoted below are both this case.
3. A device reconnecting in a loop. An iPad or iPhone with a weak Bluetooth link, a Watch at the edge of range, or an old device on the account that keeps appearing and disappearing makes rapportd re-discover it over and over. This is the usual cause of real CPU.
4. Sidecar, Universal Control or Continuity Camera in use. Active use costs a few percent the whole time; that is the feature working.
5. Many Apple devices on one network. A household or office full of iPhones and Macs means rapportd has more to track. Still low, but not zero.
6. A macOS bug. Rare, and it shows up as a flood of reports after a major update. Fixed in a point release.

What normal looks like

Compare the rapportd figure to these bands, with no Continuity feature in active use:

On a MacBook the cost that matters is not CPU but radio: a reconnect loop keeps Bluetooth and Wi-Fi busy, which shows as battery drain with the lid open and nothing running. If the drain lines up with a particular device being nearby, that device is the cause. MacBook battery draining fast lists the other background radios in the same category, and bluetoothd is the process that moves in step with rapportd when Bluetooth is the problem.

Is it safe to quit rapportd?

Quitting does no harm, and it fixes nothing. rapportd is a system daemon under launchd and relaunches in a second. While it is down, Handoff, Universal Clipboard, Sidecar, Universal Control, Continuity Camera and Watch unlock all stop, and when it comes back it re-discovers every device, which is a brief burst of exactly the activity you were trying to stop. The verdict is leave.

What you can safely control is the features. System Settings, General, AirDrop & Handoff has the Handoff switch; turning it off removes most of what rapportd does and it goes quiet. Turning Bluetooth off does the same more bluntly. Neither is necessary on a healthy Mac, but both are reversible and both are the right test when you suspect rapportd is the cause of a battery or CPU problem.

On the security question: the real binary is at /usr/libexec/rapportd on the sealed system volume. It is not the IBM Trusteer Rapport browser plug-in that some banks ask customers to install; that is a separate product with a different name in Activity Monitor. If you see a process called rapportd, it is Apple's.

What to do, in order

1. Allow the firewall prompt

   If the question is "accept incoming network connections", click Allow. It is your own devices on your own network. Denying it breaks Sidecar and Universal Control and macOS will ask again after the next update anyway.

2. If it keeps asking, reset the firewall's answer

   System Settings, Network, Firewall. Turn the firewall off, wait ten seconds, turn it on. Then open Options and check that rapportd is listed and allowed. Repeated prompts after an update are the saved answer no longer matching the new binary.

3. Turn Bluetooth off and on

   For real CPU or constant alerts, this resets device discovery. From the menu bar, turn Bluetooth off, wait ten seconds, turn it on. A reconnect loop usually ends here.

4. Find the flaky device

   If it comes back, note which of your devices is nearby. Move one out of range at a time, or turn its Bluetooth off, and watch rapportd. An old iPad still signed in to your account, or a Watch at the edge of range, is the common culprit.

5. Turn Handoff off as a test

   System Settings, General, AirDrop & Handoff, then turn off "Allow Handoff between this Mac and your iCloud devices". If rapportd goes quiet and stays quiet, you have confirmed the cause; turn it back on when you want the features.

6. Restart, then update

   A restart clears any stuck discovery state. If rapportd is busy again within a day with no device loop you can find, check System Settings, General, Software Update: the documented rapportd bugs were fixed in point releases.

When to worry

Not about the firewall prompt. It appears on nearly every Mac that turns the firewall on, it names a real Apple daemon, and the connection it asks about is from your own iPad or iPhone. Allow it and move on. Not about Little Snitch alerts either, as long as the process shown is /usr/libexec/rapportd and the destinations are your local network and Apple's domains, which is what both of the threads below found.

Worry a little if rapportd is talking constantly and you own only one Apple device, because then there is nothing for it to find and the activity is either a neighbor's device on your network or a bug. Toggling Handoff off removes the first case; a Software Update removes the second. Worry properly only if the process accepting connections is not at that path, which would mean something else has taken the name, and that is a job for Apple Support. Safe to Quit tracks rapportd over hours and shows whether its activity lines up with a device coming and going, which usually answers the question in an afternoon.

Look up another process

rapportd works alongside sharingd, which handles AirDrop and AirPlay, and bluetoothd, which runs the radio it relies on. Type any name from Activity Monitor to get the plain-English version and the verdict.