Safe to Quittrustd on Mac: what it is, why it is high, what to do
trustd is the macOS daemon that checks certificates: every time Safari opens a secure site, Mail connects to a server, or an app launches for the first time, trustd confirms the certificate is valid and not revoked. Normally it uses under 1 percent CPU. It spikes to 100 percent for a minute or two when many checks arrive at once, right after login, after an update, or when a browser restores dozens of tabs, then settles. Do not force quit it: apps waiting on a certificate check hang until it returns. If it stays high for hours, one app is usually hammering it; quit that app.
- What it is
- The certificate trust daemon. Validates TLS certificates for browsers, Mail, the App Store and signed apps.
- Normal
- 0 to 1 percent CPU. Short bursts to 100 percent for a minute after login, an update, or restoring many tabs.
- Not normal
- 100 percent for hours while idle, often together with nsurlsessiond and syslogd.
- Safe to quit?
- No. Apps waiting on a certificate check hang until it restarts. Quit the app that is driving it instead.
- The one safe fix
- Wait a few minutes. If it persists: quit the app making the requests, then restart.
What trustd does
Every secure connection your Mac makes starts with a certificate: a signed statement that the server at the other end really is who it says. Someone has to check that signature, check that the certificate has not expired, and check that it has not been revoked since it was issued. On macOS that someone is trustd. It runs as a system daemon and as a per-user agent, and almost every app that talks to the internet goes through it.
It also checks the certificates of apps themselves. Launch a newly downloaded app and Gatekeeper asks trustd whether the developer's signing certificate is still good. Open a signed PDF, connect to a corporate VPN, sync Mail over TLS: trustd again.
Because it sits in the path of so many things, two facts follow. It is normally invisible, a fraction of a percent of CPU, because each check is tiny. And when something goes wrong with it, everything that depends on it waits. That second fact is why force quitting it is the one thing you should not do.
Why trustd is using CPU right now
- A burst of checks. Log in and twenty apps reconnect at once. Safari restores forty tabs. A macOS update re-validates signed system components. Each triggers dozens of certificate evaluations in seconds. 100 percent for a minute or two is the daemon doing its job quickly.
- Revocation checks that fail slowly. trustd asks Apple's servers whether a certificate has been revoked. If that connection is slow or blocked (a captive Wi-Fi portal, a strict firewall, a VPN that drops some traffic), each check waits, retries and logs. This is the loop behind the long 2020 Apple Community thread where trustd, nsurlsessiond and syslogd all ran hot together. As one user there worked out, "The syslogd high CPU I am pretty sure is a result of the excess logging coming from trustd and nsurlsessiond."
- One app hammering it. A chat app reconnecting in a loop, a sync client retrying a broken server, a security tool scanning every binary on disk. trustd is only as busy as its callers. Developer Jeff Johnson traced one case to nsurlsessiond connecting to Apple's validation server, after which "trustd CPU jumped from 0% to 100%."
- A damaged trust database. The cache trustd keeps of validation results can become corrupt. Symptoms are constant re-checking of the same certificates. A restart often clears it; an update fixes the version-specific cases.
- Catalina and Big Sur era bugs. Michael Tsai noted he had "been seeing long periods of high CPU use from trustd since Catalina." Later versions improved it, which is one reason updating is on the list.
What it is not: malware. trustd lives on the sealed system volume and cannot be replaced. Pages telling you to "remove trustd" are selling something.
What normal looks like, and what is not
The pattern matters more than the number:
The quick check: open Activity Monitor, CPU tab, sort by % CPU, and look at who is next to trustd. If nsurlsessiond and syslogd are also high, it is the logging loop and the network path to Apple's validation servers is the problem (VPN, firewall, captive portal, DNS filter). If a single third-party app is high alongside it, that app is making the requests. If trustd is alone and it has been less than five minutes, wait.
Is it safe to quit trustd?
No. It restarts automatically, but the gap matters: every app that asked for a certificate check in that moment waits, and some wait a long time. People who tried it in the 2020 thread found it stopped the CPU for a moment and then left Safari, Mail and the App Store hanging. Jeff Johnson's write-up is blunt about the trade: "You may have to reboot or force quit trustd to get its CPU usage back to normal." A restart is the clean version of that; force quitting is the messy one.
The thing you can safely quit is the app that keeps asking. That is the whole strategy with trustd: fix the caller, not the daemon.
What to do, in order
- Wait five minutes
If you just logged in, updated, or reopened a browser with many tabs, that is a burst. Check again in five minutes before doing anything.
- Find the app that is driving it
Activity Monitor, CPU tab, sort by % CPU. Quit any third-party app that is also busy, especially chat, sync, VPN and security tools. Watch trustd for a minute. If it drops, you found it; reopen the app later or update it.
- Check your network path
Turn off the VPN, disconnect from a hotel or office Wi-Fi with a login page, pause any DNS filter or firewall app, and see whether trustd calms down. If it does, the revocation checks were timing out. Add an exception for Apple's domains in that tool, or leave it off on that network.
- Restart
Clears a corrupt validation cache and ends the logging loop in most reports. This is the honest fix for the stuck case.
- Update macOS and the apps involved
The worst trustd behavior was in Catalina and Big Sur. If you are on an old version, System Settings, General, Software Update. Update the chatty app too.
- Check for a stuck security tool
Antivirus and endpoint agents re-check signatures across the whole disk after an update. Let them finish, or check their own status window. Do not uninstall anything your employer installed; ask IT instead.
When to worry
trustd itself is a security feature; it being busy is not a breach. The things worth attention:
- It stays high after a restart on a clean network. Then an app is looping. Find it by quitting apps one at a time.
- Battery and heat. A laptop with trustd, nsurlsessiond and syslogd all at 100 percent gets hot and loses hours of battery. That is the real cost of the loop, and the reason not to just live with it.
- The log is growing fast. The 2020 loop wrote so much that syslogd itself became a CPU problem. A restart stops it.
- You followed a guide that removed or disabled it. Nothing on the Mac can verify a certificate any more. Reinstall macOS over the top (it keeps your files) to put it back.
Safe to Quit watches which processes rise together over time, so when trustd climbs it can point at the app that started making requests in the minute before, rather than leaving you to quit things at random.
What people hit, in their words
“The syslogd high CPU I am pretty sure is a result of the excess logging coming from trustd and nsurlsessiond.”
“I'm trying to do the operations you recommend, but I feel like a beginner.”
“I've been seeing long periods of high CPU use from trustd since Catalina.”
“You may have to reboot or force quit trustd to get its CPU usage back to normal.”
Questions people ask
What is trustd on Mac?
trustd is the macOS daemon that evaluates certificate trust. When Safari opens a secure site, Mail connects to a server, or Gatekeeper checks a newly downloaded app, trustd confirms the certificate chain is valid and not revoked. It runs as a system daemon and a per-user agent, is part of macOS, and normally uses well under 1 percent CPU. It is not malware and cannot be removed.
Why is trustd using so much CPU?
Either a burst of certificate checks arrived at once (login, an update, a browser restoring many tabs), which passes in a minute or two, or something is looping: revocation checks timing out through a VPN, firewall or captive portal, or one app making requests non-stop. In the looping case trustd often runs alongside nsurlsessiond and syslogd. Quit the app, fix the network path, or restart.
Can I kill trustd?
You can press the stop button, and it will restart, but every app waiting on a certificate check at that moment hangs until it does, sometimes for minutes. People who tried it reported Safari, Mail and the App Store freezing. A restart achieves the same reset without the hang. Better still, quit the app that is making the requests, since trustd is only as busy as whatever is calling it.
Is trustd a virus?
No. It is a core part of macOS stored on the sealed, read-only system volume, which malware cannot modify or replace. High CPU from trustd is a sign of a burst of certificate checks or a looping caller, not an infection. If a page tells you to remove trustd or sells a tool to do so, close it. If you are worried about malware generally, macOS's built-in XProtect scans daily on its own.
Why do trustd, nsurlsessiond and syslogd all use CPU together?
Because they are three parts of one loop. nsurlsessiond makes the network request to Apple's certificate validation servers, trustd evaluates the result, and when the request fails or times out, both log the error and syslogd has to write every line. On a network that blocks or slows that connection, the cycle repeats endlessly. Turn off the VPN or filter, or change networks, then restart to clear the backlog.
Sources and further reading
- Why are trustd, nsurlsessiond, syslogd causing high CPU on Mac?, Apple Community 125 replies, 143 Me too, April 2020
- High CPU Use From trustd, Michael Tsai collects Jeff Johnson's investigation into the valid.apple.com connection
- trustd CPU usage, Apple Developer Forums
- What to do when a process uses too much CPU, The Eclectic Light Company