macOS process library
What is trustd on Mac?
trustd is the macOS daemon that decides whether certificates can be trusted, for every process on the system. When an app opens a secure connection or checks a signature, trustd verifies the certificate chain and whether it has been revoked.
- Part of
- A macOS security daemon that evaluates certificate trust.
- Safe?
- Yes. It is part of macOS’s security system.
- Can I quit it?
- No. macOS restarts it on demand, and apps checking certificates wait or fail in the meantime.
The short answer
trustd is a core security component, and you’ll usually see more than one copy: one for the system and one for each logged-in user. Short CPU spikes are normal. Longer spikes have historically been tied to updates of Apple’s certificate revocation data, and they usually clear up on their own or with a macOS update.
Normal use
What trustd usually looks like.
trustd normally uses close to 0% CPU and a modest amount of memory. You may see several trustd processes running under different system accounts and your own; that is expected.
It does brief work every time an app makes a secure connection, so busy browsing, downloads, and app launches make it tick up for a moment.
Why trustd uses so much CPU or memory
- Lots of secure connections
Browsers, sync tools, and package managers open many HTTPS connections. Each certificate needs checking.
- Revocation data updates
macOS downloads data about revoked certificates in the background. In past macOS versions, problems with that data caused trustd to spike until Apple fixed it.
- After an update or new installs
Updating macOS or installing apps leads to a round of certificate and signature checks.
- A slow or filtered network
Network filters, VPNs, or a slow connection can make certificate checks take longer.
How to calm trustd down
Start at the top. Each step is more disruptive than the one before.
- Wait a few minutes
After an update, a big download, or a new install, trustd usually settles on its own.
- See what’s making connections
A browser with many tabs, a sync tool, or a package install running in the background can keep trustd busy. Let it finish or pause it.
- Check your network
If you use a VPN or a network filter, try without it briefly to see whether certificate checks speed up.
- Update macOS
Install pending updates in System Settings → General → Software Update. Apple has fixed trustd issues in past updates.
- Restart your Mac
A restart clears a stuck check. Save your work first. Don’t delete trustd’s files; they are protected security data.
Seeing it in Spare
Find what it’s reacting to.
trustd does its work for other apps, so it helps to see what else was busy. Spare groups your apps, development projects, and AI agents, so you can spot a large package install or a browser loading dozens of pages at the same moment trustd climbed.
Spare treats macOS processes like trustd as system tasks and never offers to stop them.
Common questions
About trustd
Is trustd malware?
No. It is part of macOS at /usr/libexec/trustd and is protected by the system.
Why are there several trustd processes?
macOS runs a system copy and a separate copy for user accounts, including yours. Seeing more than one is normal.
Why does trustd connect to the internet?
It checks whether certificates have been revoked, which can mean contacting Apple or the certificate issuer.
Should I block trustd in my firewall?
No. Blocking it can break or slow secure connections and app checks across your Mac.
Related processes
Sources: trustd(8) man page, macOS, Michael Tsai: High CPU Use From trustd. Reviewed October 6, 2026.
Get Spare
Free to use. Yours to explore.
Download Spare for Apple silicon, or explore the MIT-licensed source on GitHub. Free to use, with no subscription or account.
macOS 14+ · Apple silicon · Signed and notarized