How to find out what's running in the background on your Mac

27 October 2026 · 6 min read

To find out what is running in the background on a Mac, start with the menu bar and the Dock, then System Settings > General > Login Items & Extensions (Login Items on macOS 14), and for the full list use a tool that shows every process. A Mac runs three kinds of thing at once: apps you opened, background processes that apps and macOS start for their own work, and system processes that keep macOS itself going. Most of what is running is not an app, and most of it is meant to be there.

This post explains the three kinds, then shows how to see each one and learn what it does.

Three kinds of things running

Apps are what you open: Safari, Mail, Photos, a document editor. They have windows or a menu bar icon, and they appear in the Dock while running, unless they are menu bar apps.

Background processes are programs without a window. Some belong to your apps: a browser runs many helper processes, often one for each tab or group of tabs, plus others for networking and graphics. Some belong to macOS: a process that reads new files for Spotlight, one that syncs iCloud, one that downloads updates.

System processes are the parts of macOS that run everything else: the one that draws every window, the one that starts and stops all the other processes, the one that runs your login session. They are meant to run all the time.

A fresh Mac with nothing open still runs hundreds of processes, so a long list does not mean something is wrong.

Start with what you can see

Some background activity is visible if you look.

The menu bar. Icons on the right side are apps or system features running with no window. The clock, Control Center, Wi-Fi, sound, battery, Spotlight and a few others are macOS. The rest belong to apps. Menu bar apps often run all day and many people forget they are open.
The Dock. An app that is running has a dot under its icon, as long as that setting is on. Menu bar apps may not show here.
The Force Quit window. Press Option-Command-Escape. It lists your open apps. It does not list background processes, and it does not show how much anything is using.

This covers the apps. Everything else needs the next step.

Login items and background items

Many background programs start by themselves when you log in. The built-in list is in System Settings > General > Login Items & Extensions. It has the apps that open at login (Open at Login), and a section of items that are allowed to run in the background (Allow in the Background), each with a switch. It is a good way to find out what has installed itself, and to turn something off. It tells you what is allowed to start, though, not what is running right now or how much it uses.

See every process

To see what is actually running, with figures, you need a process list. There is one way that needs no extra software and one that is easier to read.

Terminal. The ps command prints processes, and top shows a live list sorted by use. ps -ax lists every process on the Mac. The output is plain text with the technical name of each program, so it takes some practice to read. top runs until you press q.

Foreman. Open it from any app with Control-Shift-Escape. The Processes page splits the list into three sections that match the three kinds above: Apps, Background processes and System processes. Each app’s helper processes are added up under it, and the row opens to show them. Copies of one background program share one row with a count, for example “Spotlight file reader (4)”. Columns show CPU, Memory, Disk, Network, GPU and Power usage, and the whole Mac’s total sits above each one. Click a column to sort, or type in the search field, which takes a name or a PID.

If you want every process in one flat list, the All Processes page adds columns such as User, Parent, Priority and Path. The Parent column shows which process started it, which helps when you meet one you do not know.

What each one is

Technical names are hard to read. mds_stores, cloudd, trustd and WindowServer do not say what they do. Foreman gives about 120 macOS processes a plain-English name, with the real name beside it in grey. A few examples from its own list:

mds_stores is shown as “Spotlight indexing”. It builds and updates the Spotlight search index, and is busy after big file changes or updates.
cloudd is shown as “iCloud sync”. It syncs app data with iCloud.
backupd is “Time Machine backup”.
WindowServer is “Window Server”. It draws every window and everything else on screen.
kernel_task is “macOS kernel”, the core of macOS.
com.apple.WebKit.WebContent is “Web content”. It renders a web page for Safari or another app that uses WebKit.

For a name Foreman does not list, there are two quick routes. Use Search Online on the right-click menu, which searches the web for the process name. Or check the Path column on the All Processes page: a program inside an app’s folder belongs to that app, and one under /System or /usr/libexec usually belongs to macOS. What are helper and renderer processes on a Mac explains the many copies you see for browsers and chat apps.

Is it safe to stop?

Different kinds need different answers.

Apps: Yes. End Task asks the app to quit the way Command-Q does, so it can offer to save your work.
A background process belonging to an app: Quitting the app normally takes its helpers with it. Ending a helper alone may make the app misbehave.
System processes: No, as a rule. macOS restarts many of them by itself, so ending them gains nothing, and some, such as the one that runs your login session, will log you out. Foreman never offers to end kernel_task or launchd, and warns before ending anything that would log you out. Processes owned by root, a system account or another user need an administrator password; the User column shows who owns each one.

If something is busy and you are not sure what it is, the safest steps are to look it up and to wait. How to end a background process on a Mac covers the cases where you do want to stop one.

When something is too busy

If the Mac feels slow or hot and you are hunting for a cause, sort by CPU and look for the one that stays at the top for half a minute. An app you need open but not now can go into Efficiency Mode, where in the background it runs at background priority and in short bursts, held to about a quarter of the processor time it would take, and at full speed when it is in front or playing sound. It also works on macOS’s own background processes that run under your account, such as Media analysis, Photos analysis and iCloud Drive, though not on those owned by root or a system account.

For a startup problem, Foreman’s Startup Apps page lists everything that opens at login or runs in the background, with a status for each, and lets you Disable or Enable each one.

Foreman is $12 once, works on up to 3 Macs, and is free for 24 hours. The built-in lists above cost nothing, and they are enough to answer the question of which apps and login items are yours. The process list is where the rest of the answer lives.