How to kill a process from Terminal on a Mac, and when not to
To kill a process from Terminal, find its process ID (PID) with pgrep or ps, then run kill followed by that number. A plain kill asks the process to quit and lets it tidy up. If it ignores the request, kill -9 followed by the PID forces it to stop at once. For a process owned by another user, by root or by one of macOS’s system accounts, you need sudo in front, and for many system processes the better answer is to leave them alone.
Here is each step, what the commands really do, and where the risks are.
Step 1: Find the process
Open Terminal (it is in Applications > Utilities). To search by name, use pgrep:
pgrep -l Safari
The -l option prints the name next to each PID, so you can see what matched. pgrep matches part of a name, so a short search can return more than you meant. Add -x to match the whole name exactly:
pgrep -x Safari
To see more about a process, use ps with the PID:
ps -p 1234 -o pid,user,%cpu,%mem,command
Replace 1234 with your PID. This shows who owns it, how much processor and memory it is using, and the full command that started it. The command column often tells you more than the name does, because it shows the path of the program.
To see what is busiest right now, run top -o cpu. It fills the window with a live list sorted by processor use, with the PID in the first column. Press q to leave it. Both top and ps count each processor core as 100%, so a busy program on a Mac with several cores can show well over 100. How to see which app is using the most CPU on a Mac covers the other ways of getting the same answer.
Step 2: End it with kill
kill 1234
Despite the name, kill does not kill anything by itself. It sends a signal to the process. With no option, the signal is called TERM, which means “please terminate”. A well-behaved program receives it, saves what it can, closes its files and exits. That is the polite way, and it should be your first try.
Give it a few seconds, then check whether it has gone:
pgrep -x Safari
If the command prints nothing, the process has ended.
Step 3: Force it with kill -9
kill -9 1234
Signal 9, also called KILL, cannot be caught or ignored. The process does not get a chance to save anything or clean up. macOS simply removes it. The rare exception is a process stuck waiting on a disk or a network drive, which shows U in the STAT column of ps -o pid,stat,comm -p 1234: it ends only when that wait is over. Use it when the polite request has been ignored for a minute or so, for example with a program that is truly hung.
The price is the one you would expect. Anything the process had not saved is lost. A program that was in the middle of writing a file can leave it incomplete. A program that was holding a lock on something, such as a database, may leave that lock behind, and the next start may need to recover.
The signals, in plain words
| Command | Signal | What it does |
|---|---|---|
| kill 1234 | TERM | Asks the process to stop, and lets it clean up |
| kill -HUP 1234 | HUP | “Hang up”. Ends most programs, though some background services are written to reload their settings instead |
| kill -9 1234 | KILL | Removes the process at once, with no cleanup |
| kill -STOP 1234 | STOP | Freezes the process where it is, without ending it |
| kill -CONT 1234 | CONT | Lets a frozen process carry on |
STOP and CONT are worth knowing because they are a way to pause a process that is eating the processor while you finish something else. A paused process uses no processor, but anything that depends on it waits too. If you pause something and forget about it, it stays frozen until you send CONT. How to pause an app on a Mac instead of quitting it covers the same idea without Terminal.
Step 4: Kill by name
If you do not want to look up the PID, pkill and killall work from the name:
pkill -x Safari
killall Safari
Both send TERM by default, and both accept -9 in the same way. They are quicker, and they are also easier to get wrong, because every process with that name is signalled, not just one. killall and pkill -x match the whole name. Plain pkill without -x matches any process whose name contains the text, and on a Mac an app with helpers, such as a browser, can have dozens of processes that share part of its name: pkill Chrome would hit every Google Chrome Helper too. Run pgrep -l with the same name first and read the list before you use pkill.
When you need sudo
You can end your own processes without any special rights. A process that belongs to another user, including root and the system accounts that run many of macOS’s own services, will not obey you, and kill fails with an “operation not permitted” message. Putting sudo in front runs the command as an administrator:
sudo kill 1234
Terminal asks for your password and shows nothing as you type. That is normal.
Think before you do this. That message is the Mac telling you the process is not yours to end. Being able to override it does not mean it is a good idea.
What not to kill
Terminal will do exactly what you say, with no warning, so the choice is on you. Leave these alone:
- launchd (PID 1). The program that starts and stops everything else. Ending it would take the Mac down, so do not try.
- kernel_task. The core of macOS. High CPU here often means the Mac is slowing itself down to stay cool, so it is a symptom, not a process to end. What is kernel_task on a Mac, and why does it use so much CPU? explains.
- WindowServer and loginwindow. Ending either logs you out and loses unsaved work in every open app.
- Anything you cannot describe in one sentence. Search for the name first.
macOS restarts many of its own processes by itself after they end, so killing them is usually pointless as well as risky. If a process you ended returns with a new PID a few seconds later, that is the reason.
Also avoid a habit of kill -9 on everything. It is the blunt tool. Try plain kill first, wait a short time, and use -9 only when you have to.
The same job without Terminal
Terminal is quick for someone who is already in it, but it does not tell you what a process is, and it never asks if you are sure. Foreman does the same job from a list. On its Processes page it shows plain-English names, so “Spotlight indexing” appears with mds_stores beside it in grey, and the All Processes page shows PID, User, Parent, Priority and the Path to each program. Its End Task works in the same polite-then-forceful order as kill and kill -9: it asks first, and ending it again forces it. Foreman costs $12 once and is free for 24 hours. It never offers to end kernel_task or launchd, it warns before WindowServer or loginwindow, and it asks for an administrator password before it touches anything that belongs to macOS or another user.
If you want the list view for the rest of this, How to end a background process on a Mac covers it.
The short version
- pgrep -l name finds the PID. ps -p with the PID shows what it is.
- kill PID asks politely. Wait a few seconds.
- kill -9 PID forces it. Anything unsaved is lost.
- Use sudo only when you are certain what the process is.
- Or skip Terminal and use Foreman, which names each process for you.
- Leave launchd, kernel_task, WindowServer and loginwindow alone.