What is cfprefsd on Mac, and why is it using CPU?

What cfprefsd does

Apple’s local manual identifies cfprefsd as the service behind the CFPreferences and NSUserDefaults programming interfaces. These are ways an app stores choices such as its settings. The manual says there are no user configuration options and that you should not run the daemon manually.

That explains why quitting an app does not require the preferences service to disappear. It serves other clients too. Its presence is not evidence that an app you removed is still running, and its name is not a reason to clean every file ending in .plist.

On the Mac checked for this guide, running macOS 27.0.1 on 23 October 2026, a read-only process listing showed /usr/sbin/cfprefsd under both root and the signed-in user. These are observations from one Mac, not a claim that every account or macOS release always has the same number of copies.

Identify the busy copy first

1. Open Applications › Utilities › Activity Monitor. Choose View › All Processes, then search for cfprefsd.
2. Look at the User and % CPU columns. Keep the user-owned and root-owned copies separate when comparing them.
3. Watch several updates. Note whether the reading falls after you stop changing settings or quit a particular app.
4. Open the process information and inspect its executable before deciding what the name means.

The observed binary was in /usr/sbin. A similarly named executable in an unrelated downloaded app needs its own check. Neither a familiar filename nor a high CPU reading is a complete security verdict. The Mac security guide explains the built-in checks.

What high CPU can tell you

A preferences client repeatedly reading or writing settings is one plausible cause of sustained work. A repeated failure may also generate more attempts. The process name does not reveal which client is responsible, and this guide does not claim that every busy cfprefsd is an app stuck in a write loop.

Use a small, repeatable observation. Save your work, quit a suspected app normally, and watch whether the same cfprefsd copy settles. Reopen that app without changing anything. If the load returns only when you use one settings panel, record the app version and the action. This is more useful to its developer than a screenshot of a single spike.

Do not close everything at once if you want to learn what caused the change. You would lose the connection between the app you closed and the load that disappeared. If the whole Mac feels slow, the slow Mac checklist also checks memory pressure and storage, which a preferences diagnosis would miss.

What to try, in order

• Save and quit the app you can connect to the load. Update it through its own updater or the App Store, then test again.
• Restart the Mac once after saving your work. This tests whether the condition survives a fresh login; it does not prove why it happened.
• Check login items if the load returns before you open anything. The startup items guide explains how to change one item at a time and restore it.
• Capture a sample while it is busy. Select the relevant process and choose More › Sample Process. Keep the report for the app developer or Apple Support.

Samples can contain paths and account information. Review them before sharing publicly. They can show where a process spends time, but a client app’s identity may still require a developer to interpret the report.

Why deleting preferences is a last resort

Resetting a preference can erase useful settings and may not address the client that is rewriting it. A blanket removal also makes it harder to reproduce the original problem. Start with an app’s documented reset or troubleshooting procedure, and keep a backup of the settings it says to change.

Do not remove system preference folders, anything in /Library, or the cfprefsd executable. Do not repeatedly force-quit the daemon as a maintenance routine. If a vendor asks you to reset a specific preference, follow its exact app-specific scope and recovery instructions rather than adapting a command meant for a different app.

Where Tend fits

Tend’s free app list samples processes in your own account. The user-owned cfprefsd can therefore appear as its own row when sampled; the root-owned copy is not listed by name and contributes to the macOS share. An app’s CPU, memory and estimated watts can help you correlate activity, but Tend does not identify which app made a particular preferences request.

Free energy totals cover 24 hours; Pro adds 7 and 30 days. They are period totals, not a cfprefsd CPU trace. Use Activity Monitor for the owner and sample: its process reference provides the wider context.

Questions

Related guides

Sources

• Apple, local man cfprefsd, read on macOS 27.0.1; read-only ps confirmed the two observed owners and binary path.
• Apple Developer, UserDefaults.
• Apple, Sample Process and diagnostic reports.

Sources checked 23 October 2026. Spotted something out of date? Tell us and we'll fix it.