What are rapportd and sharingd on Mac?

What each process does

Apple’s installed rapportd manual describes Phone Call Handoff and other communication features between Apple devices. The sharingd manual names AirDrop, Handoff, Instant Hotspot and Finder sharing functions. The two services have related roles, but they are not interchangeable names for a single app.

Those manuals describe service roles, not a complete map of every current Continuity request. We do not attribute every clipboard sync, wireless connection or transfer to a particular daemon. Apple’s current user documentation explains the visible features without making that process-by-process promise.

For example, Universal Clipboard requires compatible nearby devices, the same Apple Account, Wi-Fi, Bluetooth and Handoff. AirDrop has its own receiving controls. A problem with one feature does not mean all nearby-device services should be disabled.

Identify the executable and user

In Activity Monitor, choose View › All Processes, search the exact name and inspect the process. The expected executable for each is under /usr/libexec/: rapportd or sharingd.

On our read-only check of macOS 27.0.1 on 23 October 2026, both ran as the signed-in user at those paths. This establishes what we observed on that Mac, not a requirement that every release or session has exactly the same number of processes.

A matching name alone cannot establish trust. If the executable is in an unexpected Downloads folder or an unfamiliar app bundle, investigate that file separately. Do not delete Apple’s expected binary or treat a similar name as proof of malware.

Why rapportd may ask to accept connections

The macOS application firewall controls incoming connections. A service whose role involves communication can need incoming access for a feature to work. The prompt is a permission decision about that executable; it is not, by itself, evidence of an attack.

Check that it is the expected Apple service and consider whether you use nearby-device communication. Apple’s firewall settings include automatic allowances for signed built-in software and separate per-app or service rules. Existing settings, policy and the software identity can affect whether you see a prompt.

Use System Settings › Network › Firewall › Options to review the relevant rule. Do not turn off the entire firewall as a standing fix. On a managed Mac, let IT review a repeating prompt or policy restriction. Our Mac firewall guide explains the scope of that protection.

If CPU stays high

1. Observe a sustained period. Note which service is busy and whether you are making a call, sending files or using a Continuity feature. A single sample does not establish a continuing problem.
2. Finish the visible task. Let an intended transfer complete. If a call or app is stuck, end it through the app’s controls after saving work.
3. Test the affected feature. Check the relevant receiving or Handoff setting, and whether both devices have the required connections and account. Change one feature at a time only if you can tolerate losing it temporarily.
4. Restore the setting after the test. If disabling Handoff made no useful difference, turn it back on. An observation may narrow the trigger; it does not prove which internal component failed.
5. Restart normally and update. Save work first. If the same behavior returns, record the app, accessory, macOS version and feature involved for Apple Support.

Do not disable Bluetooth or Wi-Fi mid-transfer just to make a CPU number smaller. Those changes can interrupt other work. Control Center is useful for reviewing connection status, but a network-wide reset is a larger action than checking one feature.

When Handoff or AirDrop is the actual problem

Start with Apple’s feature checklist. For Handoff, confirm the same Apple Account, compatible devices, nearby range and Wi-Fi/Bluetooth. For AirDrop, check the recipient’s receiving choice and the actual transfer prompt. A firewall rule and an AirDrop receiving setting are separate controls.

Do not sign out of the entire Apple Account as a first CPU experiment. That affects more data and services than the feature you are testing. Likewise, deleting preferences or turning off macOS protections is not a useful generic response to these process names.

Can you remove or force quit them?

They are macOS services, not third-party apps to uninstall. Removing their files can break communication features and is not a supported performance fix. Force quitting may interrupt work and the service may return; repeated termination provides little evidence about the cause.

If a particular feature remains unusable, keep the exact symptom and any repeatable trigger. Apple Support can assess that more effectively than a report that a daemon merely exists. Use normal feature controls for any deliberate change.

Where Tend fits

Tend’s free app view covers your current user, so these user-owned processes can appear as their own entries. Their executables are outside another app’s bundle; Tend does not automatically fold them into Safari or a phone app just because those apps use Continuity.

System power and current app estimates can help put sustained work in context. They do not identify the device at the other end of a connection or prove that a service caused a battery change. Use Activity Monitor and the relevant feature’s settings for that investigation.

Questions

Related guides

Sources

• Apple, installed man rapportd and man sharingd; read-only process user/path check on macOS 27.0.1.
• Apple, Handoff setup and Universal Clipboard.
• Apple, Firewall settings and AirDrop.

Sources checked 23 October 2026. Spotted something out of date? Tell us and we'll fix it.