What is replayd on Mac? Screen recording explained

What replayd does

The installed Apple manual gives the direct definition: replayd supports ReplayKit on macOS and implements in-app capture, recording and broadcast features. It also says users should not launch it manually.

A framework service can be present without a visible app window of its own. A process list therefore isn't a complete display of active recordings, callers or what content an app may capture. Use the app's session controls and macOS permissions alongside it.

This is distinct from proving remote access or malware. The name replayd describes a legitimate system component; it does not tell you why a particular client has requested work at a particular moment.

The executable and owner we checked

On the M2 Max documentation Mac running macOS 27.0.1, read-only checks on 23 October 2026 found replayd in the logged-in user's account at:

/usr/libexec/replayd

The installed launch-agent record was /System/Library/LaunchAgents/com.apple.replayd.plist. Its service names include ReplayKit sharing-session support. We inspected the installed record and path; we didn't start a recording, broadcast, service restart or CPU benchmark.

In Activity Monitor, show View › All Processes and the User column to check the actual process context. Don't assume every similar-looking name belongs to the same executable.

Check what is actually sharing or recording

Look at the apps you opened before the activity began: a meeting, capture tool, presentation or broadcast workflow. Read the visible session state and stop control in that app. Saving a recording and stopping a live screen share may use different controls.

For Apple's Screenshot recording, Shift-Command-5 opens its controls. Apple's instructions say to stop a recording with the menu-bar Stop control or Command-Control-Escape. Don't assume that shortcut is a universal stop button for every third-party call or broadcast.

Wait for the intended app to finish saving its recording before quitting it. Stopping a system helper abruptly can interrupt multiple capture-related tasks without cleanly finishing the file you need.

If you see an unexpected sharing or recording indication, review the app shown by macOS and stop the session through its normal interface. A permission entry, a running helper and an active transmission are three different observations.

Review screen and system-audio permissions

On macOS 15 Sequoia, 26 Tahoe and 27 Golden Gate, use System Settings › Privacy & Security › Screen & System Audio Recording. Apple's version-specific guides explain which apps have access and how to change it.

Turn off access for an app you no longer want to capture the screen or audio. Follow any request to quit and reopen the app before retesting. A work Mac may have managed requirements; ask IT about a required meeting, remote-support or security tool.

Screen capture is a separate permission from the microphone, camera, Accessibility or Full Disk Access. Granting every available permission isn't a troubleshooting step. Give an app the access its genuine task requires.

Apple's recording instructions also distinguish macOS features by version: recording a selected window is available in Screenshot on macOS 26 or later, while its Include System Audio option is documented for macOS 27 or later. That doesn't describe every third-party app's recording options.

If replayd keeps using resources

Pattern	Next check
Busy during an expected capture	Whether the requested task is still active and completing
Remains busy after the app finishes	Save, quit that app normally and compare
Returns with one app	That app's version, support notes and recording options
Mac is broadly slow or hot	CPU, GPU, memory pressure and the rest of the workload

Observe the same action before and after one change. If the app has no useful work left to save, quit it normally and reopen it. If it cannot quit, use the force-quit guide with its unsaved-work warning.

Save everything and restart the Mac normally if the state doesn't clear. Install supported macOS and app updates. If the problem consistently follows one capture or conferencing app, give its developer the model, system version, app version and reproducible action.

No universal normal replayd CPU percentage or safe duration is established by the sources here. A short busy sample during capture and repeated unexplained activity after all sessions end are different cases.

Don't remove the system service

Don't delete the executable, permanently unload its launch record or disable System Integrity Protection to edit it. Those changes can break supported capture functions while leaving the original app problem unexplained.

Repeated kill commands are also a poor substitute for identifying a client. If you cannot account for an active session, review installed apps and permissions with trusted support. Use the malware investigation guide when there is actual suspicious behaviour, rather than treating one expected macOS name as a verdict.

For a wider slowdown, the general diagnosis examines other bottlenecks. The process reference keeps the other names in context.

What Tend shows for replayd

The verified own-user executable is outside an app bundle. Tend's grouping code therefore keeps it under its own name, replayd, rather than folding it into the meeting app. This conclusion comes from code and path inspection; no live recording or Tend UI test was performed.

Its free CPU, memory and estimated watts add workload context, with 24-hour energy totals and 7/30-day views in Pro. Tend doesn't identify the recording's content, which remote participant can see it, or whether a helper's presence means an active share.

Questions

What is replayd on a Mac?

It is the macOS service that supports ReplayKit’s in-app capture, recording and broadcast features. Apple’s installed manual says users should not launch it manually.

Does replayd mean my screen is being recorded?

Its presence alone does not prove an active recording or transmission. Check the app’s session controls, macOS indicators and screen-recording permissions.

Should I force quit replayd?

Start by saving and stopping the session through the app, then quit the app normally or restart the Mac if needed. Abruptly stopping the helper can interrupt capture work without fixing its trigger.

Does Tend show replayd by name?

For the verified own-user executable outside an app bundle, its grouping code keeps a separate replayd entry. This was checked from code and the path, not a live recording test.