What Is com.apple.accountsd?

com.apple.accountsd is a normal part of macOS. It is Apple's Internet Accounts service — the background process that manages the accounts you have added to the system and lets apps use them without each app storing your credentials. On its own it is not malware, and you should not try to remove it.

Most people arrive here after seeing it in Activity Monitor, or in a firewall prompt, or because a cleanup app flagged it. In almost every case the answer is: that is expected.

What does com.apple.accountsd do?

It is a launch agent — a background process macOS starts for each logged-in user session. Its job is to broker accounts. When you add an iCloud, Google, Microsoft or other account to macOS, accountsd holds that relationship, and apps such as Mail, Calendar, Contacts, Notes and Reminders ask it for access rather than each keeping its own copy of your sign-in.

That is why adding an account once makes it appear across several apps, and why the process becomes active when those apps sync, when a token needs refreshing, or when you add or re-authenticate an account.

Where the real accountsd lives

Two paths, both inside /System:

program:  /System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd
plist:    /System/Library/LaunchAgents/com.apple.accountsd.plist

Both were verified first-hand on macOS 26.6.1 (build 25G76) on 2026-08-11. This matters more than the name does: on a normally configured Mac, /System is a sealed, read-only volume protected by System Integrity Protection. Software that is not part of macOS cannot put a file there.

Why is com.apple.accountsd using CPU or the network?

Ordinary reasons, in rough order of likelihood:

You just added an account, changed a password, or re-authenticated one.
An access token expired and is being renewed — this is routine and periodic.
Mail, Calendar, Contacts or Notes are syncing.
You updated macOS, and accounts are re-validating afterwards.

Sustained high CPU is usually an account stuck in a re-authentication loop, most often a third-party account whose password changed elsewhere. The ordinary fix is to open System Settings, find the account, sign it out and sign back in; a restart clears many transient cases. Network activity is inherent to the job — talking to account providers is what it does.

Two things make this process disproportionately visible. The first is the name: the d suffix is a long-standing Unix convention for a daemon, a background process with no interface, so it only ever appears in tools that list processes rather than windows. The second is that account brokering happens on a schedule you did not set — so it surfaces in Activity Monitor, in battery-usage lists and in firewall prompts at moments that feel arbitrary and are not.

Can you remove or disable com.apple.accountsd?

No, and you should not try. It is part of the operating system, it is protected by System Integrity Protection, and disabling it breaks iCloud, Mail, Calendar and Contacts sign-in across the Mac. Force-quitting it in Activity Monitor is harmless in the sense that launchd simply restarts it, but it fixes nothing.

Any guide or "cleaner" that tells you to delete a com.apple.* system item is a good reason to stop and question the source rather than the file.

When is a familiar process name worth a second look?

Calmly, and without turning this into an alarm: macOS malware has long borrowed Apple-looking names, because a name is the cheapest thing in the world to copy. That is a general technique, not something specific to this process, and the overwhelming majority of people reading this page are looking at the genuine Apple service.

The useful reframe is that the name is not the question. The things that are hard to fake are where the file is and what launched it. So the question is never "is com.apple.accountsd dangerous?" — it is "is the thing on this Mac using that name the one in /System?"

Reasons to check that:

A plist with an Apple-style name sitting in /Library/LaunchAgents, /Library/LaunchDaemons or ~/Library/LaunchAgents. Apple's own services are not in those folders — those are for third-party software.
A program path in your home folder, a hidden directory, or /tmp.
A near-miss name: accountsd-helper, accounts-d, com.apple.accounts.daemon and similar.

How to check where the process on your Mac is running from

Read-only; nothing below changes anything.

Resolve the service to its real files:

launchctl print gui/$(id -u)/com.apple.accountsd

On a healthy Mac the first lines look like this — this is real output from macOS 26.6.1:

gui/501/com.apple.accountsd = {
    active count = 4
    path = /System/Library/LaunchAgents/com.apple.accountsd.plist
    type = LaunchAgent
    state = running

    program = /System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd

The path and program lines are the answer. Both inside /System means you are looking at Apple's service.

Confirm nothing is impersonating it from a third-party folder:
```
ls -la /Library/LaunchAgents /Library/LaunchDaemons ~/Library/LaunchAgents
```
Third-party entries here are normal — backup agents, security tools, updaters. An Apple-branded name here is not.
Check the binary's signing identifier:
```
codesign -dv /System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd
```
which reports Identifier=com.apple.accountsd. One warning, because it trips people up: running codesign -v -R="anchor apple" against this binary returns CSSMERR_TP_NOT_TRUSTED. That is normal for macOS platform binaries and is not a sign of trouble — several online guides suggest that command and then misread the result. Judge by path first.
If the path is not inside /System: do not delete it as your first move. Note what you found, then work through how to check a Mac for infostealer signs and the free First-Response Checklist, which puts your accounts first — deleting a file does not sign anyone out of anything.

Common questions about com.apple.accountsd

Is com.apple.accountsd a virus?

No. It is a standard macOS system service. Seeing it running is expected on every Mac.

Is it safe to quit accountsd in Activity Monitor?

It is not damaging — macOS restarts it — but it rarely solves anything. If it is misbehaving, sign the relevant account out and back in, or restart the Mac.

Why does accountsd ask for my password?

Legitimately, when a token has expired and the provider needs you to sign in again. It is also a prompt worth treating with a little care in general: dismiss an unexpected credential dialog and open System Settings yourself to sign in there instead. Typing a password into the dialog that appeared is the habit worth breaking, regardless of which process raised it.

Why did my firewall prompt me about accountsd?

Because it makes outbound connections as part of its job — contacting the account providers you configured. Outbound monitors such as LuLu or Little Snitch ask about anything that has not been allowed yet, including Apple's own services, so a prompt here is ordinary. Before allowing it, glance at the process path shown in the prompt: it should be the /System/Library/Frameworks/Accounts.framework/ path above. That is exactly the check those tools are useful for. More on what they do and don't cover: the Mac firewall, explained.

Does com.apple.accountsd send my data to Apple?

It communicates with the account providers you have configured, which is what makes those accounts work. Its network activity is inherent to its function, not a sign of anything unusual.

Should it appear in Login Items & Extensions?

No. System Settings > General > Login Items & Extensions lists third-party items — Open at Login and App Background Activity — not Apple's own system services. An Apple-named entry showing up there is worth looking into.

A cleaner app flagged it. Should I let it remove it?

No. It is part of macOS. A tool that offers to remove a SIP-protected Apple system service is telling you something about the tool.

Sources

Apple — Change Login Items & Extensions settings (macOS Tahoe 26); the Open at Login and App Background Activity section names.
Apple — Protect your Mac from malware (macOS Tahoe 26).
Paths, launchctl print output and codesign results on this page were captured first-hand on macOS 26.6.1 (build 25G76) on 2026-08-11.

HardenMac is experience-based guidance, not professional advice, and not antivirus or incident response. It does not scan this Mac, its accounts, files or network, and it cannot detect or rule out a problem. Menu names vary by macOS version; if a setting has moved, search for its name inside System Settings.