What Is rapportd on Mac? Why Your Firewall Asks About It

rapportd is a legitimate Apple system daemon that ships as part of macOS. It is not malware, not adware, and not something you installed by accident. On current macOS versions the binary lives at /usr/libexec/rapportd, it is code-signed by Apple, and it is started automatically by the system rather than by you.

Its job is Continuity, the family of features that let your Mac, iPhone, iPad and Apple Watch behave as one set of devices. That typically includes Handoff (start an email on your iPhone, finish it on your Mac), Universal Clipboard (copy on one device, paste on another), phone call and SMS relay, Instant Hotspot, Continuity Camera, Continuity Markup and Sketch, and Auto Unlock with an Apple Watch. Not every one of these routes exclusively through rapportd, but they all depend on the same underlying idea: your devices need to know that the others are nearby and awake.

That is the part rapportd handles. It advertises your Mac's presence to nearby Apple devices signed into the same Apple Account, and it listens for their advertisements in return, using Bluetooth Low Energy and peer-to-peer Wi-Fi (Apple Wireless Direct Link, or AWDL). The connections it makes are local and between your own devices, not to a distant server run by someone else.

Because discovery has to work in both directions, rapportd does not only reach out. It also waits to be reached. That single detail is the reason it appears in a firewall dialog far more often than any other Apple daemon.

The most common trigger is turning on the built-in macOS firewall. The macOS firewall filters incoming connections, so when you enable it, the system starts asking about every process that wants to listen for them. rapportd is almost always one of the first to raise its hand, which produces the dialog people search for: do you want the application rapportd to accept incoming network connections?

Nothing has gone wrong when this appears. rapportd was doing exactly the same thing the day before. What changed is that the firewall is now standing between it and your other devices and is asking you to make a decision that macOS previously made silently. The same prompt can reappear after a macOS update, since an updated binary is effectively a new binary as far as the firewall's list of allowed apps is concerned.

The second way people find it is Activity Monitor. rapportd shows up in the process list under your user account, normally with negligible CPU use and a small, steady trickle of network activity. Under the Network tab you will usually see packet counts that grow slowly and data volumes measured in kilobytes rather than megabytes, because discovery traffic is small by design.

The third way is a third-party network monitor or outbound firewall, which will show rapportd making local connections on your own network. Again, that is expected behaviour for a device-discovery service.

It is not. rapportd is Apple's own code and part of a standard macOS installation. The reason it is still worth knowing how to verify this is that naming a malicious binary after a familiar system process is a genuine, well-worn technique, so the habit of checking is a good one even when the answer is reassuring.

The first check is the location. Apple's daemon lives in /usr/libexec, a system directory protected by System Integrity Protection, which means ordinary software cannot write a replacement there. In Activity Monitor you can double-click the process and inspect its open files and ports to see where it is running from. A process calling itself rapportd from your home folder, from a Downloads directory, or from some application's private support folder is not the Apple daemon and deserves attention.

The second check is the code signature. macOS ships a command-line tool called codesign, and asking it to display signing information for the binary at /usr/libexec/rapportd will report the signing authority. For a genuine Apple system component you should see Apple's own signing authority and the Apple Root certificate authority in that chain, not a third-party developer name and not an ad-hoc or missing signature. If you prefer not to use Terminal, the combination of the correct path plus a process that Activity Monitor shows as tiny and idle is already strong evidence.

The third check is behaviour. Real rapportd is quiet. Sustained high CPU, or heavy sustained data transfer, is unusual and worth looking into, though as the next section explains it usually has a mundane cause rather than a sinister one.

The honest trade-off is narrow. If you deny rapportd incoming connections, you lose the Continuity features that depend on your devices finding each other, and you lose nothing else. Your Mac boots, browses, syncs iCloud, receives mail and runs applications exactly as before. There is no security downside to denying it and no stability problem.

So the decision is simply whether you use those features. If Handoff, Universal Clipboard, Instant Hotspot or unlocking your Mac with an Apple Watch are part of how you work, allow it. If you have never knowingly used any of them, or you only own one Apple device, denying it costs you nothing you would notice.

There is a cleaner route than firewall-denying it, though. Blocking at the firewall leaves the features switched on while quietly breaking the mechanism they rely on, which tends to produce confusing half-working states later. Turning the feature off at the source is tidier: on recent macOS versions the Handoff toggle sits in System Settings under General, in the AirDrop and Handoff section. Switch that off and the system stops asking rapportd to do the work in the first place.

High CPU or unusually constant network activity from rapportd is a separate issue and is usually a device-discovery loop rather than a compromise. It commonly clears up after toggling Bluetooth and Wi-Fi off and on again, restarting the Mac, signing out of and back into your Apple Account, or disabling Handoff to stop the discovery cycle entirely.

rapportd gets singled out for one accidental reason: it listens, so the built-in firewall has to ask about it. The dozens of other background processes on your Mac only make outbound connections, which the macOS firewall does not filter and never prompts about. They are not more trustworthy than rapportd. They are just quieter about it.

That is the awkward gap. A typical Mac runs system daemons handling certificate checks, push notifications, iCloud sync, Spotlight suggestions, software updates and telemetry, alongside every third-party app you have installed, each with its own network behaviour. Activity Monitor will tell you a process moved some data. It will not tell you which domains it contacted, when, or how much went to each one, and that is precisely the information you need to decide whether something is normal.

This is the layer NetMute is built for. It shows real-time per-app and per-process traffic, and logs at the domain level, so you can see which domains a given process actually contacted, at what time and with how much data. When something looks wrong, its per-app firewall blocks that app with one click, and temporary rules expire on their own so a quick test does not turn into a permanently broken app you forgot about. Network profiles let the rules differ between your home network and a hotspot, and Tracker Shield blocks more than 1,100 known tracker domains outright.

The goal is not to block Apple's daemons. Most of them, rapportd included, are doing exactly what they claim to. The goal is to be able to answer the question the next time it comes up, without having to search for the process name at all.