Why is my Mac so hot? How to find the process and cool it down

Heat is sustained CPU, and one process is usually doing it

A Mac gets hot for one reason that matters: something has been using a processor core flat out for minutes, not seconds. The fans follow the chassis temperature with a lag, which is why they keep going after the work has stopped and why a one-second spike in Activity Monitor is not the answer. What you are looking for is a process that has held a core for a while — and on almost every hot Mac there is exactly one, occasionally two.

That distinction — sustained versus instantaneous — is the whole trick to reading Activity Monitor. Its default sort shows you the loudest process this second, which changes every second. Sort by CPU, then watch the list for a full minute. The row that stays at the top is your culprit; the rows that flicker in and out are not.

The second thing to know is who owns the process. About half the names in that list are macOS itself, and for those the answer is nearly always "let it finish", because quitting a macOS daemon just makes launchd start it again. The other half are apps you opened, helpers those apps started, and command-line tools — and those you can actually do something about.

First, the free checks that fix it half the time

Before opening anything: is the Mac on a soft surface? A duvet, a lap or a sofa arm blocks the vents and the chassis cannot shed heat. Put it on a hard surface. Is the charger or a USB hub warm? Fast charging and bus-powered drives add heat on the same side as the CPU. And how many browser tabs are open? A browser with sixty tabs, one of them playing video or a live dashboard, is the single most common cause of a hot laptop, and closing tabs is the single most common fix.

Then look at the menu bar for a video call, a screen recording, or a screen-sharing session you forgot to end. Video encoding is the most expensive thing a laptop does and a call left running in the background will keep a Mac warm for hours.

• Hard surface, vents clear. Not a duvet, not a lap.
• Unplug a warm charger or hub for ten minutes and see if it settles.
• Close browser tabs — video, dashboards, pages with heavy ads first.
• End calls, recordings and screen-sharing sessions you are not in.
• Wait five minutes. Fans lag the temperature; a Mac that has finished a job stays loud while it cools.

Reading Activity Monitor: the names that come up

Open Activity Monitor (Applications → Utilities), click the CPU tab, click the % CPU column so the arrow points down, and watch for a minute. Percentages are per core, so a busy ten-core Mac can legitimately show one process at 800%. Here is what the usual suspects mean.

• kernel_task — the macOS kernel. When it shows high CPU it is usually not working; it is deliberately taking CPU away from everything else to keep the Mac from overheating. Treat it as a symptom: find what else is hot, cool the machine, unplug the warm charger. It cannot be quit.
• WindowServer — draws every window on screen. Rises with the number of windows, animations, external displays and transparency effects. Close windows, quit apps with constant animation, try Reduce Transparency in System Settings → Accessibility.
• photoanalysisd and mediaanalysisd — Photos analysing your library for faces and scenes. Waits for idle time then uses a lot of it, especially after an import. Leave the Mac plugged in and awake overnight and it finishes. Quitting it just postpones the work.
• mds, mds_stores, mdworker — Spotlight indexing after a big copy, a macOS update or a new external drive. Usually done within an hour. If it never settles, add the folder to System Settings → Siri & Spotlight → Spotlight Privacy.
• cloudd, bird, fileproviderd — iCloud Drive syncing. A big first sync can take days. Check progress in Finder → iCloud Drive.
• backupd — Time Machine. Let it finish; exclude large busy folders (virtual machines, build output) if it runs constantly.
• XProtect, syspolicyd, trustd — malware scanning after a download or install. Brief, normal, worth having.
• Google Chrome Helper (Renderer), Safari Web Content, Firefox plugin-container — one browser tab. Each tab is its own process. Use the browser’s own task manager (Chrome: ⋮ → More Tools → Task Manager) to see which tab, and close it.
• Slack Helper, Discord Helper, Code Helper, Electron Helper — a helper of an app built on a web engine. Quit the parent app rather than the helper; it will be restarted otherwise.
• com.docker.backend, OrbStack — a virtual machine idling. Quit it when you are not using containers.
• node, python, java, cargo, swift-frontend, clang — something you are running from a terminal or a build. A dev server with a file watcher on a huge folder is a classic cause of constant CPU.
• ReportCrash, spindump, diagnosticd — something is crashing repeatedly. Find the app in the list and update or reinstall it.

A process that comes back after you quit it is being relaunched by macOS or by its parent app. That is not a bug; it is how the system is designed. Quitting it again achieves nothing — the fix is whatever the process is waiting for, or the parent app.

Memory: a slow Mac is usually swapping, not hot

If the complaint is "slow" rather than "hot", look at the Memory tab instead. The memory pressure graph at the bottom is the honest number: green means fine regardless of how full the bar looks, yellow means the Mac is compressing memory to cope, red means it is writing memory to disk (swap) and every app will beachball. High memory use on its own is not a problem — macOS uses free memory as cache on purpose. Pressure is.

When memory is under pressure, sort by Memory and look for one process far above the rest. Browsers and web-engine apps (Slack, Discord, Notion, Spotify, VS Code) grow the longer they stay open; quitting and reopening them once a day is a legitimate fix. A process whose memory climbs steadily for minutes without ever coming down is consistent with a leak — but it is also exactly what a browser does while you open tabs, so do not declare a leak until you have stopped using the thing and it is still growing.

What is safe to quit, and what is not

Activity Monitor will let you force-quit almost anything, including things that will log you out or blank the screen. The rules are simple. Never quit kernel_task, launchd, WindowServer, loginwindow, Finder, Dock, SystemUIServer, coreaudiod or anything else owned by root. Do not quit macOS daemons in general: they relaunch, and the work they were doing resumes. Do quit apps you opened, using ⌘Q in the app itself where possible so it can save. Force-quit only when an app has stopped responding, and expect to lose unsaved work in it when you do.

A useful middle ground is the terminal. The command below lists the top processes by CPU once a second, with the user who owns them, so you can see at a glance whether a hot process is yours or the system’s. Press q to leave it.

top -o cpu -stats pid,command,cpu,mem,user

Where Dropit does this for you

Dropit’s Monitor tab does the watching described above so you do not have to: it keeps a rolling ten-minute window on every process, names the ones that have actually held a core for over a minute under a heading that says "Likely warming your Mac", labels each as macOS, app, helper or tool, and shows a plain-language card saying what it is doing and what to do — the same explanations as the list above, for about thirty families of processes, in every language the app ships in. Memory that climbs steadily is flagged as consistent with a leak, with the honest caveat attached. Watching, the rankings and the explanations are free with no account; quitting a process from inside the app is part of the one-time purchase, and it is only offered when it is safe — yours, not macOS, not on the never-quit list. The app reads no thermal sensors and sends nothing anywhere.