coreaudiod

Core Audio Daemon

System ProcessSecurityPerformance

CPU Usage

N/A

Memory

N/A

Location

N/A

Publisher

N/A

Notes

Core audio is critical for reliable playback and recording. Its stability affects every app that uses sound. If coreaudiod misbehaves, audio can glitch, devices may disconnect, or applications may fail to open audio streams.

What is coreaudiod?

coreaudiod is the Core Audio system daemon on macOS that coordinates all audio input and output across applications, devices, and the operating system. It handles device hot-plug events, sample-rate negotiation, buffering, and DSP routing to ensure synchronized, low-latency sound playback and recording, and it runs continuously in the background.

coreaudiod runs as /usr/sbin/coreaudiod under root and interfaces with the Audio HAL, I/O Kit drivers, and the kernel to allocate audio sessions, manage device changes, and apply routing and mixing policies across apps.

Is coreaudiod Safe?

coreaudiod is a legitimate Apple system daemon that is required for proper operation of the macOS audio stack. It runs with elevated privileges to coordinate hardware drivers, software mixers, and per-application audio sessions. In normal operation it only communicates locally and does not fetch data from external networks. If the file path is /usr/sbin/coreaudiod and the signature shows Apple Inc., it should be considered safe.

Is coreaudiod a Virus?

A compromised or counterfeit coreaudiod can be a sign of malware attempting to masquerade as the system daemon. Genuine coreaudiod is signed by Apple and located at /usr/sbin/coreaudiod; deviations in path, signature, or behavior (e.g., unusual network activity or persistence after logout) warrant investigation. Always verify the binary and scan for malware if in doubt.

How to Verify Legitimacy

Check File Location: Confirm the binary resides at /usr/sbin/coreaudiod. Presence elsewhere may indicate tampering.
Verify Digital Signature: Run: codesign -dv --verbose=4 /usr/sbin/coreaudiod to verify an Apple signing identity.
Check File Hash: Run: shasum -a 256 /usr/sbin/coreaudiod and compare with the known Apple hash for your macOS version.
Scan for Malware: Run a trusted malware scanner and check for modifications in /usr/sbin/coreaudiod and related Core Audio components.

Red Flags: If coreaudiod is not located at /usr/sbin/coreaudiod, signed by Apple, or shows unexpected network activity, treat as suspicious and perform a full-system malware scan.

Why is it Running?

Reasons it's running:

System-wide audio I/O coordination: coreaudiod orchestrates all playback and capture paths, ensuring applications can access the selected output and input devices without conflicts.
Device hot-plug and switching: It responds to plug/unplug events and Bluetooth or USB device changes, updating routes and compatibility settings on the fly.
Low-latency and sample-rate management: The daemon negotiates sample rates, buffers, and timing to minimize latency for real-time apps like DAWs and games.
Session and policy management: coreaudiod creates per-application audio sessions and enforces priorities and permissions to prevent resource contention.
AirPlay and wireless audio routing: It manages wireless streams, codecs, and re-connections for AirPlay and Bluetooth devices to maintain stable audio paths.

Can you disable coreaudiod?

Common Problems

Common Causes & Solutions

: Identify culprit devices or apps using exclusive mode; restart coreaudiod (sudo killall coreaudiod) and reselect the default audio device. If the issue persists, check for faulty USB/DAC drivers or Bluetooth devices and update macOS.
: Reset the audio subsystem by restarting coreaudiod, increase buffer size in affected apps, and ensure the system is not under heavy CPU load from other processes.
: Open Sound preferences, re-plug devices, reset PRAM/NVRAM if needed, and ensure relevant drivers are installed. Reboot if devices remain unavailable.
: Check input device selection in System Preferences > Sound, grant microphone access to apps in Privacy settings, and test with another app to confirm routing.
: Disable exclusive mode in apps, adjust sample rate to match device capabilities, and update audio drivers including Bluetooth codecs if relevant.
: Reopen the affected app, reselect the output device, and restart coreaudiod if necessary; ensure macOS is up to date to fix known issues.

Frequently Asked Questions

What is coreaudiod on macOS?

coreaudiod is the Core Audio daemon that coordinates all system audio I/O, routing, and device changes. It runs in the background and is essential for playback, recording, and audio management.

Is coreaudiod safe?

Yes, when it is located at /usr/sbin/coreaudiod and signed by Apple. It is a core macOS component, routinely updated by Apple, and not intended to connect to external networks.

Why does coreaudiod use CPU?

coreaudiod may use CPU when managing many simultaneous audio streams, upgrading sample-rate handling, or when devices are changing. A brief spike can be normal; sustained high usage suggests device drivers or misbehaving apps.

How do I restart coreaudiod?

Open Terminal and run sudo killall coreaudiod or log out and back in. macOS will automatically restart the daemon to restore audio services.

Can I disable coreaudiod permanently?

No. macOS requires coreaudiod for audio routing. You can temporarily stop or restart it to troubleshoot, but it will restart automatically and cannot be disabled via standard user controls.

Where is coreaudiod located?

The legitimate binary is /usr/sbin/coreaudiod. It is signed by Apple. If you find a copy elsewhere or with a non-Apple signature, treat it as suspicious.