What is itunesstored, and why is it using the network?

Last updated: 2026-07-31

What it is

itunesstored is an Apple system daemon for iOS and iPadOS. It coordinates several parts of the Apple media-store and App Store machinery: account state, purchases, redownloads, download queues, application installation, and parts of some StoreKit transaction flows. It works alongside processes such as appstored, storekitd, and nsurlsessiond.

The exact division of work is private Apple implementation detail. It can change between system releases and may also differ by content type, so it would be misleading to assign every store operation to one daemon.

Despite its name, itunesstored is not a background service found in current macOS. Its launch configuration and executable have been verified inside an Apple iOS Simulator runtime, where it runs as the mobile user. The equivalent launch service, executable, and manual page were not found on the current Mac system. macOS instead has related services including appstoreagent, storeaccountd, storedownloadd, and itunescloudd.

Why it talks to the network

Network activity can begin when someone buys or redownloads content, when an automatic download is triggered, or when the App Store installs or updates an application. StoreKit purchase and restore operations can also involve itunesstored. Less visible account maintenance, such as refreshing account or storefront state, may produce connections too.

Those connections can involve Apple Media Services, account and transaction services used by the iTunes Store or App Store, Apple push services, and Apple CDNs that host manifests or content. That list describes service categories, not a fixed set of hostnames.

The process coordinating a transfer is not necessarily the process that carries all its bytes. In particular, nsurlsessiond may perform a background transfer on behalf of store components. A large application or media download can therefore appear under nsurlsessiond instead of itunesstored, even when a store action initiated the work.

How much traffic is normal

There is no reliable process-level traffic baseline for itunesstored. When the device is idle, it commonly has little or no visible traffic. During a purchase, installation, update, or redownload, activity may grow to a scale comparable with the application or media being transferred.

That does not provide a dependable expected number of megabytes. The content size varies, and background work may be charged to nsurlsessiond rather than this daemon. A single process reading is therefore insufficient to determine whether the overall store transfer is unusual.

Can you turn it off

Apple does not provide a supported switch for turning off itunesstored, so there is no System Settings path to follow. Controls for automatic downloads in individual Mac apps do not disable this daemon and should not be presented as a system-wide off switch.

Forcibly disabling it on iOS or iPadOS may interfere with App Store sign-in, purchases, application installation or updates, redownloads, download queues, and StoreKit transactions. On current macOS, there is no corresponding system daemon to disable. Removing a launch property list or preference file is not a supported optimization and may instead leave store services damaged, repeatedly restarting, or unable to complete transactions.

What people get wrong

• “itunesstored is the current macOS iTunes or media-download process.” That is inaccurate. The daemon is present in the verified iOS Simulator runtime, but no matching launch service, executable, or manual page was found in current macOS. A record on a Mac may have come from the Simulator, connected-device logs, or incorrect process classification.

• “It only performs bulk downloads, so throttling it is harmless.” Its role is broader than bulk transfer. It also coordinates accounts, purchases, download queues, application installation, and parts of StoreKit activity. Throttling can make store operations time out or fail, while the largest transfer may still run through nsurlsessiond.

• “itunesstored performs every App Store receipt check.” There is no reliable evidence for that claim. Apple’s StoreKit documentation describes transaction or receipt verification by the application on the device, by a developer’s server, or through StoreKit verification mechanisms. It does not assign universal receipt validation to this private daemon.

• “Seeing itunesstored means the device is infected.” The name belongs to an Apple-provided iOS and iPadOS system component, so its presence there is not evidence of malware. If an executable using that name appears directly on a Mac, check its actual path and code signature before deciding what it is.

• “Deleting its launch file or preferences is a safe system optimization.” Apple provides no support for that approach. It can damage store operations, cause repeated restarts, or make transactions fail.

Seeing what it actually used

If itunesstored appears in Mac traffic records, first verify the executable path and code signature so Simulator activity or incorrect attribution is not mistaken for a native macOS daemon. Then use Bytetally’s per-process statistics to compare the recorded activity with nsurlsessiond and related store processes. Treat the result as attribution evidence, especially when a background transfer may have moved the actual bytes.

Related processes

Common questions