rapportd — the process behind Handoff, and the one your firewall keeps asking about

Last updated: 2026-07-30

What it is

rapportd is the daemon behind Continuity, Apple's umbrella term for the features that make your devices behave as parts of one system rather than as separate machines.

Concretely, it handles Handoff (starting a message on your iPhone and finishing it on your Mac), Universal Clipboard (copy on one device, paste on the other), iPhone Cellular Calls (your Mac ringing when your phone does) and Instant Hotspot (your iPhone's hotspot appearing in your Wi-Fi menu without you touching the phone).

All of those require the same underlying capability: your Mac has to know which of your other devices are nearby, whether they are awake, and how to reach them. Maintaining that awareness is rapportd's job, and it is why the process is active even when you are not consciously using any Continuity feature.

Why it talks to the network

Two mechanisms, both mostly local.

Bluetooth Low Energy handles proximity — cheaply detecting that another of your devices is nearby without either machine having to stay awake on Wi-Fi.

Local network connections handle the actual work once a device is found. This is the part that matters for firewalls: rapportd opens a listening socket, because your iPhone has to be able to initiate a connection *to* your Mac. A phone call arriving at your Mac is your iPhone reaching out, not your Mac polling.

This is why rapportd is one of the most frequently flagged processes in third-party firewall prompts. Accepting inbound connections is unusual for a background daemon, and it is exactly what the feature requires.

How much traffic is normal

Very little. Discovery and coordination traffic is measured in kilobytes, and it stays on your local network rather than crossing the internet.

Even when a Continuity feature actually fires, the volume is modest and usually local: a Universal Clipboard transfer is the size of what you copied, and iPhone Cellular Calls relays audio between two devices on the same network. Neither is a meaningful contributor to a data cap.

If rapportd shows a large figure, that is unusual enough to investigate — but the far more common complaint about it is not bandwidth, it is the firewall prompt and the open port.

Can you turn it off

Yes, but be clear about what you lose first. rapportd is an optionalOff process, which means macOS runs fine without it — that is not the same as saying you will not miss it.

Here is the list. Turning rapportd's features off costs you Handoff (start a message on your iPhone, finish it on your Mac), Universal Clipboard (copy on one device, paste on the other), Sidecar (using an iPad as a second display), iPhone Cellular Calls on your Mac, and Instant Hotspot. For a lot of people those are daily-use features. If any one of them matters to you, the answer is to leave it alone — it costs almost no bandwidth anyway.

One thing to be clear about: Apple does not give you a switch that turns rapportd off. Worth stating, because plenty of guides are written as though it does.

What you can turn off is individual features, not the process:

• System Settings › General › AirDrop & Handoff — turn off "Allow Handoff between this Mac and your iCloud devices"
• Same pane — turn off iPhone Cellular Calls
• Turning off Bluetooth removes most of the remaining nearby-device discovery

rapportd keeps running after all of that, because it also carries device pairing, remote display and Apple Watch auto-unlock. Expecting the process to disappear once Handoff is off is simply not how it works.

Could you force-remove it or block it in a firewall? Technically yes, at the cost of breaking nearby-device discovery, pairing, remote display and auto-unlock together — and the failure usually presents as "some feature mysteriously hangs" rather than "I turned that off". It costs almost no bandwidth to begin with, so the trade is a poor one.

So when is a tool like Bytetally the right answer? Two cases: processes Apple gives you no switch for, and features you want most of the time but need reined in while you are on a metered hotspot. Throttling or temporarily blocking solves "not right now" — it is the wrong instrument for "I do not want this feature".

Seeing what it actually used

rapportd is a good demonstration that "suspicious-looking" and "expensive" are different questions. It listens on a port, chats with your local network constantly, and triggers firewall warnings — while moving almost no data.

Bytetally reports actual bytes per process rather than connection behaviour, which lets you separate the two: whether to keep rapportd is a question about whether you use Continuity, not a question about bandwidth. The numbers make that clear so you can decide on the real criterion.

Related processes

Common questions