What is swcd on Mac, and why is it using the network?

Last updated: 2026-07-31

What it is

swcd is a per-user background process included with macOS. launchd starts it when its services are needed, so it may appear, disappear, and return without the user opening it directly. The system executable is located at /usr/libexec/swcd, and the Apple platform signature identifies it as com.apple.swcd.

Its job is to maintain the Associated Domains database. Apps carrying the appropriate entitlement declare website domains with which they are allowed to interact. swcd obtains and validates the Apple App Site Association, or AASA, files that describe those relationships.

Those verified associations support several features. They allow Universal Links to open an eligible link in its corresponding app, establish eligibility for shared web credentials and Password AutoFill inside apps, and participate in some handoffs from a web experience to a native app. swcd helps establish the association; it is not itself a password vault.

Why it talks to the network

Network activity commonly begins after an app with the Associated Domains entitlement is installed or registered again. Stored association data also needs periodic updates after installation. Apple’s documentation says devices check for updates approximately once a week, although the exact internal schedule across macOS releases has not been independently verified.

In the normal delivery mode, swcd requests AASA metadata through an Apple-managed Associated Domains CDN. If the CDN does not have a current cached copy, the Apple CDN contacts the website’s origin. This means a connection made for an app-to-website association does not necessarily go directly from the Mac to that website.

There are exceptions. When an app uses the developer or managed alternate mode, the Mac can contact a domain named in the app’s entitlement directly. That difference is important when interpreting destination hosts in a network monitor.

Clicking a Universal Link does not ordinarily cause a fresh download on every click. Association results are cached, while retrieval is centered on app installation, registration, and later refreshes. The transferred AASA data is configuration-like JSON containing app identifiers, service types, and URL-matching rules.

How much traffic is normal

Normal swcd traffic is low to very low. It tends to arrive as intermittent, small bursts rather than a continuous stream because the downloaded material is association metadata, not media, system updates, or cloud-drive content.

A temporary increase can occur after installing many apps, particularly when those apps declare numerous associated domains. Apple has not published a dependable per-request or monthly byte figure for swcd, however. A specific MB allowance would therefore be unverified and should not be treated as a normal-usage threshold.

Can you turn it off

The practical recommendation is to keep swcd available. Apple does not provide a System Settings switch that disables the entire service, so there is no settings path to follow. The Handoff control in AirDrop & Continuity settings turns off Handoff functionality; it is not a master switch for swcd or Associated Domains.

If network access is forcibly blocked, associations already present in the cache may continue working for a time. New installations and changed associations may fail to verify or update. Universal Links can then fall back to ordinary web pages, app-based password suggestions or shared credentials that depend on Associated Domains may become unavailable, and related Handoff activity may fail.

Those effects are conditional rather than immediate guarantees. Blocking swcd is also not the same as turning off every Safari webpage password-autofill feature. Terminating the process does not permanently disable it either, because launchd can start it again when the system requests its services.

What people get wrong

• “swcd is third-party software or malware.” The system copy is an Apple platform-signed component identified as com.apple.swcd, with its executable under /usr/libexec. Its presence is expected on macOS.

• “It uploads my passwords or browsing history to websites.” There is no reliable evidence for that claim. Its verified network responsibility is retrieving app-to-website association metadata. AASA files contain app identifiers, service types, and URL-matching rules, not user passwords.

• “Every Universal Link click makes swcd contact the destination website.” Association data is cached. Downloads mainly occur during app installation or registration and during later refreshes. In normal mode, the Mac requests the metadata from Apple’s managed CDN rather than contacting the destination website for every click.

• “Blocking it only turns off Universal Links.” Associated Domains cover more than link routing. The same association mechanism also supports shared web credentials, eligibility for Password AutoFill within apps, and some web-to-app Handoff scenarios.

• “Blocking it immediately breaks every Universal Link and all autofill.” That is too absolute. Cached associations may remain usable, and ordinary browser autofill is not identical to the Associated Domains checks used between apps and websites.

• “Disabling it will noticeably save bandwidth or improve Mac performance.” There is no reliable evidence for that conclusion. Normal traffic is sparse metadata activity, while blocking it can make association-dependent features fail without an obvious error message.

Seeing what it actually used

If the question is about this Mac rather than a general estimate, the next step is to measure swcd by process over the period you care about. Bytetally can show its upload, download, and timing separately from the rest of the system. Compare that history with recent app installations or registrations instead of relying on an unverified fixed MB threshold.

Related processes

Common questions