Who is _hidd? Decode Mac system accounts.

What the underscore accounts are

macOS runs its background services under dedicated role accounts — usernames that start with an underscore — instead of running everything as root or as you. Giving each service its own restricted identity limits what a flaw in it can reach; it reduces the blast radius rather than guaranteeing isolation. Activity Monitor’s User column and the first column of ps aux show which account each process runs as; the account is not the program itself.

These are not ordinary login accounts. In the capture below every one of the 129 has no password set at all — the password field is *, with no authentication authority — and 127 of them have /usr/bin/false as their shell, which refuses a login session. Two ship differently: _uucp (/usr/sbin/uucico) is the historic Unix-to-Unix copy service, and _mbsetupuser (/bin/bash) is the account Setup Assistant runs as — macOS itself can hand that one a random one-time auto-login while first-time setup is in progress, which is why it is the entry you may briefly see at the login window.

Check it yourself, without this page

• dscl . -read /Users/_hidd RealName — Apple’s own label for the account.
• ps aux | grep -v grep | grep _hidd — what is actually running under it right now.
• In Activity Monitor, add the User column (View → Columns) to see who runs what.

What this tool will never do

It will never tell you a process is “safe” or “malware” — no honest lookup can. A familiar account name is not identity proof: if a process worries you, inspect its executable path and code signature. This page identifies the account and explains what it exists for — the same honest posture CoreGuard takes in the app: it observes and explains, and every hardware-danger warning is free.

FAQ

Is _hidd (or another _underscore name) malware?

Seeing an _underscore name in the USER column of Activity Monitor or ps is normal: macOS ships a set of role accounts so that each system service can run with only the access it needs, and the 129 listed here are the ones on the reference Mac. The underscore is a convention, not a guarantee — a name that is not in this list may come from another macOS release or from software you installed. And a familiar name is not identity proof either: if a PROCESS worries you, check its executable path and code signature rather than judging by the name. This page never issues a safe/unsafe verdict.

Can these accounts log in to my Mac?

Not as ordinary users. In this capture every one of the 129 has no password set at all (the password field is *, with no authentication authority), and 127 of them have /usr/bin/false as their shell, which refuses a login session. Two ship differently: _uucp (/usr/sbin/uucico) is the historic Unix-to-Unix copy service, and _mbsetupuser (/bin/bash) is the account Setup Assistant runs as — macOS itself can hand that one a random one-time auto-login while first-time setup is in progress, which is why it is the entry you may briefly see at the login window. They exist so services, and setup, can run under a restricted identity.

Why does Activity Monitor show them at all?

macOS runs many services under dedicated role accounts instead of root, which limits what a flaw in any one of them can reach. Activity Monitor’s USER column shows which account each process runs as — the _underscore entry is the account, and the process name next to it is the program.

Is this list the same on every Mac?

Mostly, but it varies by macOS version — Apple adds and retires role accounts across releases. This table was captured from a real Mac running macOS 26.5.2 (Tahoe); another release may have a different set and a different count. The lookup tells you when a name is not in this capture.

Looking for a process, not an account?

If the name has no underscore, it’s usually a process. We’ve profiled the ones people search most:

All 129 underscore role accounts on macOS 26.5.2

Captured from a real Mac on 2026-07-25 with dscl . -list /Users (the roster), dscl . -list /Users UniqueID (the UIDs) and dscl . -list /Users RealName (the labels). The Apple label column is the account’s own RealName field as macOS ships it — not our wording. Notes are ours, only where we can stand behind them.