/private/var/folders on a Mac is where macOS keeps a private temporary folder and a private cache folder for every account on the Mac. Apps, command-line tools and macOS's own services write there while they work. The folder is hidden, its names look random, and Storage settings counts it in System Data.
It grows because only part of it is cleaned on a schedule. macOS removes temporary items that haven't been used for three days, but it leaves the cache part to the apps that made it, and some apps keep large files there or leave them behind when a job stops halfway.
So don't delete it, even when it's large. Find the subfolder that has grown, deal with the app it belongs to, and restart. When you need the space at once, safe mode clears the cache part the way macOS intends.
This post goes deeper than the overview in system caches on a Mac: how the cleanup really works, what makes each part grow, how to find the app responsible, and which common advice backfires.
What is /private/var/folders on a Mac?
It's a hidden folder inside the private folder at the top of your startup disk, and macOS has used it since Mac OS X Leopard. macOS creates a folder there for each account that needs one: yours, any other person's on the Mac, and the accounts its own background services run as.
Each account's folder holds a few short-named folders with separate jobs: one for temporary items, one for caches, one for files other accounts may read, and, since macOS Big Sur, one that macOS clears at startup. The next section goes through each.
Why are there two names, /var/folders and /private/var/folders?
They're the same folder. On a Mac, / is a link to /, just as / points to / and / to /. Apps and error messages often show the short form, and disk tools usually show the long one.
Finder's Go › Go to Folder accepts either. Both open the same place, and anything you see in one is in the other.
Why do the folder names look so random?
Each account's folder sits two levels down: a folder with a two-character name, then one with a long string of letters and numbers, such as zz/zyxvpxvq6csfxvn_n0000000000000. A helper in macOS called dirhelper creates these special folders for each account, which ordinary apps don't have permission to do.
The names aren't a sign of malware or of something broken. If a folder goes missing, macOS creates it again the next time something asks for it.
Which account does each folder belong to?
You can't tell from the name. Finder can: select the long-named folder, choose File › Get Info, and look under Sharing & Permissions. Your own folder lists your account with Read & Write.
Folders under zz belong to macOS's own accounts, such as root and the accounts its background services run as. On a Mac shared by several people, each person who has logged in has a folder of their own in one of the other two-character folders.
Who puts files there?
Most Mac apps never pick a temporary folder themselves. They ask macOS for one, and macOS hands them the temporary folder inside your account's folder. Command-line tools find it through the TMPDIR setting, which points to the same place.
The same goes for caches an app wants to keep out of your Library folder. macOS's manual describes the cache folder here as a good place for user cache data, because the system won't clean it automatically.
What's inside: the T, C, 0 and X folders
Open your account's folder and you'll find these. macOS's manual for confstr, a call apps can use to ask for these folders, describes the first three; Chromium's source code describes the fourth.
| Folder | What it's for | Cleared by macOS |
|---|---|---|
T | Temporary items | Items not accessed for three days |
C | Caches | Not on a schedule; files removed in safe mode |
0 | Files other accounts may read | Not on a schedule |
X | Clones of running apps, made by Chromium browsers | At startup, according to Chromium's code |
zz/… | Folders of macOS's own accounts | By macOS |
The manual says T and C are created readable only by their owner, while 0 is readable by everyone. That's why you can open your own T and C folders in Finder but not anyone else's.
What's in the T folder?
Short-lived files that apps and tools need only while they work. You'll see folders named after apps and services, and many files with long generated names ending in -shm and -wal, the working files of databases that apps have open.
The T folder is what most people mean by "the Mac temp folder". Developers see it in error messages and logs, because it's where build tools and scripts write by default.
What's in the C folder?
Caches that apps and services chose to keep here rather than in ~/. Folders are named after the app or service, usually by its bundle ID, such as com.apple.metal or com.google.Chrome.helper.
Unlike T, nothing empties C on a schedule. An app that stores a large cache here keeps it until the app trims it or until you start up in safe mode.
What is the 0 folder?
It's the account's general folder, for files that don't need to be private. The manual warns apps not to keep sensitive or temporary files there, because every account on the Mac can see them.
macOS services keep small working files in it. On the Mac we checked, it held about 12 MB, so it's rarely the reason the folder is large.
What is the X folder?
Since macOS Big Sur, macOS also keeps a folder for each account that it clears when the Mac starts up. Chromium, the code that Chrome and several other browsers are built on, uses it for its code-signing clones: folders whose names end in code_sign_clone, one for each such browser.
Chromium's source code describes this folder as cleaned when the Mac starts up and not otherwise cleaned on a schedule. The browser also removes its own clone after it quits, as a later section explains.
Why /private/var/folders grows
It grows for six reasons, and they need different responses. Knowing which one you're facing saves you from fixes that don't help.
Caches that nothing clears on a schedule
The C folder is the slow, steady part. Every app that keeps a cache there adds to it, and since macOS doesn't empty it on a schedule, it only shrinks when the app trims its own cache.
Apps you've deleted are a special case. Their folders in C can stay behind, and since nothing removes them on a schedule, they go only in safe mode.
Temporary files from jobs that never finish cleaning up
An app is supposed to delete its temporary files when it's done with them. When it quits unexpectedly, is force quit, or simply doesn't clean up, the files stay in T until the three-day rule removes them.
Batch jobs are the usual culprits, because they write thousands of files quickly. In one Apple Community thread, someone resizing thousands of images with a script watched the folder reach about 40 GB, until Mail crashed for lack of space. A restart cleared it.
Developer tools: compilers, Xcode and shader caches
Developers' Macs keep more here than most. The clang compiler, which Xcode and the Swift tools use, keeps its default module cache in C/ when a build doesn't name its own folder. Xcode's own builds keep theirs in DerivedData instead.
Xcode also keeps a folder in C for each version you've run, under com.apple.DeveloperTools, named after the version and build, such as 26.3-17C529. They're small: a few megabytes each on the Mac we checked.
Tools built on Node.js can add a node-compile-cache folder to T: Node's documentation says that's where its compile cache goes when a tool turns it on without naming a folder.
Graphics shader caches
Folders named com.apple.metal and com.apple.metalfe belong to Metal, Apple's graphics framework, and hold compiled shaders, often with a com.apple.gpuarchiver folder beside them. Apple describes Metal's shader cache as speeding up the creation of graphics pipelines an app made in earlier runs.
On the Mac we checked, running macOS 27, these folders also appeared inside a folder for each app that draws with Metal: browsers' helpers, a 3D app and the simulator's renderer. The 3D app's was the largest.
Files that are deleted but still open
When an app deletes a file it still has open, macOS removes the name at once but keeps the data until the app closes the file. The manual for unlink, the call that deletes files, says so plainly.
So a temporary folder can look small in Finder while its space is still in use, and deleting files there yourself may not free anything until the app quits. That's one reason a restart sometimes frees space no folder seems to account for.
Browsers' code-signing clones
The X folder can look large. Chromium's code makes an APFS copy-on-write clone of the browser in it, so the files the browser is running stay available after an update is staged and its code signature stays valid.
Apple's documentation says a clone occupies no additional space on disk. But when the update replaces the app, the clone keeps the old version's files, and from then on they take real space until the browser quits and its cleanup helper removes them.
An example: one developer's Mac
Here's what one Mac had in its own account's folder, measured in October 2026 on macOS 27. It's an example, not a norm: your apps decide what's in yours.
| Item | Folder | Size |
|---|---|---|
| Browser code-signing clones, three browsers | X | 2.6 GB counted file by file |
| Clang's module cache | C/clang/ModuleCache | 683 MB |
| Metal shader cache | C/com.apple.metal | 376 MB |
| A 3D app's shader caches | C/org.blenderfoundation.blender | 203 MB |
| Node.js compile cache | T/node-compile-cache | 257 MB |
The rest of T | T | about 140 MB |
The X figure shows why totals mislead. Chrome's clone measured 1.4 GB, the same as the Chrome app itself, because a tool that adds up file sizes counts a clone as a full copy. While the browser and its clone match, the clone takes almost nothing extra.
Everything else here rebuilds by itself. The clang cache saves time on the next build, the shader caches save time when an app draws, and the Node cache saves time when a tool starts. None of it is worth deleting by hand.
How macOS cleans /private/var/folders by itself
macOS has three cleanup mechanisms for these folders, and each one reaches a different part. None of them is a setting you can see or change in System Settings.
The three-day rule for temporary items
The manual says files in T may be removed if they haven't been accessed in three days. A macOS service, dirhelper, does that once a day: its schedule, in macOS 27, is 3:35 in the morning, with a three-day limit.
If your Mac is asleep at that time, macOS runs the job when it next wakes, so a Mac that sleeps through the night still gets cleaned. An Apple engineer has noted on Apple's developer forums that these details aren't a promise to developers and can change between releases.
What a restart does
A restart closes every app, so files they held open are finally released. According to Chromium's code, macOS also clears the X folder as it starts up. That's why the folder sometimes shrinks after a restart.
It isn't documented that a restart empties T or C. The three-day rule still decides what goes from T, and C keeps its caches. If a restart didn't help, the space is in C or in files newer than three days.
Why doesn't the three-day rule catch everything?
The rule looks at when a file was last accessed, not when it was made. A file an app reads every day stays, however old it is, and so does everything a long job wrote in the last three days.
It also covers only T. Caches in C, clones in X and the small files in 0 are outside it, which is why a folder that's mostly C doesn't shrink overnight.
What safe mode clears
Apple says starting up in safe mode clears some system caches, including font caches and the kernel cache, which macOS creates again as needed. The confstr manual adds that files in each account's C folder are removed during safe boot.
Apple's guide to freeing up storage suggests safe mode for exactly this kind of need: to make room for a task, such as installing an update, that needs extra space only while it runs. Then restart normally.
On a Mac with Apple silicon:
- Choose Apple menu › Shut Down, and wait until the screen is black.
- Press and hold the power button until Loading startup options appears.
- Select your startup disk.
- Press and hold Shift, then click Continue in Safe Mode. Safe Boot appears in the menu bar at the login window.
On an Intel-based Mac, turn it on or restart it, then press and hold Shift right away until the login window appears, and log in; you may be asked to log in twice. To leave safe mode, restart without holding any keys. The steps are the same in macOS 26 Tahoe and macOS 27 Golden Gate.
Does macOS clear it when the disk is nearly full?
Apple doesn't say. It says that when space is needed, macOS clears caches and logs that are safe to delete, such as temporary database files, interrupted downloads, staged macOS and app updates, and Safari's website data. Its list ends with "and more".
These folders aren't named in that list, so don't count on it. If space is short now, the restart and safe mode steps above are the ones that are documented.
What changed between macOS versions?
The basic layout hasn't changed since Mac OS X Leopard: T for temporary items, C for caches and 0 for files others may read. The X folder is newer: Chromium's code says it's available from macOS Big Sur onwards.
What changes with each release is what's inside, because macOS adds and retires services. On the Mac we checked, macOS 27 kept a Metal shader folder inside each app's folder in C, as well as one shared folder.
Where you see the result has moved too. Since macOS Ventura, Storage settings is in System Settings › General › Storage, in macOS 26 and macOS 27 alike; before that, it was under About This Mac › Storage.
How big should /private/var/folders be?
There's no official figure, and it varies more than most of System Data. The research behind the app's catalog puts its typical size between about 1 GB and 70 GB. Here it is next to the other large parts of System Data.
- Per-user temporary folders1–70 GB · Managed by macOS
- Your own app caches2–30 GB · Safe
- Swap and sleep image1–20 GB · Managed by macOS
- Shared caches in /Library/Caches1–10 GB · Usually safe
- Logs and crash reports0.1–5 GB · Safe
Typical ranges on Macs that have these items, from the research behind the app's rules catalog. The ranges are wide because Macs, and the apps on them, differ.
How do you see its size in Finder?
- In Finder, choose Go › Go to Folder, type
/and press Return.private/ var/ folders - Open each two-character folder until you find your account's long-named folder. Use File › Get Info to check it's yours.
- Open it, choose View › as List, then View › Show View Options, and select Calculate all sizes.
- Click the Size column heading to put the largest first, then open the largest folder and repeat.
Looking is harmless. Finder only opens folders you have permission to read, so you can't look inside other accounts' T and C folders, including those under zz.
Why do disk tools disagree about its size?
Because they count different things. A tool that adds up every file counts each browser clone in X as a full copy, while APFS shares that space with the app. A tool that can't read other accounts' folders leaves them out, and one with more access adds them in.
The folder also changes while you measure: temporary files come and go by the second. Two scans a few minutes apart rarely match, and neither is wrong.
When is it too big?
The size alone doesn't tell you much. These signs matter more:
- It keeps growing day after day, past a few gigabytes.
- One subfolder holds most of it.
- It doesn't shrink after a restart, or fills up again soon after.
- It's large enough to block an update you need to install.
Any of these points to one app or tool, and the fix is in that app, not in the folder.
Is it safe to delete /private/var/folders?
No. The catalog rates Per-user temporary files and caches as Managed by macOS: macOS creates these folders, apps use them while they run, and macOS clears them in the ways described above.
That doesn't mean everything inside is precious. Most of it is temporary or rebuildable. The problem is that you can't tell from Finder which files an app has open right now, and the folder structure itself has to stay as macOS made it.
What can go wrong if you delete files there?
The catalog's entry lists the risk: removing files while apps are using them can make those apps lose work in progress or quit unexpectedly. Anything an app is in the middle of can live in T.
Wiping caches has a cost too. An administrator who studied the folder on OS X Mavericks reported slow logins on shared Macs after its caches were deleted, because every service had to rebuild them.
Why Terminal commands are the riskiest advice
Many guides tell you to empty the folder with a command run as an administrator. Such a command skips the Trash, can't be undone, and removes every account's files and macOS's own, not just yours.
It also deletes files apps have open, which, as shown above, may not free their space until those apps quit anyway. A restart and safe mode clear what's safe to clear without that risk, and fake cleanup guides that ask you to paste commands are a known way to spread malware.
Why moving things to the Trash doesn't help either
Finder will let you move some of your own items to the Trash, but the space comes back only when you empty it, and items still in use stay in use. Items owned by macOS ask for an administrator's password, which is a sign to stop.
| What you'll read | What happens |
|---|---|
| Delete everything in it and restart | Apps can lose work; services rebuild caches; little that safe mode doesn't do safely |
| Run a command to clear it | No Trash, no undo, every account affected |
| Delete the T folder | Open files keep their space; apps may fail mid-task |
| Leave it to macOS | Old temporary items go daily; caches go in safe mode |
| Find and fix the app filling it | The space stays free |
What to do when /private/var/folders is huge
The goal is to find the app that's filling the folder and change what it does. None of these steps has you delete anything inside the folder.
Find the folder that's large
Follow the Finder steps above until you reach the largest folder inside T, C or X. Note its name and the dates in the Date Modified column: a folder that changed minutes ago is in active use.
If T is large but full of small files with generated names, sort by Date Modified instead of size. A burst of files from the same day usually points to one job.
Match the folder to an app
Most folders are named after the app or service that made them, by bundle ID:
- Names that start with com.apple belong to macOS or Apple's apps. Leave them to macOS.
- Names such as com.google.Chrome.helper or org.blenderfoundation.blender belong to that app.
- Names of tools, such as clang or node-compile-cache, belong to developer tools.
- Folders ending in code_sign_clone, in X, belong to the browser in their name.
If the name doesn't help, open Activity Monitor in the Utilities folder, double-click an app you suspect, and click Open Files and Ports. If the app has files open in the folder, their paths are listed there.
Watch which app is writing
When the folder grows while you watch, open Activity Monitor and click Disk. Apple's guide says it shows the amount of data read from and written to your disk; click the Bytes Written column heading to put the busiest process first.
A process that has written tens of gigabytes since it started, while you weren't doing anything with it, is worth a closer look.
Quit the app, then restart your Mac
Quit the app properly, with Quit in its app menu, so it can delete its own temporary files and close the ones it held open. For a browser, quit it completely rather than closing its windows: Chromium's cleanup helper removes the clone only after the browser exits.
Then restart. A restart releases anything still held open and clears the X folder. If the folder is still large afterwards, the space is in C or in files newer than three days.
Use safe mode when you need the space now
If C holds most of it and you need the room today, for a macOS update for example, start up in safe mode once, as described above, then restart normally. The cache part is emptied, and apps build what they need again as you use them.
Don't make it a habit. The caches come back with use, and apps and the system run slower for a while as they rebuild them.
When the same app fills it again
If one app keeps refilling the folder, the fix is in the app:
- Update it. If leaving files behind is a bug, a newer version may fix it.
- Look in its settings for a cache, scratch or temporary folder setting. Video, audio and 3D apps often have one, and some let you point it at another drive.
- Use the app's own command for clearing its cache, if it has one.
- Contact its developer with the folder's name and size.
- If you no longer use the app, uninstall it. Its folder in C then waits for the next safe mode.
What about other accounts on the Mac?
Every person who uses the Mac has a folder of their own here, and its size counts in the Mac's System Data, even though you can't open it. If someone else's folder is the large one, they can quit their apps and restart, as above, from their own account.
The confstr manual's safe boot rule applies to each account's cache folder, so starting up in safe mode clears theirs as well as yours. Their temporary items follow the same three-day rule.
Can you move /private/var/folders to another drive?
No. macOS has no setting for it, and replacing the folder with a link to another drive isn't a setup macOS supports. Apps expect it on the startup disk, where macOS creates it.
What you can move is the work of the app that fills it. Many video, audio and 3D apps let you choose their cache or scratch folder in their settings, and some developer tools have a setting for their temporary folder too.
/private/var/folders compared with other cache and temporary folders
Several folders on a Mac hold caches and temporary files, and they're managed differently. The overview of System Data on a Mac shows where each fits in Storage settings.
| Folder | Whose it is | Who clears it | Level |
|---|---|---|---|
~/Library/Caches | Your apps | You can, app by app | Safe |
/Library/Caches | Every user's apps and services | You can, with care | Usually safe |
/private/var/folders | Each account, privately | macOS | Managed by macOS |
/private/tmp | Every user and tool | macOS, daily | Managed by macOS |
/private/var/vm | macOS, as extra memory | macOS; a restart clears swap | Managed by macOS |
How is it different from ~/Library/Caches?
~/ is in your own Library folder, where Apple's guidelines tell apps to keep only data they can recreate. You can quit an app and move its folder there to the Trash, which is why the guide to clearing cache on a Mac starts there.
The C folder here holds the same kind of data, but in a place macOS manages and Finder hides. Its contents are cleared through safe mode rather than by hand.
How is it different from /tmp?
/ is one folder shared by every account and tool on the Mac. The catalog says macOS removes items there that haven't been opened or changed for three days, each day.
The T folder here is private to one account, and only that account's apps can read it. Apple's frameworks give apps the private one; installers and some command-line tools use the shared one.
Is it part of System Data?
Yes. Storage settings, in System Settings › General › Storage, puts it in System Data, which Apple describes as files that don't fall into the other categories. Apple adds that you can't manage that category's contents there.
That's why a large /private/var/folders can make System Data jump and then drop again after a restart or a night's cleanup. The guide to System Data covers the other parts that move it.
Does the folder exist on every Mac?
Yes. macOS creates it at startup if it's missing, and creates each account's folder the first time something asks for it.
How the app does it
Wombit explains / like every other item on the disk. Select it in the map or the list, and the inspector shows the catalog's entry: what it is, that it's Managed by macOS, and that macOS clears it itself. It's explained, never moved.
On the System Data page, it's counted with the rest of System Data in named buckets, next to how much the app couldn't explain. Hard links and APFS clones count once, so the browser clones in X aren't counted as full copies. Folders macOS didn't let it read are listed, not skipped.
/
private/ var/ folders Per-user temporary files and caches
Private temporary folders and caches that macOS creates for each user account, in hidden folders with random names.
Managed by macOS · Explained only: never removed
/
private/ tmp A folder shared by all users where apps, installers and command-line tools put short-lived files.
Managed by macOS · Explained only: never removed
Seeing all of this is free, and the app reads only names, sizes and dates; file names and paths never leave your Mac. Cleanup, which moves the items you can clear, such as your own app caches, to the Trash, is PRO.
Frequently asked questions
Can I delete /private/var/folders on my Mac?
No. macOS creates these folders for each account, apps keep files open in them, and macOS clears them itself: old temporary items daily, and the cache part in safe mode. Deleting files there can make apps lose work or quit unexpectedly. If the folder is large, find the app filling it instead.
Why is /private/var/folders so big?
Usually one app or tool. The cache part isn't cleaned on a schedule, batch jobs and apps that quit halfway leave temporary files behind, developer tools keep compiler and shader caches there, and browsers built on Chromium keep clones of themselves. Open it in Finder, find the largest subfolder, and match its name to an app.
Does restarting a Mac clear /var/folders?
Partly. A restart closes every app, which releases files they held open, and according to Chromium's code it clears the folder Chromium browsers use for their clones. It isn't documented that a restart empties the temporary or cache folders. Old temporary items are removed daily, and safe mode removes the cache part.
What is the zz folder in /private/var/folders?
It holds the private folders of macOS's own accounts, such as root and the accounts its background services run as. They aren't yours, Finder can't open most of them, and macOS manages them. People's own folders are in the other two-character folders next to it.
Where is the temp folder on a Mac?
Each account has its own, in the T folder inside its folder under /private/var/folders. That's the folder macOS gives apps that ask for a temporary location, and the one the TMPDIR setting points to. There's also a shared folder, /private/tmp, which every account and tool can use.
Are the random folder names in /private/var/folders a virus?
No. A macOS helper called dirhelper creates them for each account, and the names are generated rather than chosen by an app. Every Mac has them. What's inside comes from the apps and services you use, and folder names inside usually say which app made them.
Does /private/var/folders count as System Data?
Yes. Storage settings puts it in System Data, the category for files that don't fall into any other, and doesn't let you manage what's inside. A large /private/var/folders can make System Data jump, and drop again after a restart or the nightly cleanup.
Sources
- Free up storage space on Mac · Apple
- Start up your Mac in safe mode · Apple
- About Apple File System · Apple
- When /tmp and $TMPDIR directory are cleaned up in macOS? · Apple Developer Forums
- confstr(3) manual page · Xcode man pages
- code_sign_clone_manager.mm · Chromium