One of the most common recommendations when trying to solve Mac problems is to restart in Safe mode and see if that resolves them. But why should it? What is Safe mode, and how might it solve a problem?

Officially Safe

First, many of us do not always follow Apple’s current instructions for entering Safe mode, and when we think we have entered it, it may not be complete. Those instructions are given here, and read:

1. If your Mac is not already shut down, shut it down, and wait 10 seconds before pressing the Power Button to start it up; restarting is not a good way to get this to work properly!
2. As soon as you hear the startup chime/chord, press and hold down the Shift key on your keyboard.
3. Once the grey Apple logo and progress bar appear, you can release the Shift key.
4. To return to normal mode, simply restart your Mac (without holding the Shift key, of course).

There are two valuable confirmations that you have successfully entered Safe mode: during the late part of startup, the text Safe Boot appears in red at the top right of the display on the login screen, and the System Report dialog (entered by clicking on the System Report… button in the About This Mac dialog) shows Safe as the Boot Mode when you select the Software header in the list at the left.

If you have FileVault disk encryption active, you should follow the same basic procedure, but you will probably be required to log on twice: once to unlock the disk, and a second time to log into the Finder.

What Happens in Safe Mode

Startup takes longer, may go through various unusual display sequences, and once started up, your Mac will feel sluggish if not downright slow.

It used to be that starting up in Safe mode forced a check of your startup disk, but since the advent of SIP such checks can only be performed fully in Recovery mode. This does at least shorten the time taken to start up in Safe mode, a bit. Normally the progress bar sticks for a long time when it is almost complete: this is because of the various housekeeping tasks which OS X undertakes.

Browse through your logs after starting up in Safe mode, and you will notice that a lot of kernel extensions (KEXTs) are not loaded, even Apple’s: this is why it is ‘safe’, as it avoids almost all potential conflicts which could occur there. Your logs will contain entries like
23/08/2016 20:37:36.000 kernel[0]: Can't load kext com.apple.driver.AppleThunderboltIP - not loadable during safe boot.
23/08/2016 20:37:36.000 kernel[0]: Kext com.apple.driver.AppleThunderboltIP failed to load (0xdc008012).
23/08/2016 20:37:36.000 kernel[0]: Failed to load kext com.apple.driver.AppleThunderboltIP (error 0xdc008012).
23/08/2016 20:37:36.000 kernel[0]: Couldn't alloc class "AppleThunderboltIPService"

In that case, it will prevent Thunderbolt networking. Startup Items and Login Items are similarly screened, and only essentials are loaded. This makes Safe mode an excellent option if you might have a third-party kernel extension, startup item, login item, etc., which is causing problems.

The other feature of Safe mode is that OS X flushes many of its caches, and disables user-installed fonts. This ‘freshens’ many parts of OS X, and can untwist font issues, or cache problems. Unfortunately Apple does not list the caches which are cleared, but they are believed to include font caches, the Kernel cache, and unspecified others.

Because of the extensions and other components which are disabled in Safe mode, a lot of features of OS X and third-party apps will not work in this mode. These may include:

• DVD playing,
• video capture,
• USB and other non-basic audio input and output,
• WiFi (varies with model),
• file sharing.

Enforced Safe mode

Sometimes, when a Mac starts up or restarts, OS X may decide to enter Safe mode because of a problem it has encountered. This now appears to be very uncommon, as does ‘stuck’ Safe mode, where the Mac will only start up in Safe mode. Either way, you would be wise to check your hardware diagnostics and enter Recovery mode to perform first aid on your startup disk, if this were to occur.