Safe mode is an underused tool for diagnosing and fixing problems in macOS. It has changed over the years: in Mojave it checked every Time Machine snapshot before opening the Finder, a step that could take half an hour or more. This article looks at what we know about Safe mode, what it does, and how it does it.

Starting up in Safe mode

This differs, depending on whether your Mac has an Intel processor, or an Apple silicon chip.

On Intel Macs, all you need do is start up restart with the Shift key held down until you see the login window.

On Apple silicon Macs, your Mac must be shut down to begin with. Then press its Power button and keep it held in until you see its Recovery options loading. Then select the startup disk you want your Mac to boot from, and hold the Shift key. The button underneath the disk will change to read Continue in Safe Mode. Click on that button, and your Mac will restart.

Normally, you will then be asked to log in twice, and at the upper right of the display the words Safe Boot will be displayed in red.

Once your Mac is running in Safe mode and you’ve logged in, you can check that it really is in Safe mode by opening System Information. Click on Software at the left, and the line Boot Mode should say Safe rather than Normal.

If you can’t start your Mac up successfully in Safe mode, Recovery is probably its best option.

How is it different?

According to Apple’s current description, Safe mode:

• “prevents your Mac from loading certain software when it starts up, including login items, system extensions not required by macOS, and fonts not installed by macOS”
• “it also does a basic check of your startup disk, similar to using First Aid in Disk Utility”
• “it deletes some system caches, including font caches and the kernel cache, which will be created again automatically as needed.”

Any checks it makes of your startup disk no longer include any snapshots, and it doesn’t check any other disks, such as that storing your Time Machine backups.

Blocking extensions and customisations

Booting in Safe mode blocks the loading of all third-party kernel extensions, and may delay the loading of some of those provided in macOS. Specifically, kernelmanagerd doesn’t load any of the kernel extensions in the Auxiliary Kernel Collection (AKC), and records that in the log. All kernel extensions in the main Kernel Collection appear to be loaded normally. If you suspect that your Mac’s problems could relate to a third-party kernel extension, this makes Safe mode an excellent diagnostic test.

Apple adds to that login items, system extensions (the modern replacement for kernel extensions), and fonts not installed by macOS. These are other common causes of compatibility problems, adding to the value of Safe mode.

Endpoint Security is one of several subsystems which notes that Safe mode is active in the log; that may reflect changed behaviour, although it’s unclear whether that brings a complete block of third-party Endpoint Security clients.

Autologin is also disabled in Safe mode.

Checking the startup disk

Normally use of First Aid in Disk Utility calls the command tool fsck_apfs to perform checks and make any repairs deemed necessary. I have searched logs for entries recording the use of fsck or fsck_apfs during startup in Safe mode, and have been unable to find any. What does appear clear now is that any use of fsck_apfs excludes checks of snapshots, and is confined to the Data volume.

If these checks do take place, because of the encryption of the Data volume, they can’t occur until after the user has logged in the first time, and could account for the requirement to log in twice. The fact that there’s no trace of them in the Unified or other accessible logs is also problematic. In Mojave, Apple stated that “if the directory is repaired, your Mac automatically restarts”, and it’s feasible that errors detected by fsck_apfs result in a similar response in Ventura.

Previously, these reservations about checking the startup disk have led me to recommend that users who want to do that would be better off starting up in Recovery and using Disk Utility there. I see no reason to change that recommendation now.

Deleting caches

Discovering exactly which caches are emptied or deleted isn’t an easy task. Beyond Apple’s two instances of font caches and the kernel cache, I can say that none of the caches used by Launch Services appear to be affected by this. I feel sure that engineers in Apple know only too well exactly which caches are deleted or emptied, and can’t understand why Apple isn’t prepared to pass on that information to users.

Leaving Safe mode

Whatever your Mac, to leave Safe mode and return to normal mode, simply restart it.

Safe mode in Apple silicon Virtual Machines

Safe mode is available when running lightweight virtualisation of macOS on an Apple silicon Mac, provided that the host operating system is Ventura. That provides an option to start the VM in Recovery mode. Enable that option before starting the VM, then use the normal procedure to restart in Safe mode. When you shut down that VM, remember to disable starting in Recovery before running the next VM.

Good reasons for starting up in Safe mode

• To identify and locate problems with third-party kernel extensions.
• To identify and locate problems with system extensions, fonts, login items, and other user customisations.
• To download and install macOS updates, when they don’t work in normal mode.
• To clear font and other user caches.
• When there are problems preventing booting in normal mode, short of going to Recovery mode.
• As a generic non-destructive panacea.