Safe mode is unique among the different boot modes in macOS as it’s closest to normal, most features remain available, and it can solve a wide range of problems, albeit temporarily for some. It also runs the normal kernel in normal mode, and its major differences appear once the user has logged in. This article explores how Safe mode in macOS Ventura 13.3.1 differs from normal mode, with particular respect to caches.

Apple’s description of the use of Safe mode is quite limited: “Starting up your Mac in safe mode can help you identify whether issues you’re experiencing are caused by software that loads as your Mac starts up.”

Elsewhere it provides more detail, explaining that Safe mode:

1. “prevents your Mac from loading certain software when it starts up, including login items, system extensions not required by macOS, and fonts not installed by macOS”
2. “does a basic check of your startup disk, similar to using First Aid in Disk Utility”
3. “deletes some system caches, including font caches and the kernel cache, which will be created again automatically as needed”
4. “some features may not work in safe mode, such as film playback in DVD Player, video capture, file sharing, Wi-Fi, some accessibility features, some audio devices and some devices that connect via USB, Thunderbolt or FireWire”
5. “accelerated graphics are disabled, which can cause flashing or distortion of your screen during startup.”

Third-party extensions

It’s not hard to demonstrate that Safe mode blocks the loading of most third-party login items, extensions, system extensions and fonts. One of Safe mode’s most valuable uses has been to eliminate those when trying to diagnose a problem. If something doesn’t work in normal mode, but does work in Safe mode, it’s a good bet that the problem is occurring because of a third-party component that is blocked in Safe mode.

However, this doesn’t necessarily mean that a problem that occurs in both modes isn’t the result of a third-party component, it merely makes that less likely. As Safe mode also blocks some components of macOS, a Safe mode test can’t be proof, but may be an important piece of evidence that can focus attempts to isolate the cause.

Startup disk check

Not long ago, Safe mode used to perform a full fsck on the boot volumes, including all snapshots. For those with many snapshots from Time Machine backups, this could delay startup by many minutes, so that thorough check was discontinued. As quick fsck checks are normally made as a matter of routine when mounting volumes, and the results of those and any more extensive checks aren’t made accessible to the user, their value is at best questionable.

If you do want to check and repair the Data volume and know the outcome, it’s still far better to use Disk Utility in Recovery mode.

System cache deletion

Although Apple doesn’t provide any more detailed insight into which system caches are purged or emptied, the two that it mentions are of importance. Clearing font caches has long been a good reason for Safe mode; although very hard to demonstrate in the log, it continues to appear effective and remains an important feature.

“The kernel cache” (in item 3 above) most probably refers to the prelinked kernelcaches used to accelerate the boot process in macOS up to and including Catalina. In Big Sur and later, they have been replaced by kernel collections, whose operation differs between Intel and Apple silicon Macs, and aren’t as simple. On Apple silicon Macs running in Full Security, there are no kernel extensions beyond those of macOS, and they are supplied in the Boot Kext Collection (BKC), based on the SSV. Safe mode couldn’t remove or rebuild the BKC, and it’s unclear what Apple is referring to here.

Safe mode is expected to block the loading of third-party kernel extensions, but they should be reloaded, if required, when the Mac is started up in normal mode. This is a valuable feature when trying to isolate a problem, but whether prelinked kernelcaches or kernel collections are rebuilt isn’t clear.

User cache refresh

One of the most florid differences when booting in Safe mode isn’t mentioned by Apple: its effect on user caches, particularly those managed by CacheDelete through the deleted service.

CacheDelete isn’t started until after user login, and (with the exception of its privileged helper deleted_helper) runs in user mode on services and locations owned by that user. The best way to appreciate how active CacheDelete is in Safe mode is to compare that with standard mode. In the latter, CacheDelete first works through its property lists to build its database of services whose purgeable data it manages. It then lists the latest information it has on those services and their caches. Once that’s completed, it checks each of those standard services for shared purgeable and nonpurgeable space, just once, then announces updated totals for purgeable space. The whole sequence is likely to take around 0.3 seconds to complete.

After login in Safe mode, CacheDelete completes a similar initialisation, then proceeds to perform multiple passes through all the services whose caches it manages, first to establish what is purgeable and what is not, then to refresh what it can. Many of those are performed in conjunction with iCloudNotificationAgent, and at different levels of urgency, from 1 to 3. At the end of a period of 20 seconds or more, CacheDelete returns with a set of updated values that may be worse than those it started with, but should be more accurate in the event that macOS needs to free up purgeable space to accommodate an important demand on free space.

In practice, the total purgeable space of any volume consists of several compartments, including

• user service caches managed by CacheDelete;
• local copies of files held in iCloud Drive, which can be evicted to iCloud;
• local copies of iCloud content, including media and App Store apps, which can also be evicted;
• Time Machine snapshots of that volume.

CacheDelete is concerned here only with the first of those, and iCloud items won’t be evicted, nor snapshots deleted, at this stage.

Here, Safe mode brings a refresh of service caches managed by CacheDelete resulting in a full updated set of measurements of purgeable and free space.

Summary

Safe mode:

• blocks third-party extensions, kernel extensions, system extension, login items and fonts, and is an ideal way of determining whether a problem might be the result of any of those.
• doesn’t provide access to any report of checks it might make on your startup disk. If you suspect problems with the disk or its volumes, use Disk Utility in Recovery mode instead.
• clears some system caches, including font caches.
• refreshes user service caches managed by CacheDelete, and updates purgeable and available space as a result.
• doesn’t of itself evict iCloud Drive files or iCloud content, which appear to be controlled separately, but does refresh iCloud caches.
• doesn’t of itself delete local Time Machine snapshots.
• may enable troubled features including downloading and installing macOS and security updates.
• can sometimes release substantial amounts of free disk space.