List every login and background item in one report — via Howard Oakley, The Eclectic Light Company

Commandlow riskNeeds adminmacOS 14 Sonoma and later

The Login Items screen often shows vague names that don't tell you which app installed what. An undocumented command dumps macOS's full list of login and background items, with the app and file behind each one, to a text file you can read.

Takes effect right away

The easy way

  1. Run the command and enter your password. It writes btmdump.txt to your Documents folder.
  2. Open the file and search for the name you saw in Login Items to find which app and file it comes from.

Command

Run in Terminal (Applications › Utilities). It uses sudo, so macOS asks for your password.

sudo sfltool dumpbtm > ~/Documents/btmdump.txt
This only reads information. Don't use sfltool resetbtm unless you really mean to: it removes all third-party login items and resets background items, and needs a restart.

Sources

Source reviewed
2026-11-02
Link checked
2026-11-02
Tested hands-on
Not by Oddbyte.Me

Oddbyte.Me hasn't tried this on every macOS version, so keep the undo handy.

sfltoollogin itemsbackground itemsbtmlaunch agentsmalware

More in Performance & Power

Check memory pressure, not 'free RAM' — via Apple Support

Tricklow risk

A Mac that shows almost no free memory is usually fine: macOS keeps recently used files cached in RAM so apps reopen faster. The number that matters is the Memory Pressure graph in Activity Monitor, which combines free memory, swap and cached files.