What does your Mac do when it's sleeping? Your Mac's secret life as a sleepwalker

Modern computers are designed to go to sleep when you’re not using them. When you put your Mac to sleep, the display turns off and most of the computer’s activity ceases. This standby mode is designed to save power. However, your Mac is a light sleeper; a lot goes on when your Mac is not awake.

In this article, I will explain what happens when a Mac goes to sleep, what different types of sleep modes exist, and how you can find out precisely what is happening on your Mac when it isn’t awake. Then we’ll take a look at some security implications to keep in mind regarding sleeping Macs.

In this article:

• How to put your Mac to sleep
• The different types of sleep modes on Macs
• What happens while your Mac is asleep?
• What are the security implications of sleeping Macs?
• Your Mac does a lot when it’s asleep
• How can I learn more?

How to put your Mac to sleep

There are several ways you can put your Mac to sleep. The simplest is to click on Apple menu > Sleep. Your Mac’s display immediately shuts off, and, in the background, macOS performs a number of operations to suspend non-essential processes. You can also put a Mac to sleep by pressing Command-Option-⏏Media Eject Key (if your keyboard has one). If you have a Mac laptop, the simplest way to put it to sleep is to close the display.

If you have a desktop Mac or a MacBook without Touch ID, you can also put your Mac to sleep by pressing the power button. When you press the Power/Touch ID button on a laptop or on a Magic Keyboard with Touch ID, the Mac immediately takes you to the login screen; if you then press Esc, your screen will go dark. To use your Mac again, hold the correct finger on the Touch ID sensor and your Mac will wake up and immediately take you back to where you left off.

You can set your Mac’s display to turn off automatically when your Mac is inactive. You can find the settings relevant to your Mac model by going to Apple menu > System Settings… > Lock Screen. If you have a desktop Mac, choose a time next to “Turn display off when inactive.” If you have a MacBook, you can set different amounts of time for when it’s running off its battery (“Turn display off on battery when inactive”) and for when it’s plugged in (“Turn display off on power adapter when inactive”).

Note that if you’re using an older macOS version such as Monterey, these steps will be a bit different; you’ll instead find them under Apple menu > System Preferences… > Battery.

To wake your Mac from sleep, simply open the lid or press a key on the keyboard.

The different types of sleep modes on Macs

Because batteries can run out on laptops while they are asleep, macOS has a safe sleep feature. When you put a laptop to sleep, the Mac saves its state, including which apps are open, and saves documents in supported apps. This prevents you from losing data if your battery is depleted. The next time you start up the Mac, the saved state will be loaded.

The pmset command, which you can access in Terminal, allows you to see what sleep settings your Mac has, and lets you change them if you wish. Run pmset -g, and you’ll see something like this (from my M2 MacBook Air):

You can find out more about these settings (and how to modify them, if you wish) by typing man pmset in Terminal, and the main setting to look at for choosing how your Mac sleeps is hibernatemode.

There are three different hibernation modes for a Mac when safe seep activates.

In hibernatemode 0, the default on desktop Macs, the computer saves what’s in its memory. The Mac wakes from the contents of its memory; the Mac loses data in memory if the power is cut. If you have a desktop Mac and you live in an area where you have frequent blackouts or brownouts, and you don’t have a UPS — an uninterruptible power supply, essentially an external battery backup — you may want to consider changing this setting.

With hibernatemode 3, the default on laptops, the Mac stores a copy of memory to its disk, and keeps memory powered during sleep. When awakened, the Mac reloads the memory, unless it has run out of power. In this case, the hibernate image is reloaded.

Finally, hibernatemode 25 can only be set using the pmset command in Terminal. The Mac saves what’s in its memory to disk, then powers down the memory. When awakened, the Mac reloads the hibernation image. Using this mode means that both sleeping and waking are slower, but it saves battery life.

In addition, if a laptop is asleep, and its battery is below 50%, the Mac goes into hibernation.

For most people, none of this is very important; generally you should use the defaults, unless you need to squeeze every bit of juice out of your laptop’s battery. These hibernation modes let you get back to work quickly when you wake up your Mac.

What happens when your Mac is asleep?

Your Mac can do a lot when it’s asleep. If you choose to allow it to wake for network access (System Settings > Battery > Options… on a laptop; System Settings > Energy Saver on a desktop Mac), your Mac may be very active while it’s “sleeping.” (If you have an Intel Mac, this setting is called PowerNap.)

As this dialog says, waking for network access can allow your Mac to receive incoming network traffic for apps that update via iCloud. In particular, Mail, Calendar, Notes, iMessage, and other apps can update when the Mac is asleep. Additionally, Find My will broadcast your Mac’s location while it’s sleeping. If your Mac is connected to a power adapter, it can download updates from the Mac App Store, and Time Machine backups will run. In addition, some third-party software, notably backup software, can wake a sleeping Mac in order to run.

Disabling this can save some power; if you need to make your battery last as long as possible, you can disable this setting to preserve battery life.

If you enable Wake for network access or PowerNap, your Mac can also share certain resources, such as a shared printer, or music from the Music app. A user can also connect to your Mac over a network and mount shared volumes; initiating a connection wakes the Mac, even if the display of a laptop is closed.

But your Mac does much more when it’s asleep. Here’s a screenshot from iStat Menus showing CPU activity for 24 hours. You can clearly see that there were brief spurts of CPU usage even while the MacBook Air was sleeping.

To get the details of the Mac’s activity, type pmset -g log in Terminal and press Return or Enter. You’ll see an extremely long list of entries, each of which indicates something that happened when your Mac was asleep.

There’s an easier way to see this information. Sleep Aid is an app that reads this log and presents the data visually.

I put my M2 MacBook Air to sleep from around 2pm on a Thursday and woke it up on a Monday morning; the above screenshot shows the sleep activity through Sunday at midnight. As you can see, a lot happened. Sleep Aid is designed to find when your Mac isn’t sleeping; when it is insomniac. If I click on different lines, I can see things like push notifications, power management, and network activity being activated.

Many of these events are brief, though some last as long as one minute. If the Mac was set to hibernatemode 25, then none of this would have occurred.

Naturally, all this activity uses power. My MacBook Air was fully charged, and, when I woke it up on Monday morning, after 94 hours of sleep, the battery was at 84%. Broken down to an hourly average, 0.17% of the battery’s full capacity was consumed per hour. While this doesn’t matter in normal usage, it’s important to know that, if you’re going to store a laptop for a while when it can’t be charged, such as when traveling, and you want the most power available the next time you use it, it’s best to shut it down.

What are the security implications of sleeping Macs?

You might be wondering, if you allow your Mac to be awakened for network access when sleeping, are there any security implications?

If someone discovered your Mac on a network, they could theoretically be able to exploit a vulnerability that gives them remote access, particularly if you aren’t using the very latest macOS version or if you have certain outdated software installed. Alternatively, if someone who’s targeting you has learned your password through other means, they may be able to remotely connect to your Mac if you have services running such as Screen Sharing, File Sharing, or Remote Login. (You can check whether or not these and other services are enabled by going to System Settings > General > Sharing if you have macOS Ventura or later. For older macOS versions, you’ll find them in System Preferences > Sharing.) If an attacker had previously installed malware on the Mac (or if a user had been tricked into installing it), that malware could potentially awaken the Mac from sleep, giving remote access to the malware distributor.

One thing to be aware of with a laptop or notebook computer is the “evil maid” attack, where someone accesses your Mac while it’s asleep, such as in a hotel room. Putting a Mac to sleep leaves data stored in system memory (RAM), some of which may contain sensitive information. Many vulnerabilities require physical access to a Mac, and leaving a Mac unattended — even if it’s protected with a strong password — could leave it at risk. There have been a number of physical attacks in the past, particularly of the “DMA” (direct memory access) variety, that could allow an attacker to retrieve data from RAM via a Thunderbolt or other external port on your Mac laptop.

If your adversary is a sophisticated threat actor with physical access, all bets are off.

If you’re mildly worried about evil maid attacks, DoNotDisturb is an app that can alert you if someone opened your MacBook’s lid while you were away. Note that, although there used to be a companion app that could alert you in real time on your iPhone, the companion app is no longer available in the App Store. DoNotDisturb will, however, inform you the next time you log into your MacBook if a casual, non-sophisticated attacker opened the lid—assuming someone didn’t somehow log all the way into your MacBook and dismiss the alert. However, if a highly skilled attacker gets physical access to your sleeping Mac, the attacker may be able to eliminate all evidence that they accessed your Mac or exfiltrated data from it.

If you’re highly concerned about an attacker getting physical access to your Mac while traveling, it’s best to keep it with you at all times and never let it out of your sight. Just beware of border crossings; some countries may require you to hand over your computer to authorities for a brief “inspection,” and they may take it out of your sight. If you’re traveling to or from a country that doesn’t have (or doesn’t honor) travelers’ rights against unreasonable search and seizure, you may want to consider using burner devices instead, and leaving your personal devices at home.

Your Mac does a lot when it’s asleep

To sum up, your Mac does a lot when it’s asleep. While M-series Macs don’t use a great deal of power, it’s important to know that if you leave a laptop asleep for several days, the battery will deplete; in my case, about 1% every six hours. If you finish working on Friday afternoon and leave your Mac laptop unplugged over the weekend, it will have used 8 to 10% of its battery. If you need the battery to be full on Monday morning, it’s best to leave the Mac plugged in, or just shut it down.

As for the security of a sleeping Mac, your level of concern should depend on how trusted of an environment you’re using it in: at home, at the office, or when you’re traveling. When in a less-trusted environment, it’s best to shut down your laptop when you’re not using it, especially when it may not remain in your possession, such as in a hotel room, or when preparing to go through security checkpoints; there’s always the chance of an “evil maid” attempting to access data on your Mac.

The above is the detailed content of What does your Mac do when it's sleeping? Your Mac's secret life as a sleepwalker. For more information, please follow other related articles on the PHP Chinese website!