Sweepfor Mac
Free Download

Mac maintenance

How macOS's 'Dirty' System Cache Works (and How to Clear It)

Understand the system caches that pile up on macOS — Quick Look, font, kernel, dyld — and how to clear the ones that actually cause problems.

9 min read

A clean install of Sequoia takes about 35 GB. Two years in, that same Mac somehow has 80+ GB of “System Data” in the Storage pane and nobody can tell you what’s in it. Apple’s vague “System Data” category is a black box that includes a bunch of caches — and a few of them genuinely go wrong, in ways that show up as broken icons, missing fonts, or apps that just refuse to launch.

Here’s how the system-level cache layer actually works on macOS, which caches matter, and which ones are safe to clear when something’s gone sideways.

Where system caches live

Three big locations:

  • /System/Library/Caches/ — read-only on modern macOS thanks to the sealed system volume. You can’t touch this and don’t need to.
  • /Library/Caches/ — system-wide caches written by daemons and helper processes. Owned by root or _softwareupdate. Some are safe to delete; some aren’t.
  • /private/var/folders/... — the per-user temporary cache directory. Sandboxed apps drop a lot here. Path includes a random component for security.

Plus the user-level caches we cover elsewhere:

  • ~/Library/Caches/
  • ~/Library/Containers/<bundle>/Data/Library/Caches/ (sandboxed apps)

The system-level ones are what we’re focused on here.

The caches that actually matter

A short list of caches you might end up clearing intentionally:

  1. Icon services cache — what Finder uses to draw icons.
  2. Quick Look cache — thumbnails for spacebar previews.
  3. Font cache — system font registration data.
  4. dyld shared cache — the prelinked dynamic linker cache. Almost never user-touchable, but worth knowing about.
  5. Kernel extension cache — KextCache / boot caches.
  6. Spotlight index — technically a cache.
  7. Software Update cache — downloaded .pkg files.

Each behaves differently. Some you can rm without consequence; some need a specific command; some should not be touched.

Icon services cache

Symptom: every other icon in Finder is the generic “white document with corner fold.” Drag-and-drop preview is broken. App icons show up as the generic gear.

Fix:

sudo rm -rf /Library/Caches/com.apple.iconservices.store
sudo find /private/var/folders/ -name com.apple.dock.iconcache -exec rm -f {} \;
sudo find /private/var/folders/ -name com.apple.iconservices -exec rm -rf {} \;
killall Dock
killall Finder

That clears the system icon database, the per-user dock icon cache, and the per-user icon services cache. macOS rebuilds them in the background. Reboot if you want to be thorough — some processes hold the cache open and the rebuild only kicks in after a fresh login.

Tip: If only specific apps have broken icons, the issue might be that app's bundle, not the system cache. Try right-click → Get Info on the affected app — if the Get Info icon is also wrong, it's the bundle.

Quick Look cache

Symptom: spacebar preview shows the wrong thumbnail, or no thumbnail at all.

Fix:

qlmanage -r cache

That command tells qlmanage (the Quick Look daemon helper) to wipe its thumbnail cache. No sudo needed. Quick Look will regenerate thumbnails on demand.

If that didn’t help, also reset the Quick Look generators (the plugins that know how to preview each file type):

qlmanage -r

This re-registers every Quick Look plugin macOS knows about. Useful if you’ve installed and removed an app that had its own QL plugin.

Font cache

Symptom: tofu boxes (square placeholders) where text should be. Apps showing wrong font weights. Font Book showing duplicates that aren’t really duplicates.

Fix:

sudo atsutil databases -remove
atsutil server -shutdown
atsutil server -ping

atsutil is the Apple Type Server utility. The first command nukes the cached font registration databases. The second/third stop and restart the font server so it rebuilds them.

After this, log out and back in. If a specific app still shows wrong fonts, that app might have its own font cache (Microsoft Word does, Adobe products do).

Power users use Sweep tooEven when you know the Terminal commands, Sweep is faster and harder to mess up. Get Sweep free →

dyld shared cache

The dyld shared cache is the prelinked map of all system frameworks and libraries. It lives at /System/Library/dyld/dyld_shared_cache_<arch> and is many GB. It’s part of the sealed system volume on modern macOS and you cannot manually rebuild it without breaking SIP.

If you ever see “dyld: Library not loaded” errors at boot or app launch, that’s a real problem — but it’s not one you fix by clearing the cache. macOS rebuilds the cache during OS updates. If yours is corrupt, the fix is reinstalling macOS over your current install.

Don’t try to delete /System/Library/dyld/. SIP will block you, and even if it didn’t, you’d brick the OS.

Kernel extension cache

Modern Macs use system extensions instead of kernel extensions for most things, but a few legacy kexts still load. The kext cache is rebuilt automatically when you install or remove one. If it fails — usually after a beta upgrade or a broken third-party kext — boot might hang at the Apple logo.

To force a rebuild:

sudo kmutil install --update-all
sudo kmutil rebuild-cache

kmutil replaced the older kextcache command on macOS Big Sur and later. The first form updates and rebuilds in one shot. After running, reboot.

If even that doesn’t help, you can boot into recovery mode (hold the power button on Apple Silicon) and run kmutil from the recovery Terminal.

Software Update download cache

When macOS downloads an update and you don’t install it (or the install fails), the .pkg files can sit around taking 5–15 GB.

sudo softwareupdate --clear-catalog

That clears the cached catalog. The packages themselves live in /Library/Updates/:

sudo rm -rf /Library/Updates/*

That removes any partial update downloads. macOS will re-fetch them next time you ask for an update.

Spotlight index

Technically a cache, since it’s regenerable from your file system. To clear and rebuild:

sudo mdutil -E /

That erases the index and triggers a rebuild. Expect 30 minutes to several hours of fan noise depending on how much data macOS has to crawl through.

For a specific volume:

sudo mdutil -E /Volumes/External

To check current indexing status:

mdutil -s /

-s shows whether indexing is on, off, or in progress.

Mail caches

If Mail is showing duplicate messages, won’t sync, or is mysteriously slow:

qlmanage -r cache
defaults delete com.apple.mail
rm -rf ~/Library/Mail/V11/MailData/Envelope\ Index*

(V11 is current at the time of writing — check ~/Library/Mail/ for the latest version.)

This deletes Mail’s local message index. On next launch, Mail will rebuild it from the IMAP server, which can take an hour for a large mailbox. Don’t do this unless Mail is actively misbehaving.

Container caches (sandboxed apps)

Modern macOS apps live in containers under ~/Library/Containers/<bundle id>/Data/. Each container has its own Library/Caches/ inside. To find the largest:

du -sh ~/Library/Containers/*/Data/Library/Caches 2>/dev/null | sort -h | tail -10

The biggest is usually Safari, Mail, or Messages. To clear a specific one:

rm -rf ~/Library/Containers/com.apple.Safari/Data/Library/Caches/*

Safari can also be told to flush its cache from the menu (Develop → Empty Caches), which is safer if you’re not sure what you’re deleting.

Skip the Terminal stackSweep does the same cleanup with a UI and a preview before anything is removed. Download Sweep free →

What NOT to clear

A few caches that look tempting but you should leave alone:

  • /private/var/folders/* — your in-flight system caches and per-user temp data. Some of it is needed by the current login session. Deleting it can cause logged-in apps to crash or lose state.
  • /Library/Caches/com.apple.kext.caches/ — kernel extension cache. Use kmutil to rebuild instead.
  • /System/Library/Caches/ — read-only and SIP-protected. Not even possible to delete.
  • /Library/Caches/com.apple.bom.plist — package receipt database. The system uses it to track installed .pkgs.

If a third-party guide tells you to sudo rm -rf /Library/Caches/*, ignore it. Some of those caches are needed by specific daemons that won’t gracefully recreate them.

Diagnosing what’s eating “System Data”

The Storage pane’s “System Data” category is everything macOS can’t categorize cleanly. To break it down:

sudo du -sh /Library/* 2>/dev/null | sort -h | tail
sudo du -sh /private/var/folders 2>/dev/null
sudo du -sh /Library/Caches 2>/dev/null
sudo du -sh /private/var/log 2>/dev/null

Common culprits:

  • /private/var/log/ — system logs, especially DiagnosticReports. Can balloon if you’ve had a crashing app.
  • /Library/Updates/ — the unfinished software update we mentioned.
  • /Library/Caches/com.apple.iconservices.store — usually stays small but can corrupt.
  • /Library/Application Support/MobileSync/Backup — iPhone backups synced over USB. These are huge.
  • /Library/Developer/CoreSimulator/Devices/ — iOS simulators if you’ve ever opened Xcode.

The single biggest swing is usually iPhone backups (in /Library/Application Support/MobileSync/Backup). A single iPhone backup can be 50–100 GB. Delete old ones from Finder’s “Manage Backups” view in the device’s sidebar.

A reasonable system-cache reset

If you’re troubleshooting something specific (broken icons, font issues, Quick Look problems), this is the safe sequence:

# Icons
sudo rm -rf /Library/Caches/com.apple.iconservices.store

# Quick Look
qlmanage -r cache
qlmanage -r

# Fonts
sudo atsutil databases -remove

# Restart the relevant UI processes
killall Dock
killall Finder
killall SystemUIServer

That covers the three caches that genuinely cause user-visible bugs when corrupt. Don’t touch anything else unless you have a specific reason.

When the GUI is faster

For routine cleanup of things like cached app data, login items, leftover preferences from uninstalled apps, and orphaned files in containers, a Terminal walkthrough is too tedious. The cleanup tool earns its keep on the long tail — the dozens of small caches and leftovers nobody bothers to script.

There’s a GUI for thatSweep wraps the Terminal cleanup in a UI you don’t have to memorize. Try Sweep free →

A reboot is half the fix

Many cache issues clear themselves on reboot. macOS rebuilds the icon cache, the Spotlight index, and several others on a fresh boot. So before you start typing sudo rm against a system path, restart. If the bug persists, then it’s actually a stuck cache and the targeted commands above are the next step.

The mental model that helps: a cache is data that exists for performance. Deleting one always works (the system will regenerate it) but can be slow and noisy in the short term. Treat clearing system caches like a scalpel — surgical, infrequent, when you have a specific reason.

← Back to all guides