Why is port 5001 in use on my Mac?

Two unrelated common causes: if you have a Synology NAS on your network, its DSM admin interface uses 5001 for HTTPS access, and your Mac may just be seeing that network traffic. Separately, if you deliberately moved a Flask or Node dev server off port 5000 (because AirPlay Receiver was holding it), 5001 is the typical next choice.

Is it safe to kill whatever is on port 5001?

If it's your own dev server, yes. If lsof shows nothing local and you're just seeing Synology DSM traffic on your network, there's nothing on your Mac to kill: that's the NAS, not a process on your machine.

Is port 5001 a security risk?

No more than any admin interface. Synology's DSM login should be protected with a strong password and, ideally, not exposed directly to the internet. For a local dev server, no risk beyond the usual local-only exposure.

Port 5001: Synology NAS Admin, or Your Flask Fallback

Port 5001 comes up in two unrelated contexts, and telling them apart takes about five seconds with the right command.

What typically listens on port 5001

Synology NAS (DSM): Synology’s DiskStation Manager web admin interface uses port 5001 for HTTPS. If you have a Synology NAS, this is often what a network scan is actually picking up, not a process on your Mac at all.
Flask/Node dev servers: Since macOS’s AirPlay Receiver claims port 5000 by default (see the port 5000 guide), it’s common to explicitly run a dev server on 5001 instead to sidestep the conflict entirely.

Is it safe to kill?

If it’s a local dev server you started, yes, killing it is completely safe. If you’re seeing 5001 because of a Synology NAS on your network, there’s no local process to kill: lsof on your Mac won’t show anything, because the traffic belongs to a different device.

Is it suspicious?

No. Both common causes are benign and expected. The only real troubleshooting step is figuring out which one applies to you, which is exactly what checking your Mac’s own listening ports (rather than just seeing “5001” mentioned somewhere) will tell you.

How to check port 5001 on macOS

lsof -i :5001

If this returns nothing, whatever you saw referencing port 5001 is happening on another device on your network (like a Synology NAS), not your Mac. If it returns a process, that’s your local dev server.

Portie shows every port your Mac itself is actually listening on with the owning app attached, so you can immediately tell whether 5001 is your own server or just network noise from another device.