Why is port 631 always open on my Mac?

CUPS (Common Unix Printing System) is macOS's built-in print architecture, and cupsd listens on 631 by default so your Mac can discover and communicate with network printers using IPP. It's normal and expected on every Mac.

Is it safe to kill the process on port 631?

You can stop cupsd, but printing will stop working until it restarts (macOS usually relaunches it automatically when a print job comes in). There's rarely a reason to kill it manually.

Is port 631 a security risk?

On your local machine, no; it's how your Mac prints. The risk scenario is CUPS being reachable from outside your network, which by default it isn't; cupsd normally only listens on localhost and your local network interface, not the public internet.

Port 631: The macOS Printing Port (CUPS) Explained

Port 631 is one you’ll see open on essentially every Mac, and it’s not a mystery once you know what it is: it’s CUPS, the printing system Apple has used since OS X.

What typically listens on port 631

cupsd: The Common Unix Printing System daemon. It handles IPP (Internet Printing Protocol) requests, which is how modern network printers and your Mac talk to each other, including discovery, job submission, and status.
Print & Scan preferences: The Printers & Scanners pane in System Settings talks to cupsd over this port locally.
AirPrint: Apple’s AirPrint feature is built on top of the same IPP infrastructure.

Seeing 631 in a port scan of your own Mac is completely normal; it means printing works.

Is it safe to kill?

Stopping cupsd will break printing until it restarts, and macOS typically relaunches it as needed, so there’s little practical reason to kill it. If you genuinely never print from this Mac and want it gone, it can be disabled, but most people have no reason to touch it.

Is it suspicious?

No, on a normal Mac this is expected and harmless. It only becomes worth checking if you see port 631 accessible from outside your local network. cupsd is meant to serve local and same-network requests, not the public internet, so unexpected external exposure (for example, on a machine directly connected to the internet without a router/NAT in front of it) would be the actual red flag, not the port being open locally.

How to check port 631 on macOS

lsof -i :631

You should see cupsd as the owner. If you see anything else, that’s the actual anomaly worth investigating, not the port itself.

Portie makes this a one-glance check: it shows every listening port with the exact process behind it, so confirming that 631 is really cupsd (and not something impersonating it) doesn’t require opening Terminal.