Use Safe Mode to Diagnose Login Issues

macOS Safe Mode provides a critical diagnostic environment for troubleshooting persistent system issues, particularly those manifesting during startup or…

macOS Safe Mode provides a critical diagnostic environment for troubleshooting persistent system issues, particularly those manifesting during startup or login. By limiting the loaded software and performing system checks, Safe Mode helps isolate whether a problem stems from core macOS components, third-party software, or system caches.

Understanding macOS Safe Mode

Safe Mode, officially known as "Safe Boot," initiates a minimal macOS environment. It achieves this by:

Running a directory check of the startup disk: This is equivalent to running First Aid in Disk Utility. If issues are found, they are automatically repaired where possible.
Loading only essential kernel extensions: Non-Apple kernel extensions (KEXTs) are prevented from loading. This is particularly useful for diagnosing issues caused by problematic device drivers or security software.
Preventing third-party startup items and login items from opening automatically: This stops applications, agents, and daemons configured to launch at user login or system startup.
Disabling most fonts not installed by macOS: Corrupt or incompatible fonts can sometimes cause application crashes or login issues.
Deleting font caches, kernel caches, and other system cache files: Stale or corrupted cache files can lead to a variety of stability problems.

If your Mac boots successfully and performs stably in Safe Mode, it strongly suggests that the issue is caused by a third-party application, an installed kernel extension, or a corrupted cache, rather than a fundamental problem with the core macOS installation or hardware.

Entering Safe Mode

The procedure for entering Safe Mode differs significantly between Intel-based Macs and Apple Silicon (M-series) Macs.

For Intel-based Macs

Start or restart your Mac.
Immediately press and hold the Shift key.
Release the Shift key when you see the login window. If FileVault is enabled, you might need to log in twice: once to unlock the disk, and again to log into your user account.

You'll see "Safe Boot" written in red in the menu bar of the login window, or in the top right corner of the screen after logging in, to confirm you are in Safe Mode.

For Apple Silicon (M-series) Macs

Shut down your Mac completely.
Press and hold the power button (Touch ID sensor) until you see "Loading startup options."
Select your startup disk (usually "Macintosh HD").
Press and hold the Shift key, then click "Continue in Safe Mode."
Release the Shift key.

Similar to Intel Macs, you'll see "Safe Boot" in the menu bar or after logging in to confirm. Performance in Safe Mode on Apple Silicon Macs may feel slightly slower than usual, as certain hardware acceleration features might be limited.

Diagnosing Login Issues in Safe Mode

If you can log in successfully and operate your Mac without the previous issues while in Safe Mode, you can begin to systematically identify the culprit.

Scenario 1: Login Loop or Crashing Before Login

If your Mac is stuck in a login loop, crashes during startup, or freezes before you can even get to the login screen in normal mode, but boots fine in Safe Mode, suspect either a problematic kernel extension or a system-level agent/daemon that starts very early in the boot process.

Kernel Extensions (KEXTs): While deprecated and replaced by System Extensions in modern macOS versions, older KEXTs can still exist and cause severe instability. In Safe Mode, KEXTs not provided by Apple are not loaded.
You can check for third-party KEXTs using the Terminal:
```
kextstat -kl | grep -v com.apple
```
This command lists loaded kernel extensions and filters out Apple-signed ones. If you see entries from third-party vendors (e.g., VPN clients, antivirus, old drivers), these are potential suspects. Removing or updating these usually requires vendor-specific uninstallers or manual deletion from /Library/Extensions/ or /System/Library/Extensions/ (proceed with extreme caution when modifying /System/Library/).
System Launch Agents/Daemons: These are configuration files (.plist files) that tell macOS to launch specific programs or scripts at system startup or at intervals. They reside in /Library/LaunchDaemons/ (for root-level processes) and /Library/LaunchAgents/ (for user-level processes that run immediately after login).
In Safe Mode, many of these are still prevented from loading. To troubleshoot, you might temporarily move these files out of their respective folders (e.g., to a temporary folder on your Desktop) one by one, then reboot into normal mode to see if the problem resolves. Remember to move them back if they aren't the cause.
```
# Example: List LaunchDaemons
ls -la /Library/LaunchDaemons/

# Example: Move a suspected plist file (DO NOT DELETE)
sudo mv /Library/LaunchDaemons/com.example.badservice.plist ~/Desktop/
```

Scenario 2: Issues After Successful Login (in Normal Mode)

If you can log in normally but then experience crashes, freezes, or other strange behavior only after logging into your user account (but not in Safe Mode), the problem is very likely caused by a Login Item or a User Launch Agent.

Login Items are applications or processes configured to start automatically when a user logs in. They are managed through System Settings (macOS Ventura and later) or System Preferences (earlier macOS versions).

Boot into Normal Mode.
Open System Settings (Ventura+) or System Preferences (Monterey-).
- macOS Ventura and later: Go to System Settings > General > Login Items.
- macOS Monterey and earlier: Go to System Preferences > Users & Groups, then select your user account and click the Login Items tab.
Disable Login Items:
- For each item listed, either click the "minus" (-) button to remove it (Ventura+), or uncheck the "Hide" box if available, then manually disable the application from its own preferences, or simply remove it from the list.
- A more systematic approach is to remove all login items, then add them back one by one, restarting your Mac into normal mode after each addition, until the problem reappears.
Check User Launch Agents: These are similar to system-level launch agents but specific to your user account and reside in ~/Library/LaunchAgents/ (the tilde ~ represents your user home directory).
Accessing the user Library folder requires a trick, as it's hidden by default:
1. Open Finder.
2. From the menu bar, click Go > Go to Folder...
3. Type ~/Library/LaunchAgents/ and press Enter.
As with system-level agents, temporarily move suspect .plist files out of this folder and reboot into normal mode to test.

Common Pitfalls and Troubleshooting

Misinterpreting "Safe Boot": Just because your Mac boots in Safe Mode doesn't mean it's "fixed." Safe Mode is a diagnostic environment. The underlying issue still exists; Safe Mode merely bypasses it.
FileVault and Dual Login: If FileVault is enabled, you will always have to log in twice when entering Safe Mode on Intel Macs: once to unlock the encrypted drive, and again to your user account. This is normal.
Slow Performance in Safe Mode: Don't be alarmed if your Mac feels sluggish in Safe Mode. Graphics performance is often degraded, and certain features (like Wi-Fi on some older models, or certain USB devices) might not work. This is part of the minimal environment.
Deleting vs. Moving Files: When troubleshooting .plist files for Launch Agents/Daemons, always move them to a temporary location (like your Desktop or a new folder) instead of deleting them outright. This allows you to easily restore them if they are not the cause of the problem.
Reverting Changes: Keep a record of any changes you make (e.g., disabling login items, moving .plist files). If a change doesn't resolve the issue, revert it before trying another solution to avoid compounding problems.
Checking Console Logs: After a crash or an issue, check the Console application (Applications/Utilities/Console.app) for crash reports or relevant log entries. Look for entries around the time of the problem, particularly in Crash Reports or Log Reports.
Software Updates: Sometimes, login issues are resolved by updating macOS or problematic third-party applications. Ensure your system and all installed software are up to date.