Mac menu bar icons: how to tell what each one is

There is usually one. A small grey shape near the middle of the right hand group that has been there for months, that nobody remembers installing, and that does not obviously belong to anything. Clicking it opens a menu of options that make sense only if the app is already known. Ignoring it works fine until the day the menu bar runs out of room and something has to go.

Identifying it by looking at it is unreliable, and not because of poor memory. Mac menu bar icons are drawn from a deliberately small visual vocabulary, and a dozen unrelated apps end up using the same shapes. There are better methods, and they take about a minute.

Why the shape is a weak clue

macOS supplies apps with a large library of standard symbols, and most well behaved apps use them rather than drawing something custom. The result is consistency, which is good for the look of the bar and bad for identification. A cloud means sync, or backup, or a weather app, or a file service. A gear means settings, or an automation tool, or a system monitor. A shield means security software, or a firewall, or an ad blocker, or a VPN.

Colour does not help either. Menu bar icons are usually drawn as template images, which means macOS controls the colour and renders them to match the bar in light and dark appearance. Two icons that look identical in black may come from completely different places.

The one visual clue that does carry information is state. Many icons change appearance depending on what the app is doing: filled when active and outlined when idle, greyed out when disconnected, sometimes with a small badge. That says something about the app's condition, but it still does not say which app it is.

Position is no better as a clue. The order of icons at the right end is not assigned by macOS in any meaningful way. New items appear at the left edge of the group, to the left of everything already there, so the arrangement records roughly the order in which apps happened to launch rather than anything about what they do. Once icons have been dragged around by hand, even that pattern is gone. A shape that sits next to the battery is not related to power in any way.

So identification has to come from somewhere other than the picture.

Five checks, fastest first

Check	What it gives	When it fails
Click the icon	The app name, usually in an About or Settings entry	Icons that open a panel with no text
Control-click the icon	A different, often plainer menu	Apps that ignore Control-click
Command drag it	Confirms it is movable and stores state	Fixed system items will not move
Activity Monitor	The process name, and the parent app	Names that do not resemble the app
Login Items and Extensions	Every background app by name	Apps launched manually, not at login

Click it. The first or last line of most menus names the app, and an About entry names it for certain. If there is a Settings or Preferences entry, open it: that is also where a hide option would be if the app has one, which saves a second trip later.

Control-click it. A minority of apps show a different menu on Control-click, often a plainer one with Quit and About at the top. This is worth trying when a left click opens a panel of controls with no app name anywhere in it.

Command drag it. This does not name the app, but it answers a different useful question. Hold Command and move the icon along the bar. Items that keep their new position after a restart are storing state, which means they are likely to honour a hide preference too. Items that snap back store nothing, and dragging them out will never be permanent.

Open Activity Monitor. Sort by process name and look for candidates. Helper processes usually carry the parent app's name with a suffix, which is enough to identify the owner even when the visible name is unfamiliar.

Read the login items list. System Settings, then General, then Login Items and Extensions. This lists the apps set to open at login and, separately, the background components apps have installed. Almost every icon that appears without anything being launched is represented there by name. Reading that list top to bottom is often faster than working through icons one at a time, because it gives names instead of shapes.

The items with no app behind them

Some icons cannot be identified by any of the above, because there is no app to find.

The built-in modules are the largest group. Wi-Fi, Bluetooth, Sound, Battery, Focus, the clock, and the rest come from macOS itself, and the complete list of them is in System Settings under Control Center. Each one has its own visibility choice there. This list doubles as a test: an icon in the menu bar that has no counterpart in Control Center settings did not come from macOS.

Two items belong to macOS but are not in that list. Control Center and Spotlight sit at the far right, cannot be dragged, and have no setting. They are always present.

Then there are the indicators that appear only while something is happening. The mark shown while the microphone or camera is in use is the best known. Screen sharing and location services produce their own. These are not apps and not modules, they cannot be switched off, and that is intentional: they exist so that nothing can use a camera or a microphone without the menu bar saying so. An icon that only appears during video calls is almost always one of these, and the app to look for is the one making the call.

Finally, an icon can outlive the app it belonged to. A background helper installed alongside an app keeps running after the app is dragged to the Trash, and keeps drawing its icon. Nothing in the Applications folder will match it. The login items list will, listed under background items, and switching the entry off is what clears it.

Reading what an icon is telling you

Once the owner is known, the appearance becomes useful rather than confusing.

A greyed or dimmed icon usually means the app is running but the thing it manages is not: not connected, not signed in, not monitoring. This is the most common cause of a feature quietly not working while the app appears to be fine, and the menu bar was reporting it the whole time.

A filled or highlighted icon generally means active. A badge or a small overlay means attention is wanted, often a subscription, an update, or a failed operation.

An icon that disappears and returns on its own is usually reporting a transient state rather than misbehaving. The camera indicator is the clearest example, but sync agents and network tools do the same thing.

This is the argument against simply removing every unfamiliar icon. Some of them are the only channel through which an app reports that it has stopped doing its job.

Icons that are present but not drawn

There is one more reason an icon cannot be identified: it is not on screen at all.

On MacBook models with a notch, the menu bar is physically interrupted, and items that would fall behind the notch are not drawn. No warning appears and there is no overflow arrow. The apps are running and the icons exist, but the bar has nowhere to put them. Connecting an external display changes the usable width and changes which ones go missing, which is why the set of visible icons can differ between the desk and the train.

The left half of the bar makes this worse in a way that is easy to miss. Those menus belong to the frontmost app, so an app with many menus leaves less width for icons. Switching to an app with a long menu bar can push items out of sight that were visible a moment earlier.

When an icon is suspected but not visible, the login items list is the way to confirm it exists. It reports what is running regardless of what fits on screen.

A quick way to test whether width is the problem, rather than a missing app, is to switch to an app with very few menus, such as the Finder, and watch the right hand group. If an icon reappears, nothing was removed and nothing is broken. The bar simply had more room at that moment. Repeating the test with the Mac connected to an external display and then undocked shows how much the available width actually varies between the two situations, which is worth knowing before deciding that an app has stopped working.

Tidying up while everything is still identified

There is a good reason to act on the results straight away rather than filing them away. Identification is perishable. In a month there will be two new icons, the arrangement will have shifted, and the same guessing starts again.

The step that keeps the knowledge useful is putting the bar into an order that means something: the items checked daily nearest the right, next to the system indicators, and everything else grouped to the left of them. Hold Command and drag to move an item, and the order is remembered across restarts. It takes a few minutes once, and afterwards a new icon is obvious because it arrives outside the pattern rather than blending into it.

That also makes the next decision easier. An icon that has been placed deliberately and is still never clicked has answered the question of whether it needs to be visible.

After identifying them

Naming the icons is usually half the job. The other half is deciding, for each one, whether it should be visible, hidden, or gone.

Gone applies to apps that were installed once for one task and forgotten. Remove them from the login items list, or uninstall them properly, using the app's own uninstaller where one was supplied.

Visible applies to the handful checked daily.

Hidden covers the rest, and it is the largest group: apps that have to keep running but do not need to be looked at, such as backup tools, clipboard managers, VPN clients, and battery utilities. Most of them have no preference to hide their own icon, because the icon is the only way to reach them. A menu bar organiser handles that case by moving nominated icons behind a divider and bringing them back on demand, leaving the apps themselves untouched.

Two things are worth checking before picking one. Whether a hidden icon can be clicked and its menu opened without expanding the whole bar first, because otherwise every hidden item costs an extra action. And whether hidden items can be found by searching for the app name, since position stops being a way to find anything once icons are out of sight. The features page covers one approach and the comparison page sets the current options side by side.

What to change first

Read the login items list before touching anything in the menu bar, because it names in one pass what clicking icons reveals one at a time. Then switch off the system modules that are never used, remove the apps that were forgotten, and hide what is left rather than fighting it: Koffret can be tried for fourteen days without a card.