TL;DR: /var/folders
contains folders for per-user caches and temporary files. You can access your own folders, but not those of other users. Deleting files that are not currently in-use should be safe, but deleting files that are in-use will probably cause problems. If you want to purge them, you should reboot afterward, to minimize the likelihood of problems.
If you do nothing, system processes will periodically clean these folders of files that have not been accessed for three days, so you don't have to do anything, unless you are running very low on storage.
The details
/var/folders
mostly contains temporary files and cache files, stored on a per-user basis. If you look at the root of /var/folders
, you won't see much:
$ ls -l /var/folders
total 0
drwxr-xr-x 3 root wheel 102 Mar 2 2014 43/
drwxr-xr-x 3 root wheel 102 Mar 2 2014 4c/
drwxr-xr-x 3 root wheel 102 Mar 2 2014 c3/
...
But if you look one level lower, you will see that these contain per-user folders. Typically, each top-level (two character) folder contains one user folder, but the "zz" folder contains many system-users. For example (user-names changed for privacy purposes):
$ ls -l /var/folders/*
/var/folders/43:
total 0
drwxr-xr-x 6 user1 staff 204 Oct 3 2016 3lsw0k6d7vqbywvsf226nkqc0000gs/
/var/folders/4c:
total 0
drwxr-xr-x 6 user2 staff 204 Jul 15 2016 yc9pgt3j5y18vr29jcgbbyb4000101/
/var/folders/c3:
total 0
drwxr-xr-x 6 user3 staff 204 Aug 16 2016 wv6q5xlx1flgtwcs0rjlkbd4000102/
/var/folders/rp:
total 0
drwxr-xr-x 4 admin staff 136 Jul 3 2016 qjg8tsk964scvw2510_n6yz00000gt/
/var/folders/yx:
total 0
drwxr-xr-x 4 macports macports 136 Jul 3 2016 m3d21nm91wnd4c0k2yjk57200000gn/
/var/folders/zz:
total 0
drwxr-xr-x 6 root wheel 204 Jul 3 2016 zyxvpxvq6csfxvn_n0000000000000/
drwxr-xr-x 3 _networkd _networkd 102 Jul 3 2016 zyxvpxvq6csfxvn_n000003000000r/
drwxr-xr-x 3 _lp _lp 102 Jul 3 2016 zyxvpxvq6csfxvn_n000003800000t/
...
Within each one of these, you will find a few magic folders:
$ ls -l /var/folders/4c/yc9pgt3j5y18vr29jcgbbyb4000101/
total 0
drwxr-xr-x 6 user2 staff 204 Sep 1 10:31 0/
drwx------ 53 user2 staff 1802 Jul 28 18:44 C/
drwxr-xr-x 2 user2 staff 68 Jul 3 2016 Cleanup At Startup/
drwx------ 83 user2 staff 2822 Sep 1 10:53 T/
The "C
" folder is that user's caches - containing what (prior to MacOS X 10.5) would have gone in /Library/Caches
. The "T
" folder is that user's temporary files - taking the place of /tmp
or maybe /var/tmp
.
I'm not sure about the other two folders. Cleanup At Startup
is empty. I suspect its purpose is to store files that are needed up to the moment of a reboot, but should be purged afterward (e.g. temporary files used by system updaters), and will therefore be erased after a reboot (or maybe even a logout/login).
The "0
" folder contains a few desktop-related databases and is probably intended to act as a cache for these services:
$ ls -l /var/folders/4c/yc9pgt3j5y18vr29jcgbbyb4000101/0
total 14104
-rw------- 1 user2 staff 7221248 Sep 1 10:31 com.apple.LaunchServices-1341025.csstore
drwx------ 3 user2 staff 102 Jul 3 2016 com.apple.dock.launchpad/
drwx------ 3 user2 staff 102 Jul 3 2016 com.apple.notificationcenter/
drwx------ 3 user2 staff 102 Sep 1 10:05 com.apple.pluginkit/
So, to summarize, every user and virtual user has his own directory under /var/folders
. You will have access to your own, but not to other users (unless you use sudo
to access them as root). They mostly contain caches and temporary files. As such, deleting the contents may or may not be safe, depending on whether the files are in use or not.
Deleting files where the corresponding process is still running may cause that process to misbehave or crash. Deleting files where the corresponding process is not running should be safe, but may lead to performance problems when the process re-launches (since it will likely re-generate its caches and temporary files.)
It appears that a background process runs every night at 3:35am to clean up these folders. I don't know the specific nature of the cleanup (it doesn't appear to be well documented) but what I have read seems to indicate that it will delete any file that has not been accessed for three days.