Whenever you fire up Dropbox (or it starts automatically at login), you will soon notice three Dropbox.exe processes running on your PC. Though unusual, that is completely normal behavior. It’s just how Dropbox works.
You can see the three processes running in the Windows Task Manager:
Or better yet, if you really want to understand what is going on, turn to Microsoft’s excellent Process Explorer. Its helpful tree panel will reveal the hierarchical relationship between the Dropbox processes — one parent and two children:
But why are 3 copies of Dropbox started? Isn’t one enough to synchronize all the files and folders that the software is managing?
And why is one using significant CPU and memory while the other two remain small and idle?
Fortunately the command line parameters for each instance of Dropbox reveal what is going on…
#1 is the “Main” Dropbox process
With the help of Process Explorer, we can see that the main/parent executable runs with a single parameter: /home:
That is consistent with the desktop shortcut to start Dropbox, which specifies the same parameter:
So that’s the one we started.
Digging in a little deeper, we saw this process consistently using a small bit of CPU (1-10%) and a fair chunk of memory (200+ MB).
Furthermore, we noticed that the CPU and memory would jump whenever we placed a new file in the Dropbox folder.
Our conclusion? This parent process is responsible for Dropbox’s primary activity: copying your files to and from the cloud.
#2 is the “Crashpad Handler”
The second process has a massive command line — over 3600 characters!
Most of the command line is meaningless without a technical understanding of the arguments, but the first parameter stands out: -type:crashpad-handler:
This “crashpad handler” consumes a mere 2 MB of RAM — infinitesimal, by today’s standards. What is its purpose?
Our research suggests that the process implements Crashpad — a crash reporting system developed by Google.
From the software’s stated objective:
Crashpad is a library for capturing, storing and transmitting postmortem crash reports from a client to an upstream collection server. Crashpad aims to make it possible for clients to capture process state at the time of crash with the best possible fidelity and coverage, with the minimum of fuss.
So it is very likely that when the main Dropbox process crashes or runs into trouble, the “crashpad handler” will jump in to collect information and beam it back to Dropbox headquarters for subsequent analysis.
#3 is the “Exit Monitor”
The third process has a command line just shy of 400 characters in length. Its “type” is exit-monitor:
As the type suggests, exit monitor’s job is to watch the main Dropbox process and restart it if it fails. Its purpose is to make sure that Dropbox is always running on your machine — even in the face of crashes and other failures.
To sum up
Having three Dropbox.exe processes is completely normal. Dropbox performs your file synchronization in one executable but the other two are there to support the robust operation of the software. It’s all good!