What Is Keychain on Mac? How to Keep It Safe

Quick answer: Keychain is the encrypted store macOS uses for your saved passwords, Wi-Fi passwords, certificates and app tokens, and your login keychain unlocks with your Mac login password. That makes it a prime target for Mac infostealers, which often try to get in by tricking you into typing that password into a fake dialog, so a strong login password and a habit of refusing unexpected password prompts protect it most.

Every password you have saved in Safari, every Wi-Fi network you have joined, every certificate your apps rely on and every secure note lives in your Keychain. Here is how Keychain security works, how attackers try to get around it, and what you can do to keep it locked down.

What the macOS Keychain actually is

At its core, the Keychain is a specialized encrypted database. There are two kinds. The older file-based keychains, such as your login keychain, are encrypted with a key derived from a password. The newer data protection keychain, which iCloud Keychain and the Passwords app use, is a database Apple documents as encrypted with AES-256-GCM.

The Keychain is not a single file. Your file-based keychains are stored as .keychain-db files in ~/Library/Keychains/ for your login Keychain and /Library/Keychains/ for the system Keychain. You can see them yourself:

ls ~/Library/Keychains/

What makes this different from, say, a password manager's encrypted vault is that the Keychain is deeply integrated into macOS itself. It is not just an app storing passwords — it is a system-level service that nearly every application on your Mac interacts with, whether you realize it or not.

What is stored in your Keychain

The scope of what lives in your Keychain is broader than most people expect:

• Website and app passwords: Every password Safari auto-fills, plus any password an app stores through the macOS security framework.
• Wi-Fi passwords: Every network you have ever connected to. Your Keychain remembers them all so you reconnect automatically.
• Certificates and private keys: TLS certificates, code signing certificates, VPN certificates. These are the cryptographic identities your Mac uses to prove who it is.
• App tokens and API keys: OAuth tokens, session tokens, and API credentials that apps store for persistent authentication.
• Secure notes: Free-form text notes you create directly in Keychain Access, often used to store sensitive information like recovery codes or license keys.
• Internet passwords: FTP credentials, SMTP credentials, and other protocol-specific login information.

To put it bluntly, your Keychain is the single richest source of credentials on your entire machine. If an attacker gets a full dump of your Keychain, they do not just have your passwords. They have your digital identity.

How Keychain encryption works

The encryption model is actually quite elegant, and the hardware matters.

The login keychain

Your login Keychain is encrypted with a key derived from your macOS login password. When you log in, macOS derives the encryption key from your password and unlocks the Keychain automatically. This is why your login Keychain unlocks when you log in and locks when you log out or your Mac goes to sleep (if configured).

The derivation uses PBKDF2 with a high iteration count to make brute-force attacks computationally expensive. But — and this is the important part — the security of the entire system is bounded by the strength of your login password. A weak login password means a weak Keychain, however strong the encryption underneath.

With a Secure Enclave

Macs with Apple silicon, and Intel Macs with a T2 chip, add another layer: the Secure Enclave. The Secure Enclave is a dedicated security coprocessor with its own encrypted memory that handles key operations in hardware. It protects the keys of the data protection keychain, so copying the database files off your Mac is not enough to read them.

This is a meaningful security improvement. The older file-based login keychain still depends mainly on your login password, which is why that password matters so much.

How Keychain Access Control Lists work

This is the part most people do not know about, and it is genuinely clever.

Every item in your Keychain has an Access Control List (ACL) that specifies which applications are allowed to read it. When Safari saves a password, that password's ACL is set so only Safari can read it without prompting you. If a different application tries to access that password, macOS shows you a dialog asking for your permission.

You have seen this dialog before — the one that says something like "AppName wants to use your confidential information stored in your keychain." That is the ACL system at work.

The ACL can be configured at several levels:

• App-specific: Only the app that created the item can access it.
• App group: A set of apps from the same developer can share access.
• User confirmation: Any app can access it, but only after you click "Allow" and enter your password.
• Always allow: Any app can access it without prompting. This is the least secure option.

You can inspect and modify these ACLs in Keychain Access (Applications > Utilities > Keychain Access). Select any item, click "Access Control" at the bottom, and you will see exactly which applications have permission to read it.

Why infostealers target the Keychain first

If you were writing malware designed to steal the maximum amount of valuable data from a Mac, where would you look first? The Keychain is the obvious answer. One successful Keychain dump gives you:

• Every saved website password (banking, email, social media)
• Browser session tokens (can hijack active logged-in sessions)
• Wi-Fi passwords (useful for lateral movement in corporate environments)
• Application credentials (Slack tokens, GitHub tokens, AWS keys)
• Certificates (can be used for impersonation or code signing)

This is not theoretical. Mac infostealer families such as Atomic Stealer, Cthulhu Stealer, Poseidon and Banshee go after the Keychain along with browser data. We covered the full infostealer landscape here.

How infostealers bypass Keychain protections

The Keychain's encryption is strong. Attackers generally do not try to break the encryption directly. Instead, they use social engineering and macOS features against you.

Fake password dialogs

A common technique is shockingly simple. The malware uses AppleScript or a custom dialog to display a password prompt that looks identical to a legitimate macOS system dialog. It says something like "macOS wants to make changes" or "Your Keychain is locked. Enter your password to unlock." You type your password, and now the malware has it.

With your login password, the malware can programmatically unlock your login Keychain and dump it. A convincing fake dialog takes only a few lines of AppleScript.

This is why the advice to never enter your password into unexpected dialogs is not just a platitude. It is the best defense against this attack.

Chainbreaker and offline extraction

For targeted attacks, there is a well-known open-source tool called Chainbreaker that can decrypt Keychain database files offline, given the correct password or decryption key. If an attacker exfiltrates your .keychain-db file and knows (or can brute-force) your login password, they can extract every credential at their leisure on their own machine.

Cthulhu Stealer used a variant of this technique — it would grab the Keychain database file and exfiltrate it along with the user's password obtained through a fake dialog.

TCC bypass techniques

macOS's Transparency, Consent, and Control (TCC) framework protects sensitive files, such as browser data and Mail, that infostealers collect alongside the Keychain. But researchers have found multiple TCC bypass vulnerabilities over the years. Apple patches them, new ones get found. It is a constant arms race.

Login Keychain vs iCloud Keychain vs custom keychains

Your Mac actually has multiple Keychains, and understanding the differences matters.

Login Keychain is the default. It is stored locally on your Mac, encrypted with your login password, and unlocks automatically when you log in. Most app passwords and certificates live here.

iCloud Keychain syncs credentials across all your Apple devices. It is end-to-end encrypted by default, with keys that Apple cannot access, whether or not you turn on Advanced Data Protection. iCloud Keychain items are protected by your device passcode plus a device-specific key. This is generally more secure than the login Keychain for password storage because the encryption is not solely dependent on your login password.

System Keychain stores system-wide credentials like certificates used by system services. Modifying it requires administrator privileges.

Custom Keychains are additional Keychains you can create for specific purposes. Some organizations use them to separate work credentials from personal ones. You can create them in Keychain Access via File > New Keychain.

For most people, the practical takeaway is: if you use iCloud Keychain (or the Passwords app in Sequoia and later), your credentials get the benefit of both local Keychain encryption and iCloud's end-to-end encryption. That is a meaningful security upgrade over relying solely on the login Keychain.

How to protect your Keychain

Here is what actually matters, ranked by impact.

1. Use a strong login password

This is not optional advice. Your login password is the master key to your entire login Keychain. If it is "password123" or your dog's name, your Keychain encryption is effectively meaningless.

Use at least 12 characters. Mix uppercase, lowercase, numbers, and symbols. Better yet, use a passphrase — four or five random words strung together. Something like "correct horse battery staple" is both stronger and easier to remember than "P@ssw0rd!".

On Apple Silicon, your login password also gates access to the Secure Enclave's key protection. A strong password here has outsized security value.

2. Do not enter your password into unexpected dialogs

This is the most important behavioral defense against Keychain theft. If a dialog pops up asking for your password and you did not initiate an action that should require it, stop and think.

Legitimate macOS password prompts only appear when you are actively doing something that requires elevated privileges — installing software, changing system settings, unlocking Security preferences. If a dialog appears out of nowhere while you are browsing the web or opening a file, treat it as suspicious.

The telltale signs of a fake dialog: it appears in the context of a non-system app, the visual styling is slightly off (wrong font weight, wrong button style, wrong icon), or it asks for your password in a context where macOS would not normally ask.

3. Lock your Keychain when not in use

By default, your login Keychain stays unlocked as long as you are logged in. You can change this. Open Keychain Access, right-click your login Keychain, and select "Change Settings for Keychain." You can set it to lock after a period of inactivity or when your Mac goes to sleep.

This adds friction — you will need to enter your password more often — but it significantly reduces the window during which malware can silently access your Keychain.

4. Review Keychain Access for unexpected entries

Open Keychain Access (Applications > Utilities > Keychain Access) and browse through your items. Look for entries you do not recognize. Pay special attention to the "Access Control" tab on each item — if you see applications listed that should not have access to a credential, remove them.

Also check for Keychain items with "Allow all applications to access this item" selected. These items have no ACL protection at all. Change them to require confirmation or restrict to specific apps.

5. Use the Passwords app for credential management

Starting with macOS Sequoia, Apple introduced a dedicated Passwords app that provides a cleaner interface for managing your credentials. It uses iCloud Keychain under the hood, which means your passwords benefit from end-to-end encryption and sync across your Apple devices.

The Passwords app also makes it easier to identify weak, reused, or compromised passwords. It flags credentials that have appeared in known data breaches and prompts you to change them. This is part of a broader set of security settings worth reviewing.

6. Monitor for unauthorized Keychain access

This is where manual vigilance falls short. You cannot realistically monitor your Keychain 24/7 for unauthorized access attempts. Malware that targets the Keychain operates quickly — extract, exfiltrate, done. By the time you notice something, the damage is already done.

This is one of the problems I built CoreLock to help with. Its free scan checks running apps, startup items (login and background items) and your Downloads folder, among six checks. It doesn't watch the Keychain itself, and it cannot guarantee it will catch Keychain theft.

If you want to check the basics manually, you can look for recent Keychain access events in Console.app by filtering for "SecKeychain" or "securityd." But honestly, unless you know exactly what you are looking for, the output is overwhelming. A full protection strategy covers more than just the Keychain.

The bottom line

Your Mac's Keychain is a well-designed system with strong encryption. Apple has put serious engineering effort into making it secure, especially on Apple Silicon where the Secure Enclave adds hardware-backed protection that is genuinely difficult to defeat.

But the Keychain's greatest strength — that it stores everything in one place — is also its greatest vulnerability. Attackers do not need to break the encryption. They just need your password. And a common way they get it is by asking you for it through a convincing fake dialog.

Strong login password. Skepticism toward unexpected password prompts. Regular review of what has access to your credentials. Those three habits, consistently applied, close off the attacks described above.

Want a quick check for common warning signs? Download CoreLock and run a free scan. It checks running apps, startup items (login and background items) and your Downloads folder, which it compares against a built-in malware-hash list and 19 YARA rules. It does not watch Keychain access itself.