I'm a new to Mac and found that Keychain has gathered quite a lot of passwords so far. I'm concerned about the security of these data, and I would like what security settings would you recommend so that my keychain data is secure?

  • Could you expand on what keychain 'settings' you are referring to? – grg Aug 24 '14 at 12:18
  • the ones that you can see in the answer below – gen Aug 24 '14 at 13:09

Maximum security if you’re that worried. Otherwise, just enable Lock when sleeping.

I’m not that worried because to view the password in Keychain Items requires your account password.

Keychain Setting

| improve this answer | |
  • I have High Sierra ... where is this dialog ? – Liviu Nov 28 '17 at 19:16
  • 1
    Open Keychain Access.app and you can right-click on the items in the sidebar and choose "Change Settings for Keychain". – sayzlim Nov 29 '17 at 2:55

The security of your keychain depends upon two things.

  1. Who has access to your Mac both physically and to log in.
  2. How secure your password is.

The first is quite easy to control. Don't let anyone you don't trust have an admin account on your Mac or have access to the backups and room where the Mac sits. If someone never gets a hold of your keychain file(s) then they can't use them or try to crack into them. Even guest users (or non-admin users) could potentially find a loophole and escalate their privileges to root/admin and then get a copy of your files, but this is a rare unlikely situation for most people that don't work in tech security fields. Governmental agencies, etc... of course probably can readily snatch that file if they should be interested in you or your Mac.

The security of your password is what secures the keychain even if someone has possession of the file. If you use a unique password there (one that isn't used on other services such as email, Facebook, online banking, etc...) is far more secure than a common password. Also, a longer password is far, far harder for someone to crack using brute force computations or a rainbow table should one be identified for the keychain (I haven't heard of one since I believe OS X salts that password sufficiently - but it's certainly possible someone could figure out that or Apple could have made an error in the coding of that password handling.)

In short - to most people - the keychain is highly secure - far more so than most any other storage of passwords they might use. A large majority of people make keychain insecure with simple, short, well-used passwords. If you are quite concerned, you could also store unimportant items in the login keychain and make other keychains with separate passwords for the secure items. You could also look into a dedicated product such as 1Password that have devoted significant amounts of funding to work to secure passwords. I'm certain Apple has spent a lot of money on the keychain - but like any physical security, the more secure it is, the less convenient it also is. There is a trade off between maximum security and maximum utility so you'll want to educate yourself until you are comfortable that you understand things and then make a good choice for your needs.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .