I'm testing the following command-line in the Terminal:

sudo security dump-keychain -d login.keychain

which I'd like to use to save all my passwords into a file.

However when I run it, it keep asking me for each item if I want to allow the access, despite I'm selecting 'Always Allow'.

Is there any workaround?


4 Answers 4


There is Keychaindump tool written by Juuso Salonen which is a proof-of-concept tool for reading OS X keychain passwords as root.

Basic usage:

$ sudo ./keychaindump ~/Library/Keychains/login.keychain

Example output:

$ sudo ./keychaindump 
[*] Searching process 15 heap range 0x7fa809400000-0x7fa809500000
[*] Searching process 15 heap range 0x7fa809500000-0x7fa809600000
[*] Searching process 15 heap range 0x7fa809600000-0x7fa809700000
[*] Searching process 15 heap range 0x7fa80a900000-0x7fa80ac00000
[*] Found 17 master key candidates
[*] Trying to decrypt wrapping key in /Users/juusosalonen/Library/Keychains/login.keychain
[*] Trying master key candidate: b49ad51a672bd4be55a4eb4efdb90b242a5f262ba80a95df
[*] Trying master key candidate: 22b8aa80fa0700605f53994940fcfe9acc44eb1f4587f1ac
[*] Trying master key candidate: 1d7aa80fa0700f002005043210074b877579996d09b70000
[*] Trying master key candidate: 88edbaf22819a8eeb8e9b75120c0775de8a4d7da842d4a4a
[+] Found master key: 88edbaf22819a8eeb8e9b75120c0775de8a4d7da842d4a4a
[+] Found wrapping key: e9acc39947f1996df940fceb1f458ac74b877579f54409b7
[email protected]:login.facebook.com:xxxxxxx
[email protected]:smtp.google.com:xxxxxxx
[email protected]:imap.google.com:xxxxxxx
[email protected]:www.google.com:xxxxxxx

Other tools:

See also:

  • 1
    You deserve a 100 upvotes, and the creator deserves a 1000!
    – Sheharyar
    Oct 2, 2015 at 23:58
  • 2
    It's too bad this program does not work on Mojave.
    – oarfish
    Aug 31, 2019 at 12:08

This is simple job for AppleScript. First off make sure you're redirecting the standard output to a file by doing sudo security dump-keychain -d login.keychain > ~/Desktop/loginKeychain.txt. Before doing this command open up Script Editor, it should be in /Applications/Utilities/ then paste this:

tell application "System Events"
repeat while exists (processes where name is "SecurityAgent")
    tell process "SecurityAgent"
        click button "Allow" of window 1
    end tell
    delay 0.2
end repeat
end tell

Now start the dump command, then click the Play button at the top of the Script Editor. This should press the buttons.

The Allow Always gives the permission to access keychain item forever, but it's only applied on one item at a time. I would stick with clicked Allow so someone else cannot access it in future without your permission.

  • Thanks, it sounds like workaround, but it's something:) I've tested and it works, but I had to change the line to: click button "Allow" of group 1 of window 1, otherwise I had the error that the button was not found.
    – kenorb
    May 5, 2015 at 22:46
  • Actually didn't solve exactly, as the command-line relies on external script. I'm looking for something more universal. I think you should also link to the source where you found this script, probably from here.
    – kenorb
    May 6, 2015 at 15:36
  • @kenorb You can run this script from command line too using osascript command. I don't think it's possible to do GUI scripting in bash.
    – user14492
    May 6, 2015 at 16:51

You can unlock the keychain before on CLI level using unlock-keychain subcommand before like:

# unlock login.keychain
# WARNING: command-line will ask you to enter your password
security unlock-keychain login.keychain
# export the data from login.keychain
security dump-keychain -d login.keychain

An insecure alternative is to pass the password on command-line adding the argument -p ${PASSWORD}.


Python has the keyring library that:

provides an easy way to access the system keyring service from python

To get it to work on recent macOS versions, the library maintainer provides this information:

macOS keychain supports macOS 11 (Big Sur) and later requires Python 3.8.7 or later with the “universal2” binary. See #525 for details.

You can use the library in a python script:

>>> import keyring
>>> keyring.get_password("item_name", "username")

or as a command line tool:

$ keyring get item_name username

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .