Is it possible to use the Touch ID fingerprint reader to unlock my SSH key?

I have a MacBook Pro with Touch Bar, and I have a traditional text passphrase for my SSH key right now.

I have noticed that I don't get a system dialog asking for my passphrase on 10.12, so this probably isn't a thing, but if I could do it, it would be AMAZING.

  • OpenSSH 8.2 adds FIDO2 support. If there is a way to wire TouchID to a FIDO2 unlock, this should work. I have not tried doing so. Feb 19, 2020 at 13:48

5 Answers 5



One option is add your private SSH key to macOS Keychain, then use TouchID for Keychain authentication. You will want to use ssh-add -K ~/.ssh/[your-private-key] -- however on macOS 10.12 Sierra the feature needs to be enabled by editing editing ~/.ssh/config and adding:

Host * (asterisk for all hosts or add specific host)
   AddKeysToAgent yes
   UseKeychain yes
   IdentityFile <key> (e.g. ~/.ssh/userKey)

For details, read:

  1. Permanently add your private key to Keychain so it is automatically available to SSH
  2. Saving SSH keys in macOS Sierra keychain


At present TouchID unlocking of an SSH key is not available for macOS.

  1. The sudo-touchid Xcode project demonstrates how to build a command line application that is TouchID enabled and fails over to a passcode dialog. It runs on the 2016 MacBook Pro with Touch Bar. However, it is for sudo, not ssh. This indicates that the idea is technically feasible.
  2. The Prompt 2 SSH client has TouchID support -- for iOS, not macOS. This indicates that comparable applications might become available from commercial developers.
  3. One developer online started an ssh touchid wrapper project a few months ago -- although it is an empty project stub. This indicates that others may be asking a similar question to yours.
  • 9
    Can you elaborate on "then use Touch ID for Keychain authentication"? If I follow your steps I'm not asked to authenticate at all.
    – mniess
    Mar 20, 2018 at 11:07
  • Can you update the instructions to make it more clear whether the first part of the first sentence applies to 10.12+?
    – Jonathan
    Nov 1, 2022 at 14:48

There are multiple options that will generate and store your private key in the Secure Enclave. Access to the keys can be gated either via Touch ID and/or a tap on an Apple Watch.


This is somewhat tangential to my original question, but I have recently been using and very much like Krypton, which gives me something a lot like TouchID unlocking. This solution stores the SSH key on my phone's secure enclave, and my computer and phone negotiate via bluetooth when I go to use the key. I get a confirmation popup on the phone and respond after unlocking that.

So! I get to do something that works similarly, but is (I think) a bit more secure than storing the key on my laptop (even with a passphrase), pretty definitely better than leaving it decrypted in my Keychain, and very usable to boot.

It also works as a U2F second factor for web services, using a browser plugin.

  • 2
    Wither, Krypton. Thanks Akamai :/. Oct 27, 2021 at 6:04

On macOS you can use the 1Password SSH/Git agent to unlock your key with TouchID:

For more info: https://developer.1password.com/docs/ssh/agent/#:~:text=The%201Password%20SSH%20agent%20uses,even%20leaves%20the%201Password%20app.

  • Thanks for contributing! Some feedback: It's better to include the relevant portions here so readers don't have to go off-site for the answer and link back as a supporting resource. Also, it would be helpful to show how this directly addresses the question being asked; regarding TouchID.
    – Allan
    Jun 22, 2023 at 16:08
  • good lord is there a way I can mark my question as old, dumb, and answered so I stop getting notified about it
    – Nate
    Jun 22, 2023 at 18:29

You could easily write an wrapper to translate touchid calls into ssh and back again. Even further translate a ~ possible match into a range sequence (think close but incomplete painting) - no magic there. I used the camera for that before when touchid seemed like a tricorder feature from star trek :-)

Try making such App yourself, a good motivation to learn Swift! Apple has good doc's around all of their SDK's so after initial pain of Xcode you can do it in few days.

Seems like a good idea to use the feat. even when everybody will tell you of gazillions possible security risks that are, well, possible (like a lot of other things). You will need a dev account though (99$/year...), since self-signed apps cant access all macOS SDKs functionalities, touchID is (possibly) not accessible without signing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .