I like to be able to use Touch ID for quickly unlocking my Macbook, e.g. for when I've walked away from the machine for a few minutes but it's still in a safe place.

But I'd also like to be able to lock it properly, with a password, for when I'm taking it out of the office or otherwise want to enforce more security.

By default you need to enter your password after a system restart, or if you get 5 failed fingerprints in a row, or after no login for 48 hours.

Is there a command-line command, or a programmatic way to replicate this state, so I could script it using one of the various automation tools out there?

  • try just typing the password to login. Even if you don't see the text input field it should work. If it does, I'll format this as a proper answer. i.e. open the MacBook and just type the password to unlock. – bjbk Feb 22 '17 at 15:21
  • 1
    @bjbk OP is asking about forcing password entry, preventing the use of Touch ID. – grg Feb 22 '17 at 15:25
  • I see now. So to 'toggle' the TouchID settings on/off with a shortcut then? – bjbk Feb 22 '17 at 15:28
  • yeah, sorry if I wasn't clear - basically toggle off TouchID when I want to leave a secure area. – Korny Feb 22 '17 at 16:47
  • 1
    It's kind of clunky, but could you just use the wrong finger 5 times upon wake, then close it up to carry out of the office? – Bosque Bill Feb 28 '17 at 17:08

You're looking for the command line tool bioutil. Probably with the -u option.

bioutil {-r | -w [-f { 0 | 1 }] [-u { 0 | 1 }] [-a { 0 | 1 }]} | [-c] | [-p] | [-d <uid>] [-s] 

    -r, --read                      Read current Touch ID settings
    -w, --write                     Write new Touch ID settings
    -s, --system                    Flag to read/write systemwide Touch ID settings or perform systemwide operations
    -f, --function                  Enable (1) or disable (0) Touch ID functionality in general (system settings only)
    -u, --unlock $value             Enable (1) or disable (0) Touch ID for unlock
    -a, --applepay $value           Enable (1) or disable (0) Touch ID for ApplePay (user settings only)
    -c, --count                     Print number of enrolled fingerprints of the current user or of all users (-s, administrator only)
    -p, --purge                     Delete all enrolled fingerprints of the current user or of all users (-s, administrator only)
    -d, --delete $uid               Delete all enrolled fingerprints of the given user (administrator only)
|improve this answer|||||
  • 2
    Hmm - this works, but with a couple of issues: If I run bioutil -w -u 0 and then bioutil -w -u 1 it does what I want - it forces password entry once and then accepts fingerprints again. However, it also always prompts for the user password. Even if run as root/sudo. So hard to script. If I run bioutil -w -s -u 0 as root or admin, it works without a user password - but disabling unlock globally also forgets all enrolled fingerprints, so again not very useful. Thanks, though, this is the closest I've seen to what I want. – Korny May 8 '17 at 13:38
  • Is there a way to prefill the password programmatically when the command asks it during execution of "bioutil -w -u 0"? – Victor Bocharsky Feb 28 '19 at 17:55
  • You can try using 'expect' to send passwords but obviously this is frowned upon because you'll be hardcoding the pword – Hefewe1zen Mar 2 '19 at 1:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .