# Mac 10.13, 10.14 where are the hash passwords located?

I ran to view the contents of a shadow file for a user:

sudo plutil -p /var/db/dslocal/nodes/Default/users/<username>.plist


but when I get to Default it says permission denied, either as a user or root, any ideas?

10.14 protects these files with SIP, so even root cannot access the files without using the directory services command. If you need to get this information deactivate SIP. Remember to reactivate SIP after you are finished. If you attempt to access using the directory services call shown above then you do not need to deactivate SIP.

You need to deactivate the SIP, which protects these files. In terminal, you need to write this to disable it, and you should get this message:

csrutil disable

Successfully disabled System Integrity Protection. Please restart the machine for the changes to take effect.


restart your computer once the command is successful. Then, you type your code into terminal:

sudo plutil -p /var/db/dslocal/nodes/Default/users/<username>.plist


and extract the files accordingly.

Once you are finished, remember to re-enable the SIP.

csrutil enable


Using sudo plutil -p to access these plists still works in 10.13+, even with SIP enabled. You need to grant Terminal (or iTerm) Full Disk Access in System Preferences though.

Disabling SIP, or trying to read the files directly, is not the thing to do here if you want to read a user record. You should use dscl to read things from Directory Services.

dscl . read Users/<username>

You can choose different formats for the output as well like -plist.

• How does this show the hashed password value? – nohillside Jan 21 at 15:27