How does macOS encrypt iOS backup when password is not in Keychain?

Question

I regularly backup my iPhone and iPad devices to my Mac and for many years have been doing an encrypted backup. Based on reading elsewhere like answer here and the comments I'm going to assume I did not select save backup password in Keychain originally way back when. I search in my Keychain and find no items matching "Backup" etc. How is it that I can plug in the iOS device and make new encrypted backups without entering a backup password?

The only entries I'm finding in keychain related to my iOS devices is one for each device name of type RPIdentity-SameAccountDevice. I don't know what these are for and my user password doesn't seem to unlock these keychain items.

Background: yep yep, I seem to have lost my iPad encrypted backup password. I didn't forget it, because I never knew it. I use a password manager. I have a iPhone backup password saved that works on my iPhone backup, but that password, nor anything else I can think of is working to unlock my iPad backup. :-/ I backed up this iPad without issue right before erasing it to do a little testing with a different account.

Answer 1

The backup password setting is stored on the iOS device itself, and iOS encrypts the files as it sends the to the Mac. The Mac just accepts and writes the files without a lot of work done on the Mac itself during the backup.

The encrypted backup setting and the password for it are also saved in the backup itself (iCloud or iTunes), so if you set up that iPad by restoring a backup of another iPad or iPhone, the encrypted backup setting would be set on the iPad. Glad you found the password!

For anyone seeing this in the future, older keychain entries are named "iPhone Backup" or "iPad Backup", but it changed in the past couple years to be named "iOS Backup" now. I have an article I wrote with a handful of tips to try for a forgotten backup password, in case it's helpful to someone in the future also.