Your Mac has a low-level secret-managing system called Keychain, which is covered more fully in where Apple stores your passwords and passkeys. Keychain contains passwords for lots of different things that need to be both available on demand and secured against unauthorized access. This includes passwords to log in to apps and Wi-Fi networks, passkeys for websites at which you’ve enrolled to use them, credentials for local network servers, encryption certificates, and other important information your Mac needs to function securely.
If you sync Passwords with iCloud, Keychain also contains credentials for websites where you have accounts and may include your credit card details, separate from the stored Apple Pay payment card information on Macs with Touch ID or an Apple silicon Mac paired with a Magic Keyboard with Touch ID.
Because this information is valuable and potentially sensitive, a Mac encrypts the contents of your keychain. However, whenever your Keychain is unlocked, your credentials can be passed to apps, websites, and network services without any intervention on your part.
And how do you unlock your keychain? That’s the wild part: all you have to do is log in to your Mac’s user account. And—as covered in what launches on your Mac—another default setting is to log you in to your account automatically.
As noted earlier, if you have FileVault enabled, you can’t log in automatically. However, after you manually log in, you’re in the same boat as anyone else. See how to turn on FileVault.
In other words, unless you take steps to change the defaults, merely turning on your Mac might unlock your keychain!
Anyone else who might have physical access to your Mac could then log in to all your web accounts (like your bank, Amazon, or PayPal), file servers, and other resources where you’ve saved credentials (like Music or the App Store).
There are a few bright spots:
- No one can see the actual keychain entry’s secure text without knowing your macOS account login password.
- Within Safari, an unwanted party can’t get a list of all the sites at which you have passwords stored from Safari, Keychain, or the Passwords app without your password.
- Even when a password is autofilled in Safari or in an app, there’s typically no way to copy the password to view it as text.
- Macs with active Touch ID hardware and password autofill enabled will drop in your password only when you use a valid fingerprint or enter your password (System Settings > Touch ID & Password > “Use Touch ID for autofilling passwords”).
Touch ID can be built in, as with a laptop model, or for an Apple silicon Mac, provided via a paired Magic Keyboard with Touch ID. See how to set up Touch ID and Face ID.
Yet the storm cloud lingers: someone can use all your passwords when the conditions above aren’t true. These actions will help prevent that:
- Leave FileVault enabled: Because FileVault is a high-value way to prevent power-up access to your computer, most people should leave it enabled, and it is on by default starting in macOS 26. Some people may find it more trouble than the potential of losing access to their files; see how to turn on FileVault for both sides.
- Turn off automatic login, if you don’t have FileVault enabled: See what launches on your Mac for how to disable it.
- Enable Touch ID and AutoFill: This blocks access to autofilled passwords without your fingerprint or password.
- Lock your Mac after a duration: See the Mac settings worth changing.
Lock the keychain separately
For most people, setting their Mac to lock when it sleeps, when the display is off, or after a screen-saver duration has passed, as described in the Mac settings worth changing, is enough. But macOS also lets you lock the keychain after a set period, even if your Mac remains unlocked.
First, open Keychain Access, located at /System/Library/CoreServices/Applications. Click Open Keychain Access at the prompt.
Select your login keychain, and choose Edit > Change Settings for Keychain “login”. You can select “Lock after X minutes of inactivity,” pick a time delay, and click Save. (The “Lock when sleeping” option makes little sense—you should set your Mac to lock when sleeping, as that locks the Keychain and your session.)
Note that you can only change settings for the login keychain and your custom keychains, if any. You cannot change these settings for the System, System Roots, or iCloud (if enabled).
