Der Flounder
Seldom updated, occasionally insightful.- Home
- About
- Contact
Manually copying login keychain files from one Mac to another no longer works on Secure Enclave-equipped Macs running macOS Tahoe
September 8, 2026 rtrouton Leave a comment Go to commentsI recently encountered an issue with the login keychain on macOS. For those not familiar with the login keychain, it’s a keychain that macOS automatically creates for each user account on a Mac. The password for a user’s login keychain matches the password used to log in to the Mac. It is stored as an encrypted database file and unlocks automatically when the user logs in, since the login password and keychain password are the same by default.
As of macOS Tahoe, the login keychain is a SQLite database file named login.keychain-db. It is stored in the user’s home folder in the following directory:
/Users/username_goes_here/Library/Keychains
Historically, you could copy the login keychain file from one Mac to another and be able to open it on the destination Mac by providing the password to that keychain. As of macOS Tahoe, this does not appear to work for Macs which use Secure Enclave. For those Macs, only having the password to the login keychain is no longer sufficient for reasons discussed in the Keychain data protection section of Apple’s Platform Security documentation:
Keychain items are encrypted using two different AES-256-GCM keys: a table key (metadata) and a per-row key (secret key). Keychain metadata (all attributes other than kSecValue) is encrypted with the metadata key to speed searches, and the secret value (kSecValueData) is encrypted with the secret key. The metadata key is protected by the Secure Enclave but is cached in the Application Processor to allow fast queries of the keychain. The secret key always requires a round trip through the Secure Enclave.
For more details, please see below the jump.
The relevant section of the passage above is this:
The metadata key is protected by the Secure Enclave but is cached in the Application Processor to allow fast queries of the keychain. The secret key always requires a round trip through the Secure Enclave.
From that, it appears that unlocking the login keychain requires more than the password because the keys it unlocks are tied to the Secure Enclave of the Mac where the keychain was created. With the decryption keys stored in the source Mac’s Secure Enclave, manually copying the keychain to another Mac and then unlocking it won’t work. The password you have for the keychain may be correct, but the actual keys needed to decrypt its contents won’t be available on the destination Mac.
I was able to test this by copying a login.keychain-db file from an Apple Silicon Mac to a second Mac (in this case, a macOS virtual machine) and attempted to unlock it using the account’s correct password.
Note: The reason I chose to test using a macOS VM is that VMs don’t have a Secure Enclave. This allows us to verify that if keys are being stored in the source Mac’s Secure Enclave, then the VM won’t be able to access them in the VM.
Here’s the test procedure used:
1. Create a user account on an Apple Silicon Mac with the following username:
username
2. Log into the username account on the Apple Silicon Mac.
3. Locate the login.keychain-db file in /Users/username/Library/Keychains.
4. Copy the login.keychain-db file to a convenient location.
5. Set up a new macOS VM
6. Create a username user account on the macOS VM with an identical password to the one used for the username account on the Apple Silicon Mac.
7. Log into the username account on the macOS VM.
8. Locate the login.keychain-db file in /Users/username/Library/Keychains.
9. Remove the existing login.keychain-db file from /Users/username/Library/Keychains on the macOS VM
10. Copy the login.keychain-db file from the Apple Silicon Mac to /Users/username/Library/Keychains in the macOS VM.
11. Restart the macOS VM
12. Log into the username account on the macOS VM.
The behavior I expected:
- The login keychain would unlock automatically when I logged in as the username account on the macOS VM.
What actually happened:
- A new login keychain file was created automatically when I logged in as the username account on the macOS VM.
Why did this happen? Time to check the logs.
What I found was that the unlock attempt failed even though the correct password was supplied. I was able to confirm this by running the following command to get the relevant logs:
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Show hidden characters
| log show –predicate 'subsystem == "com.apple.securityd" && category == "KCLogin"' –last 1h |
gistfile1.txt
hosted with ❤ by GitHub
The logs showed the following:
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Show hidden characters
| Timestamp Thread Type Activity PID TTL | |
| 2026-09-08 11:49:11.321174-0400 0x33c Default 0x2fb6 170 0 loginwindow: (Security) [com.apple.securityd:KCLogin] StorageManager::login: loginDLDbIdentifier is /Users/username/Library/Keychains/login.keychain | |
| 2026-09-08 11:49:11.321284-0400 0x33c Default 0x2fb6 170 0 loginwindow: (Security) [com.apple.securityd:KCLogin] Attempting to unlock login keychain "/Users/username/Library/Keychains/login.keychain-db" | |
| 2026-09-08 11:49:11.466352-0400 0x33c Default 0x2fb6 170 0 loginwindow: (Security) [com.apple.securityd:KCLogin] SecKeychainLogin result: 0, password was supplied | |
| 2026-09-08 11:50:53.497587-0400 0x338 Default 0x2d4a 170 0 loginwindow: (Security) [com.apple.securityd:KCLogin] StorageManager::login: loginDLDbIdentifier is /Users/username/Library/Keychains/login.keychain | |
| 2026-09-08 11:50:53.497759-0400 0x338 Default 0x2d4a 170 0 loginwindow: (Security) [com.apple.securityd:KCLogin] Attempting to unlock login keychain "/Users/username/Library/Keychains/login.keychain-db" | |
| 2026-09-08 11:50:53.713693-0400 0x338 Default 0x2d4a 170 0 loginwindow: (Security) [com.apple.securityd:KCLogin] SecKeychainLogin failed: -2147413984, password was supplied | |
| 2026-09-08 11:50:54.014314-0400 0x338 Default 0x2d4d 170 0 loginwindow: (Security) [com.apple.securityd:KCLogin] StorageManager::login: loginDLDbIdentifier is /Users/username/Library/Keychains/login.keychain | |
| 2026-09-08 11:50:54.014418-0400 0x338 Default 0x2d4d 170 0 loginwindow: (Security) [com.apple.securityd:KCLogin] Creating login keychain /Users/username/Library/Keychains/login.keychain | |
| 2026-09-08 11:50:54.240675-0400 0x338 Default 0x2d4d 170 0 loginwindow: (Security) [com.apple.securityd:KCLogin] Login keychain created successfully |
gistfile1.txt
hosted with ❤ by GitHub
A. The log confirms a password value was supplied to the unlock attempt. As the keychain’s password was separately verified to be correct from the test setup, this should rule out a simple password mismatch causing the unlock failure.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Show hidden characters
| 2026-09-08 11:50:53.713693-0400 0x338 Default 0x2d4a 170 0 loginwindow: (Security) [com.apple.securityd:KCLogin] SecKeychainLogin failed: -2147413984, password was supplied |
gistfile1.txt
hosted with ❤ by GitHub
B. Checking the file system afterward showed the copied keychain file had been renamed from login.keychain-db to a file named login_renamed_1.keychain-db and the logs confirm macOS created a new login.keychain-db file in its place. Creating a new login keychain is the standard macOS fallback behavior when a login keychain can’t be unlocked on login with the password used to log in at the login window.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Show hidden characters
| 2026-09-08 11:50:54.014314-0400 0x338 Default 0x2d4d 170 0 loginwindow: (Security) [com.apple.securityd:KCLogin] StorageManager::login: loginDLDbIdentifier is /Users/username/Library/Keychains/login.keychain | |
| 2026-09-08 11:50:54.014418-0400 0x338 Default 0x2d4d 170 0 loginwindow: (Security) [com.apple.securityd:KCLogin] Creating login keychain /Users/username/Library/Keychains/login.keychain | |
| 2026-09-08 11:50:54.240675-0400 0x338 Default 0x2d4d 170 0 loginwindow: (Security) [com.apple.securityd:KCLogin] Login keychain created successfully |
gistfile1.txt
hosted with ❤ by GitHub
Share this:
- Print (Opens in new window) Print
- Email a link to a friend (Opens in new window) Email
- More
- Share on Facebook (Opens in new window) Facebook
- Share on LinkedIn (Opens in new window) LinkedIn
- Share on Reddit (Opens in new window) Reddit
- Share on X (Opens in new window) X
- Share on Pinterest (Opens in new window) Pinterest
- Share on Tumblr (Opens in new window) Tumblr
Related
Categories: Mac administration, macOS Comments (4) Leave a comment-
staze September 8, 2026 at 10:49 pm Reply
Thi
-
Thi
-
This makes me wonder how Migration Assistant handles this. Does it copy the contents for SE over from one machine to another?
-
Josh Whitver September 14, 2026 at 1:12 pm Reply
So, then, is the workaround to rely on Federated Apple Accounts and syncing corporate/education institution keychains up to the respective federated Cloud accounts, in order to allow us to migrate keychains between machines at upgrade time?
- No trackbacks yet.
Leave a comment Cancel reply
Suppressing the Liquid Glass screen with a configuration profile on macOS Golden Gate Checking APNS communication on macOS Tahoe RSS feed- Youdao
- Xian Guo
- Zhua Xia
- My Yahoo!
- newsgator
- Bloglines
- iNezha
| M | T | W | T | F | S | S |
|---|---|---|---|---|---|---|
| 1 | 2 | 3 | 4 | 5 | 6 | |
| 7 | 8 | 9 | 10 | 11 | 12 | 13 |
| 14 | 15 | 16 | 17 | 18 | 19 | 20 |
| 21 | 22 | 23 | 24 | 25 | 26 | 27 |
| 28 | 29 | 30 | ||||
Recent Comments
 | David Young on Enrolling macOS Golden Gate 27… |
 | Mike Boylan on Enrolling macOS Golden Gate 27… |
| David Young on Enrolling macOS Golden Gate 27… |
 | isotopp on Intel apps and macOS Golden… |
| isotopp on Intel apps and macOS Golden… |
Categories
Archives
- September 2026
- August 2026
- July 2026
- June 2026
- May 2026
- April 2026
- March 2026
- February 2026
- January 2026
- December 2025
- November 2025
- October 2025
- September 2025
- August 2025
- July 2025
- June 2025
- May 2025
- April 2025
- March 2025
- February 2025
- January 2025
- December 2024
- November 2024
- October 2024
- September 2024
- August 2024
- July 2024
- June 2024
- May 2024
- April 2024
- March 2024
- February 2024
- January 2024
- December 2023
- November 2023
- October 2023
- September 2023
- August 2023
- July 2023
- June 2023
- May 2023
- April 2023
- March 2023
- February 2023
- January 2023
- December 2022
- November 2022
- October 2022
- September 2022
- July 2022
- June 2022
- May 2022
- April 2022
- March 2022
- February 2022
- January 2022
- December 2021
- November 2021
- October 2021
- September 2021
- August 2021
- July 2021
- June 2021
- May 2021
- April 2021
- March 2021
- February 2021
- January 2021
- December 2020
- November 2020
- October 2020
- September 2020
- August 2020
- July 2020
- June 2020
- May 2020
- April 2020
- March 2020
- February 2020
- January 2020
- December 2019
- November 2019
- October 2019
- September 2019
- August 2019
- July 2019
- June 2019
- May 2019
- April 2019
- March 2019
- February 2019
- January 2019
- December 2018
- November 2018
- October 2018
- September 2018
- August 2018
- July 2018
- June 2018
- May 2018
- April 2018
- March 2018
- February 2018
- January 2018
- December 2017
- November 2017
- October 2017
- September 2017
- August 2017
- July 2017
- June 2017
- May 2017
- April 2017
- March 2017
- February 2017
- January 2017
- December 2016
- November 2016
- October 2016
- September 2016
- August 2016
- July 2016
- June 2016
- May 2016
- April 2016
- March 2016
- February 2016
- January 2016
- December 2015
- November 2015
- October 2015
- September 2015
- August 2015
- July 2015
- June 2015
- May 2015
- April 2015
- March 2015
- February 2015
- January 2015
- December 2014
- November 2014
- October 2014
- September 2014
- August 2014
- July 2014
- June 2014
- May 2014
- April 2014
- March 2014
- February 2014
- January 2014
- December 2013
- November 2013
- October 2013
- September 2013
- August 2013
- July 2013
- June 2013
- May 2013
- April 2013
- March 2013
- February 2013
- January 2013
- December 2012
- November 2012
- October 2012
- September 2012
- August 2012
- July 2012
- June 2012
- May 2012
- April 2012
- March 2012
- February 2012
- January 2012
- December 2011
- November 2011
- October 2011
- September 2011
- August 2011
- July 2011
- June 2011
- May 2011
- April 2011
- March 2011
- February 2011
- January 2011
- December 2010
- November 2010
- October 2010
- September 2010
- August 2010
- July 2010
- May 2010
- March 2010
- February 2010
- December 2009
- November 2009
- October 2009
- September 2009
- June 2009
- April 2009
- March 2009
- February 2009
- December 2008
- November 2008
- October 2008
- September 2008
- March 2008
- February 2008
- December 2007
- November 2007
- October 2007
- September 2007
- July 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- December 2006
- November 2006
- October 2006
- September 2006
- August 2006
- July 2006
- June 2006
- May 2006
- April 2006
- March 2006
- February 2006
- January 2006
- December 2005
- November 2005
- October 2005
- September 2005
- July 2005
- June 2005
- May 2005
- April 2005
- March 2005
- February 2005
- January 2005
- December 2004
- November 2004
- October 2004
- September 2004
- August 2004
- July 2004
- June 2004
- May 2004
- April 2004
- March 2004
- February 2004
- January 2004
- December 2003
- November 2003
- October 2003
- September 2003
- August 2003
- July 2003
- June 2003
- May 2003
Blog Stats
- 11,030,646 hits
- Comment
- Reblog
-
Subscribe
Subscribed
-
Der Flounder
- Already have a WordPress.com account? Log in now.
-
-
-
Der Flounder
- Subscribe Subscribed
- Sign up
- Log in
- Copy shortlink
- Report this content
- View post in Reader
- Manage subscriptions
- Collapse this bar
-