Sweepfor Mac
Free Download

Mac maintenance

iCloud Keychain on Mac Explained

iCloud Keychain syncs Mac passwords, passkeys, and Wi-Fi credentials across Apple devices. Here's how it works, what it stores, and how to fix sync issues.

9 min read

You save a password on your iPhone. Forty seconds later, you’re at your Mac and Safari already knows it. You add a passkey on your iPad. It shows up in System Settings on your MacBook. Wi-Fi passwords flow between devices without a single manual entry. iCloud Keychain has been quietly running this whole show since 2013, and most Apple users couldn’t tell you what it actually is, where the data lives, or what to do when it stops working.

iCloud Keychain is Apple’s end-to-end encrypted credential sync service. It’s separate from your local macOS Login Keychain — separate file, separate encryption, separate sync mechanism — even though Keychain Access and Safari treat them as one unified password store. Knowing the distinction matters when something goes sideways.

What’s Stored in iCloud Keychain

The data types iCloud Keychain syncs across your Apple devices:

  • Safari passwords — every saved login on Mac, iPhone, iPad
  • Wi-Fi passwords — networks you’ve joined on any device
  • Passkeys — modern passwordless credentials
  • Apple Pay payment methods — credit/debit cards saved for in-store and online
  • Verification codes — TOTP codes Apple now generates as a built-in 2FA tool
  • Internet account credentials — for Mail, Calendar, Messages accounts on stockApple-supported services

What’s not in iCloud Keychain:

  • Most Login Keychain entries that aren’t web logins (app-specific passwords, code signing certs, manually-added secure notes)
  • Bank account or financial information beyond payment methods
  • Anything from third-party password managers (1Password, Bitwarden, etc., manage their own vaults)
  • App-specific encrypted data

How the Encryption Works

End-to-end means Apple can’t read your passwords. The mechanism:

  1. Each device has a device-specific encryption key
  2. The keychain syncs are encrypted with a key derived from your iCloud Security Code (or, more commonly now, your device passcode)
  3. Adding a new device to the sync circle requires approval from an existing one (or your iCloud Security Code, or a recovery contact)
  4. Apple’s servers see encrypted blobs they can’t decrypt

The “iCloud Security Code” was the original recovery mechanism — a 4 or 6-digit code Apple kept in a way that allowed recovery of your keychain even if you lost all your devices. Modern setups have largely replaced this with iCloud Keychain Recovery flows that use account-trusted phone numbers and recovery contacts.

The practical implication: iCloud Keychain is more secure than most password managers because Apple genuinely can’t read it, but the recovery story depends on you maintaining access to either a trusted device, your phone number, or a recovery contact.

Enabling and Checking Status

On Mac:

  • System Settings → [Your Name] → iCloud → Passwords & Keychain

You’ll see whether it’s on or off, and which devices are in the sync circle.

If it’s off and you turn it on, the device joins the sync circle. macOS will ask you to verify identity using a trusted device, an iCloud Security Code, or a recovery contact, depending on your setup.

To see synced passwords:

  • System Settings → Passwords
  • Authenticate with Touch ID, Face ID, or your account password
  • Search and view entries

The new “Passwords” app introduced with macOS Sequoia (and the equivalent on iOS 18) is a friendlier UI on top of the same iCloud Keychain data. Older macOS versions accessed it through Safari’s preferences or Keychain Access.

Where Data Lives Locally

A copy of the iCloud Keychain data is stored locally on each device for offline access:

~/Library/Keychains/<UUID>/keychain-2.db

Where <UUID> is a unique identifier per Apple ID. The contents are encrypted at rest with a key tied to your device.

This is why opening “Passwords” works even when offline — the local copy is queried, with sync resuming when network returns.

Power users use SweepSweep handles all the cleanup that articles like this describe. Get Sweep free →

Sync Failures and How to Diagnose Them

Sync usually just works. When it doesn’t:

“Approve from another device” loop

You enable iCloud Keychain on a new Mac. It says “Approve from another device.” You go to your iPhone. The iPhone says “Approve from another device.” Round and round.

Usually a glitch in Apple’s sync state. Fixes:

  1. Restart all involved devices
  2. Make sure all are on a current OS version
  3. Sign out of iCloud entirely on one device (System Settings → [Your Name] → Sign Out), then sign back in
  4. As a last resort, disable iCloud Keychain on all devices, wait an hour, re-enable on one, then propagate

Passwords not appearing on a new device

After enabling iCloud Keychain, sync can take 5–15 minutes for the initial download, longer if you have hundreds of entries. If it’s been longer than an hour:

  • Check that all devices are on the same Apple ID
  • Verify two-factor auth is set up properly
  • On Mac, check Console.app for entries with subsystem:com.apple.security.keychain for sync errors

Passwords inconsistent across devices

You delete a saved password on iPhone. The Mac still shows it. Two days later, the iPhone version reappears.

This usually means one device isn’t syncing correctly. Look at:

  • System Settings → [Your Name] → iCloud → Passwords & Keychain — is the device listed in the sync circle?
  • The cloudd daemon: log show --last 1h --predicate 'subsystem == "com.apple.cloudd"' for sync activity

A re-sync trick: turn off Passwords & Keychain on the misbehaving device, wait two minutes, turn it back on. The device re-joins the sync circle and pulls a fresh state.

Tip: If you have an old Mac still in your sync circle that you no longer use, sign out of iCloud on it (or remove it from your trusted devices list in Apple ID settings). Stale devices in the circle can cause weird sync hesitation.

Passkeys Specifically

Passkeys are the WebAuthn/FIDO2 credentials Apple started supporting heavily in iOS 16 and macOS Ventura. They’re cryptographic key pairs, with the private key stored in iCloud Keychain and the public key registered with the website.

Passkey advantages over passwords:

  • No shared secret on the server (a server breach can’t leak credentials)
  • Phishing-resistant (the passkey is bound to a specific domain)
  • No need to remember anything

Where they live: same iCloud Keychain database as passwords. They sync the same way. They show in the Passwords app alongside saved logins.

To use a passkey from a Mac, the website prompts you to sign in with passkey, your Mac authenticates you (Touch ID or password), and the passkey signs the authentication challenge. The site never sees the private key.

Passkeys are still rolling out across the web. Major sites that support them include Google, GitHub, PayPal, eBay, Amazon (in some flows), and a growing list. Most other sites still rely on traditional passwords, which iCloud Keychain handles fine.

iCloud Keychain vs. Login Keychain (Again)

Worth restating: these are different keychains, even if Mac UI sometimes blurs them.

  • Login Keychain (~/Library/Keychains/login.keychain-db) — local-only, holds app passwords, certificates, secure notes
  • iCloud Keychain (~/Library/Keychains/<UUID>/keychain-2.db) — synced via iCloud, holds web passwords, Wi-Fi, payment methods, passkeys

Web passwords from Safari go into iCloud Keychain when iCloud Keychain is on. Mail account passwords go into Login Keychain. The two coexist.

When you “delete a password” in Safari, you’re affecting iCloud Keychain. When Keychain Access shows you a “login” keychain, that’s the Login Keychain — separate.

For a complete view of credentials saved by iCloud Keychain, use the Passwords app or System Settings → Passwords. For Login Keychain entries, use Keychain Access.

Skip the manual huntSweep audits launch agents, daemons, and helpers in one screen. Download Sweep free →

Auto-Fill Behavior

When you visit a login form in Safari, iOS Safari, or supported third-party browsers, iCloud Keychain offers to fill credentials. Settings to know:

On Mac (Sonoma+):

  • System Settings → Passwords → Auto-Fill Passwords (toggle)
  • Safari → Settings → AutoFill — granular controls

The auto-fill respects domain matching strictly — a saved password for example.com won’t auto-fill on example.net. If you’ve saved the same password under multiple domains, you’ll see them all in the suggestion list.

For password generation: when you sign up for a new account, Safari offers to “Suggest a strong password.” Accepting saves the generated password to iCloud Keychain. The suggestions follow site-specific rules (some sites require specific character sets) which Apple maintains in a database.

Sharing Passwords Securely

A relatively new feature: shared password groups. From the Passwords app:

  • File → New Shared Group
  • Add iCloud contacts to share with
  • Move credentials into the shared group

Everyone in the group sees and can edit those credentials. End-to-end encryption is preserved — Apple sees encrypted blobs, the group members hold the keys.

This is a real alternative to dedicated team password managers for small groups (family Wi-Fi password, shared streaming logins, etc.). For business use, dedicated tools usually still make more sense.

Recovery Without Trusted Devices

If you’ve lost all your trusted Apple devices, recovery options:

  1. Recovery contacts — people you’ve designated who can help
  2. Recovery key — a long alphanumeric code you saved when setting up account recovery
  3. iCloud Security Code (older accounts) — short code Apple held that allowed recovery
  4. Apple Support — assists with identity verification, but cannot decrypt iCloud Keychain — they can only help you regain account access; the keychain itself may need to be reset

If you set up Account Recovery (System Settings → [Your Name] → Sign-In & Security → Account Recovery), you have multiple paths back. If you didn’t, and you lose all devices, your iCloud Keychain may be unrecoverable — Apple’s design prioritizes user privacy over recoverability.

When to Use iCloud Keychain vs. a Third-Party Manager

iCloud Keychain is great for:

  • Apple-only households
  • People who want zero setup and zero management
  • Passkeys (the integration is excellent)

A third-party manager is better for:

  • Cross-platform households (Windows, Android, Linux mixed in)
  • Sharing complex credential structures with non-Apple users
  • Storing detailed credit card info, software licenses, secure documents
  • Audit trails, compliance, business use

Many people use both: iCloud Keychain for casual web logins via Safari, a dedicated manager for everything else. There’s no rule against running both side by side, and the auto-fill conflicts are usually manageable.

What This Buys You

iCloud Keychain is the most invisible useful feature on a Mac for many users. It eliminates an entire class of friction (typing passwords, syncing them across devices, remembering them) at zero cost beyond an Apple ID. Knowing what it actually does, where the data lives, and how to fix it when sync breaks turns it from “magic that sometimes fails mysteriously” into a predictable, trustworthy tool.

← Back to all guides