How to Use the macOS Keychain Access App to Manage Saved Passwords and Certificates

Where macOS Stores Your Passwords

Every time you connect to a Wi-Fi network, log into a website in Safari, approve a code-signing certificate, or save a password in an application, macOS silently stores that credential in a secure, encrypted database called the Keychain. Most users never interact with this system directly because macOS handles it automatically in the background—autofilling passwords in Safari, silently authenticating with known Wi-Fi networks, and validating application certificates without any visible prompt.

However, there are situations where you need to manually access this database: recovering a forgotten Wi-Fi password, diagnosing certificate trust errors that prevent applications from launching, or exporting credentials before migrating to a new Mac. For these tasks, macOS provides a dedicated graphical utility called Keychain Access.

Opening Keychain Access

Keychain Access is located in the Utilities folder, but the fastest way to open it is via Spotlight:

1. Press Command + Space to open Spotlight.
2. Type Keychain Access and press Return.

When the application opens, you will see a window divided into two key areas: the left sidebar lists the available Keychains, and the main area displays the individual items stored within the selected Keychain.

Understanding the Different Keychains

macOS maintains several distinct Keychains, each serving a different purpose:

• login: This is your primary, personal Keychain. It is unlocked automatically when you log into your Mac account. It stores the vast majority of your saved passwords, including Wi-Fi credentials, Safari website logins, and application-specific passwords.
• System: This Keychain stores system-wide credentials and certificates that apply to all users on the Mac. Modifying items here requires administrator authentication.
• System Roots: This contains the root certificates that macOS trusts by default (issued by trusted Certificate Authorities like DigiCert, Let’s Encrypt, and Apple). You should generally never modify this Keychain unless you have a very specific, expert-level reason.
• iCloud: If you use iCloud Keychain, this stores credentials that are synced across all your Apple devices. Changes here propagate to your iPhone, iPad, and other Macs signed into the same Apple ID.

Recovering a Forgotten Wi-Fi Password

One of the most common reasons to use Keychain Access is retrieving the password for a Wi-Fi network your Mac has previously connected to. This is especially useful when a guest asks for your Wi-Fi password and you cannot remember it.

1. Open Keychain Access and ensure the login Keychain is selected in the sidebar.
2. In the search bar at the top right, type the name (SSID) of the Wi-Fi network.
3. The matching entry will appear in the list, categorised as an “AirPort network password” under the Kind column.
4. Double-click the entry to open its details.
5. In the details window, check the box next to Show password.
6. macOS will prompt you to enter your Mac login password (and possibly your username) to authenticate. This security step ensures that only you can reveal stored credentials.
7. After authenticating, the password will appear in the text field.

Finding Saved Website Passwords

If you need to retrieve a password saved by Safari or another application:

1. Select the login Keychain.
2. Use the Category filter in the sidebar and select Passwords to narrow the list.
3. Search for the website name or URL in the search bar.
4. Double-click the entry and check Show password, authenticating when prompted.

Note: On newer versions of macOS (Ventura and later), Apple has also moved website passwords into a dedicated section within System Settings > Passwords. Keychain Access remains the more comprehensive tool, as it also stores application passwords, certificates, and encryption keys that the System Settings view does not display.

Diagnosing Certificate Trust Issues

If an application refuses to open with a security warning, or if Safari displays a “This Connection Is Not Private” error for a website you trust (such as an internal company portal), the issue may be a certificate trust problem in your Keychain.

1. Open Keychain Access and select Certificates from the Category list in the sidebar.
2. Search for the name of the issuing authority or the domain name.
3. Double-click the certificate to view its details.
4. Expand the Trust section by clicking the small disclosure triangle.
5. You will see a dropdown next to When using this certificate. The options include “Use System Defaults”, “Always Trust”, and “Never Trust”.

Warning: Setting a certificate to “Always Trust” bypasses macOS security protections. Only do this for certificates you have personally verified as legitimate (such as a self-signed certificate for your own development server or a corporate intranet). Never mark an unknown certificate as trusted.

Deleting Outdated or Problematic Entries

Over years of use, your Keychain accumulates hundreds of entries for Wi-Fi networks you visited once, websites you no longer use, and expired certificates. If you experience persistent authentication errors (such as macOS repeatedly asking for a Wi-Fi password despite you entering it correctly), deleting the corrupted entry and re-entering the password fresh often resolves the issue.

1. Find the problematic entry in Keychain Access.
2. Right-click (or Control-click) the entry.
3. Select Delete.
4. Authenticate with your Mac login password if prompted.

The next time you connect to the Wi-Fi network or visit the website, macOS will prompt you to enter the password again from scratch, creating a clean new Keychain entry.

Conclusion

Keychain Access is a critical macOS utility that most users never need until they desperately do. By understanding how to navigate its interface, recover forgotten credentials, and diagnose certificate issues, you gain a level of control over your Mac’s security infrastructure that goes far beyond what the standard System Settings app provides.