How to Use the macOS security Command to Manage Keychains

The Invisible Vault of macOS

Every time you log into a website using Safari, connect to a secure corporate Wi-Fi network, or verify an SSH key for GitHub, macOS saves those secret passwords and cryptographic certificates in a heavily encrypted database called the Keychain.

For standard users, this process is completely invisible. When Safari needs a password, it silently reaches into the Keychain, retrieves the password, and logs you in. If you want to manually view a saved password, you must open the graphical “Keychain Access” application and type your Mac login password to prove your identity.

However, if you are a system administrator writing automated deployment scripts, or a developer trying to digitally sign a macOS application via the terminal, you cannot rely on the graphical Keychain Access app. To programmatically unlock vaults, extract passwords, and manage digital certificates from the command line, you must use the incredibly powerful security command.

Step 1: Open the Terminal

Because you are interacting with highly sensitive encrypted vaults, you will be prompted to enter your Mac administrator password frequently.

1. Press Command + Space to open Spotlight Search.
2. Type Terminal and press Enter.

Step 2: Finding a Saved Password

If you forgot the Wi-Fi password for your corporate network, you can extract it directly from the terminal without opening the Keychain Access app.

You use the find-generic-password flag, and specify the exact name of the Wi-Fi network (the account) using the -a flag. The -w flag tells the command to output only the raw password (the “word”) instead of a massive block of metadata.

security find-generic-password -a "Corporate_Guest_WiFi" -w

macOS will instantly pop up a graphical security prompt asking for your Mac login password to prove you are authorized to see this secret. Once you enter it, the terminal will cleanly output the Wi-Fi password in plain text.

Step 3: Creating a Custom Keychain

If you are writing a script that requires its own set of passwords (e.g., an automated backup script that needs FTP credentials), you should not dump those passwords into the user’s primary login Keychain. Instead, you should create an isolated, dedicated Keychain just for your script.

security create-keychain -p "MySecretPassword123" backup_vault.keychain

This command creates a brand new encrypted vault named backup_vault.keychain and locks it using the password MySecretPassword123. You can now safely store your script’s FTP credentials inside this specific vault without polluting the rest of the system.

Step 4: Unlocking a Keychain for Scripts

If you have an automated script that runs at 3:00 AM while you are asleep, it cannot stop and wait for you to physically type your password into a graphical pop-up box to unlock a Keychain.

To allow a script to run autonomously, you must programmatically unlock the required Keychain at the very beginning of the script.

security unlock-keychain -p "MySecretPassword123" backup_vault.keychain

Once this command runs, the backup_vault is temporarily unlocked. Your script can now extract the required FTP passwords, perform its backup, and finish its job completely silently.

Step 5: Managing Digital Certificates

If you are a macOS software developer, you cannot distribute your application unless it is digitally signed with an official Apple Developer Certificate. These certificates are stored securely inside the Keychain.

Before you attempt to compile and sign your code, you should verify that your Developer Certificate is actually installed and recognized by the system.

security find-identity -v -p codesigning

The terminal will scan all your active Keychains and output a list of all valid (-v) identities specifically authorized for code signing. If your Apple Developer Certificate does not appear in this list, your Xcode build will fail, immediately telling you that you need to re-download your certificates from the Apple Developer portal.