How to Configure Automatic Keychain Lock Timeouts in macOS Terminal Using security

In macOS, the user login keychain securely stores critical credentials, including saved website passwords, Wi-Fi network passphrases, SSH keys, enterprise VPN tokens, and cryptographic certificates. By default, macOS automatically unlocks your login keychain when you sign in and leaves it unlocked indefinitely until you log out or shut down. If an employee steps away from their desk, leaves their MacBook unattended, or if malware executes in user space, an unlocked keychain allows applications to query saved credentials without prompting for master authentication.

To enforce zero-trust endpoint security, macOS includes a native command-line utility within the security subsystem: set-keychain-settings. This command allows administrators to configure automatic inactivity lock timeouts and force keychains to lock whenever the Mac enters sleep mode.

Why Automate Keychain Locking?

Configuring automated locking rules provides essential safeguards:

• Inactivity Auto-Lock: If no user interaction occurs for a specified duration (such as 10 or 15 minutes), the keychain locks automatically in memory. Subsequent credential requests require entering the master keychain password.
• Lock on Sleep: Ensures that closing your MacBook lid or triggering display sleep immediately locks cryptographic keys, mitigating physical cold-boot and memory extraction risks.
• Enterprise Compliance: Meets strict cybersecurity auditing standards (e.g., NIST, CIS Benchmarks) requiring encrypted credential stores to lock after designated idle intervals.

Identifying Your Target Keychain Path

Before configuring lock settings, identify the filesystem path of your active user keychain:

security list-keychains

On modern macOS systems, the default user login keychain is located at:

~/Library/Keychains/login.keychain-db

Command Syntax and Configuration Flags

The syntax for configuring keychain security settings is structured as follows:

security set-keychain-settings [options] [keychain_path]

The table below summarizes available modifier switches:

Flag	Function	Operational Role
-t <seconds>	Lock Timeout	Specifies inactivity idle timeout in seconds before the keychain automatically locks.
-l	Lock on Sleep	Forces the keychain to lock automatically whenever the system sleeps.
-u	Unset Timeout	Disables the inactivity timeout, keeping the keychain unlocked indefinitely.
[keychain_path]	Target Keychain	Path to the target keychain file. If omitted, applies to the default keychain.

Configuring Inactivity Timeouts and Sleep Locks

1. Enabling Inactivity Timeout (e.g., 10 Minutes) and Sleep Locking

To set a 10-minute idle timeout (600 seconds) and lock the keychain on sleep, execute:

security set-keychain-settings -t 600 -l ~/Library/Keychains/login.keychain-db

2. Locking Strictly on System Sleep Without Inactivity Timeout

If you prefer not to enter your password during continuous workday usage but want guaranteed protection whenever your MacBook sleeps:

security set-keychain-settings -l ~/Library/Keychains/login.keychain-db

Auditing Active Keychain Security Settings

To verify the active timeout configuration on your login keychain, use the show-keychain-info verb:

security show-keychain-info ~/Library/Keychains/login.keychain-db

The terminal outputs the active security parameters:

Keychain "/Users/john/Library/Keychains/login.keychain-db"
  Lock on sleep: yes
  Timeout: 600 seconds

Manually Locking the Keychain Immediately

If you need to step away from your workstation immediately, force an instant lock on all keychains without logging out:

security lock-keychain ~/Library/Keychains/login.keychain-db

To lock every keychain on the system simultaneously, run: security lock-keychain -a.

Frequently Asked Questions

What happens when an app requests credentials while the keychain is locked?

macOS displays a standard system security modal stating that an application wants access to your keychain. You must enter your macOS user password to unlock the keychain and permit access.

How do I revert settings back to default (no timeout)?

To remove the timeout and sleep lock, pass the -u flag: security set-keychain-settings -u ~/Library/Keychains/login.keychain-db.