Mac Security · FileVault & Mac Data Protection · Lesson 4 of 5

Passwords and the Passwords App

Keep sign-ins in Passwords, sync them safely and act on its warnings.

One place for every sign-in

You learned earlier why a password manager beats remembering everything. Your Mac has one built in.

Your Mac keeps saved passwords in its keychain. A keychain is a locked store for your passwords, passkeys and other secrets.

In recent versions of macOS (Sequoia and later), you see it all in the Passwords app. Find it with Spotlight, or in the Applications folder. It opens only after your Mac password or Touch ID.

On older versions of macOS there is no Passwords app. Look in System Settings > Passwords, or in Safari's settings under Passwords. You may also see an app called Keychain Access. It is an older tool for advanced items, and most people never need it.

The sidebar in Passwords sorts things into groups. You'll see all your passwords, your passkeys, verification codes, saved Wi-Fi networks and a Security section. Click any entry to see the website, the user name and the password.

iCloud Keychain keeps all this in step across your Apple devices. Save a password on your iPhone, and it shows up on your Mac. To turn it on:

1. Open System Settings and click your name.
2. Click iCloud.
3. Turn on Passwords. Some versions call it Passwords & Keychain.

iCloud Keychain is end-to-end encrypted. That means it is scrambled on your devices and only your devices can unscramble it. Apple can't read your passwords.

If you also use a Windows PC, Apple's iCloud for Windows can bring these passwords there too.

One caution. Anyone who can unlock your Mac can open Passwords with your Mac password. That is one more reason to keep your Mac password strong and private.

Passkeys and security warnings

You set up passkeys on Windows in an earlier lesson. A passkey is a sign-in that uses your device instead of a password. It can't be guessed, and it won't work on a fake site. Macs handle them well.

When a website offers a passkey, your Mac saves it in Passwords. Next time, you approve the sign-in with Touch ID or your Mac password. With iCloud Keychain on, the passkey syncs to your iPhone and iPad too.

Need to sign in on a computer that isn't yours? Many sites show a QR code. Scan it with your iPhone and approve there. Your passkey never leaves your phone.

Now open the Security section of Passwords. It lists accounts that need attention:

• Weak passwords that are short or easy to guess.
• Reused passwords used on more than one site. If one site leaks, the others are at risk.
• Compromised passwords that showed up in a known data leak. A data leak is when a company's stored sign-ins get stolen and shared.

Fix them in this order:

1. Compromised first. Someone may already have them.
2. Then reused ones, starting with email and banking.
3. Then weak ones.

Click an entry and choose Change Password on Website. On the site's page, let your Mac suggest a strong password, and it saves it for you. If a site offers a passkey, consider switching to one.

Passwords watches for leaks for you. In the app's settings, keep the option to detect compromised passwords turned on.