Update, Sept. 24: Apple has since documented the change in Technote TN3137. In macOS 26.4 and later, a keychain file may reference a “protected entropy file” stored in /var/db/SystemKeys, and unlocking it requires both the keychain password and that file. Apple tells backup developers to back up that directory, and says moving a login keychain to another Mac means copying the matching entropy file too, a step that requires disabling System Integrity Protection. Rich Trouton has updated his post to say Apple’s note contradicts some of his conclusions.
Copying a Mac’s login keychain file to another machine and unlocking it with the user’s password no longer works on Secure Enclave-equipped Macs running macOS Tahoe, Mac admin Rich Trouton reported on his Der Flounder blog.
The login keychain is a SQLite database, login.keychain-db, stored in each user’s ~/Library/Keychains folder. Historically, admins could copy that file to a new Mac and open it with the keychain password. Trouton pointed to the keychain data protection section of Apple’s Platform Security guide, which says: “The metadata key is protected by the Secure Enclave but is cached in the Application Processor to allow fast queries of the keychain. The secret key always requires a round trip through the Secure Enclave.”
To test it, he copied a login keychain from an Apple silicon Mac to a macOS virtual machine, which has no Secure Enclave. The correct password did not unlock it.
The change dates to macOS 26.4
Developer Jeff Johnson of Lapcat Software amplified the finding, writing that “you do not and cannot have a reliable backup of your login keychain.” All Apple silicon Macs and some Intel models have the Secure Enclave, so the change reaches millions of machines. Time Machine can restore a login keychain to the same Mac but not to a different one, he wrote.
In an addendum, Johnson said the behavior started with macOS 26.4, released in March, not with the first Tahoe release. Using Guilherme Rambo’s VirtualBuddy, he found a login keychain from a 26.3 virtual machine could be read on Sequoia, while one from a 26.4 VM could not. The 26.4 release notes don’t mention the change.
Custom keychains are not affected. Johnson said keychains created through the Keychain Access app’s File menu on Tahoe can still be unlocked on other Macs, including ones running Sequoia, and suggested moving what entries you can out of the login keychain into a custom keychain that can be backed up.
WebProNews is an iEntry Publication