Why does my Mac keep asking for my keychain password?
A password box that keeps returning, usually after a password change or a migration. What the keychain is, why it falls out of step with your login, and how to bring the two back together without wiping it.
- Difficulty
- intermediate
- Time
- 25 min
- Read
- 6 min
- Safety
- caution
Short answer
The login keychain is unlocked automatically by your account password, so when the two stop matching it starts asking. That happens after a password reset done through Apple, after restoring from a backup, or after a migration. The fix is to change the keychain's own password to your current login password using Keychain Access — you need the old password to do it, and if you have it, nothing is lost.
macOS stores passwords, certificates, wifi keys and secure notes in an encrypted file called the login keychain. It is unlocked automatically when you sign in, using your account password as the key, which is why most people never know it exists. The two can be separated: resetting an account password through Apple ID or a recovery route changes the login password without being able to change the keychain, because unlocking the keychain requires the old one. From then on macOS has to ask, every time something needs a stored secret. Nothing is broken and nothing is lost — the two just need reuniting.
Safety
Step by step
- Work out what changed and when.The prompts almost always start after a specific event: an account password reset through Apple ID or recovery, a Migration Assistant transfer to a new Mac, restoring from a backup, or a work account policy changing the password. Naming the event tells you which password the keychain still expects.
- Try the old password when it asks.The prompt is asking for the keychain's password, not your current login password, and it says so if you read it carefully. Entering the password you used before the change usually unlocks it immediately, which both confirms the diagnosis and gets you working.
- Change the keychain password to match your login.Open Keychain Access, select the login keychain, and use Edit, Change Password for Keychain "login". It asks for the current keychain password — the old one — and then the new one, which should be your current login password. That permanently ends the prompts and keeps every stored item.
- Check that it is set to unlock automatically.In Keychain Access, the login keychain's settings should not be set to lock after a period of inactivity or on sleep. Those options are legitimate for a shared machine and are a common cause of prompts that appear several times a day rather than constantly.
- Look at whether it is one application asking repeatedly.Mail, Calendar, Messages and any application holding a server password will prompt in a loop if the stored password is wrong rather than if the keychain is locked. That is a different fault with a different fix: delete the stored entry for that account in Keychain Access and let the application store it again.
- Consider iCloud Keychain before any reset.If iCloud Keychain is on, your website and app passwords are also stored in iCloud and will repopulate on a new keychain. That materially reduces what a reset would cost — but it does not cover certificates, some application passwords, or secure notes.
- Reset only as a last resort, and export first if you can.Keychain Access can create a new login keychain, and the old file remains on disk in the Keychains folder so it is not immediately destroyed. If you genuinely cannot recall the old password, moving the old keychain file aside rather than deleting it preserves the possibility of recovering it later.
- Fix the underlying cause on a machine with FileVault.With FileVault on, resetting a password through the recovery key or Apple ID is precisely what desynchronises the keychain. Knowing that in advance means changing your password through System Settings, where macOS updates both, rather than through a reset route.
Common mistakes
- Clicking through the prompt dozens of times a day — It never stops on its own, and each dismissal means an application failed to get a password it needed — which shows up later as mail not sending or a calendar not syncing.
- Resetting the keychain as the first response — It destroys stored certificates, application passwords and secure notes irreversibly. The change-password route keeps everything and takes two minutes if you have the old password.
- Changing your Mac password through Apple ID recovery out of convenience — That is the route that desynchronises the keychain. Changing it in System Settings, while signed in, updates both together.
If it doesn't work
Prompts started immediately after resetting the account password
Cause: The keychain still expects the old password — Fix: Change the keychain's own password to the new one in Keychain Access, using the old password to authorise it. This is the standard case and nothing is lost.
One application asks over and over, others are fine
Cause: A wrong stored password for that account, not a locked keychain — Fix: In Keychain Access, search for the account, delete the stored entry, and let the application prompt once and store the correct password.
Asks after every sleep or after a few minutes
Cause: Keychain lock settings — Fix: Keychain Access, the login keychain's settings, and turn off locking after inactivity and on sleep.
Started after Migration Assistant from an old Mac
Cause: The keychain came across with the old machine's password — Fix: The old Mac's login password is the keychain password. Use it in the change-password dialogue and set it to the new machine's password.
Wifi networks keep asking for their passwords
Cause: The keychain is locked or the system keychain has a problem — Fix: Wifi keys live in the system keychain rather than the login one. If the login keychain is fine and wifi still asks, that points at the system keychain, and Keychain Access's First Aid or a network settings reset is the route.
The old password genuinely is not known
Cause: No way to decrypt the existing keychain — Fix: Nobody can recover it, by design. Create a new login keychain, keep the old file rather than deleting it, and rebuild from iCloud Keychain or a password manager.
Questions people ask
What is the difference between the keychain and iCloud Keychain?
The login keychain is a local encrypted file on that Mac. iCloud Keychain is Apple's synced service that shares website and app passwords, passkeys and card details across your devices. They overlap but are not the same, and iCloud Keychain does not carry everything the local one holds.
Is the keychain a password manager?
For Apple devices, effectively yes, and it is a good one — it is encrypted, it syncs, and it now handles passkeys. Its limitations are that it works properly only inside the Apple ecosystem and is awkward to share with family. The catalogue's guides on password managers cover the wider comparison.
Can someone read my keychain if they have my Mac?
Not without your password, and with FileVault enabled not without decrypting the disk first. That is exactly why the keychain cannot be rescued when the old password is forgotten — the recovery route you would want is the same one an attacker would use.
Does Windows have an equivalent?
Windows Credential Manager stores saved credentials similarly, and it is likewise unlocked by your sign-in. It produces the same class of problem after a password change, though Windows is generally better at keeping the two in step.