Where apps hide your files

The keychain files, one by one

Updated 2026-10-28 · 6 min read

macOS spreads keychain data across several files in your Library, in /Library and in /System. This lists each one, what it does, and the safe ways to back up or move what is inside.

The login keychain

~/Library/Keychains/login.keychain-db

That is the file most people mean. It is your login keychain: saved passwords, certificates, keys and secure notes, opened automatically when you log in. Open the folder with ⇧⌘G in Finder, or run open ~/Library/Keychains in Terminal.

To see which keychains your account uses, without reading anything inside them, run:

security list-keychains

On the Mac checked for this post (macOS Sequoia 15.6) it prints two paths: the login keychain above and /Library/Keychains/System.keychain.

Every keychain location

Path	What it is
~/Library/Keychains/login.keychain-db	Your login keychain, the default for your account.
~/Library/Keychains/metadata.keychain-db	A support file the security system keeps beside it.
~/Library/Keychains/<UUID>/keychain-2.db	The newer keychain database behind iCloud Keychain and the Passwords app. The folder name is an ID.
/Library/Keychains/System.keychain	Mac-wide items shared by all users, such as saved Wi-Fi networks and system certificates.
/Library/Keychains/system-keychain-2.db	The system's newer database, readable only by root.
/System/Library/Keychains/SystemRootCertificates.keychain	Apple's built-in trusted root certificates. Read-only.

On the Mac checked here, ~/Library/Keychains held login.keychain-db, metadata.keychain-db, two UUID-named folders and a certificate store left by Microsoft software. Yours will differ with the apps you use.

The -db ending arrived with macOS Sierra. Before that the file was login.keychain, and old backups may still use that name.

You may also see files such as login.keychain-db.sb-52e0b571-CAPDYc. They are working copies the keychain service leaves while saving, and the files ending in -shm and -wal inside the UUID folders belong to the database there. Apple does not document either, so leave them alone.

Why you cannot just copy the file out

A keychain file is encrypted, and the login keychain is tied to your Mac login password. A plain copy to another Mac is not a dependable way to move it, and the iCloud Keychain database in the UUID folders is not meant to be moved by hand at all. Never email, upload or share these files: anyone who has the file and your login password can try to open it.

Do not delete, rename or edit any keychain file in Finder or Terminal. Deleting login.keychain-db throws away every password, key and certificate stored only there, and apps start asking for passwords you may no longer have.

Backing up the supported way

You usually want one of three outcomes, and each has an Apple route.

1. Keep your passwords on every device: turn on iCloud Keychain. In System Settings, click your name, then iCloud > Passwords and turn on Sync this Mac (on Sonoma the item is called Passwords & Keychain).
2. Move a whole Mac: use Migration Assistant. It carries your login keychain with the rest of your user account, so it opens with your old login password.
3. Export passwords to a file: on Sequoia and later, the Passwords app has File > Export All Passwords to File, or Export Selected Password to File for one. It writes a CSV file that is not encrypted, so keep it private and delete it once you have imported it elsewhere. Apple notes that Wi-Fi passwords, passwords shared with a group you did not create, and Sign in with Apple accounts are not exported.

For certificates and private keys, use Keychain Access. On Sequoia it lives in /System/Library/CoreServices/Applications/, not in Utilities, but Spotlight opens it by name. Select the items and choose File > Export Items, then pick a format. A private key is exported in a password-protected file, so choose that password carefully.

Time Machine backs up ~/Library/Keychains with the rest of your home folder, which is how you restore the same Mac after a mistake.

Before a clean install or a new Mac

Make sure you can get back what the keychain holds:

• Confirm iCloud Keychain is syncing, as in step 1 above.
• Export anything that lives only on this Mac, such as client certificates, private keys and Wi-Fi networks you could not type in again.
• Write down your Mac login password, because it is what protects the login keychain.

After the install, sign in to the same Apple Account and synced items return. Items that were never synced do not. If you use Time Machine or Migration Assistant instead, the login keychain comes back only when you restore the whole user account, not just your Documents folder.

When the keychain asks for the wrong password

If Keychain Access keeps asking for a password that no longer works, usually after a password reset, the login keychain is probably still locked with your old password. Typing the old one, if you remember it, opens it and lets you carry on. If not, Keychain Access has a reset: choose Keychain Access > Settings and click Reset Default Keychains. That gives you a new, empty login keychain, so try every other route first and expect to sign in to apps and websites again.

To check whether a single password exists, search for it by name in the Passwords app or Keychain Access. Never try to read the keychain files themselves.

Confirming where they sit

Spotlight does not list anything inside ~/Library, so searching "keychain" in Finder returns nothing useful. Everywhere includes those folders, so typing keychain-db shows your login and metadata files, and keychain-2.db shows the database inside each UUID folder, which is handy for confirming what exists before a clean install. ⌘↵ reveals a result in Finder. It only knows file names: it cannot open or read a keychain, and neither should anything else.

Common questions

Where is the keychain file on a Mac?

Your login keychain is ~/Library/Keychains/login.keychain-db. Mac-wide items, such as saved Wi-Fi networks, live in /Library/Keychains/System.keychain.

Can I copy login.keychain-db to a new Mac?

Not as a dependable method. The file is encrypted and tied to your login password, and iCloud Keychain data sits in separate files. Use iCloud Keychain or Migration Assistant instead.

What is the difference between login.keychain-db and keychain-2.db?

The login keychain is the older file-based store for your account. The keychain-2.db file in a UUID-named folder is the newer database used by iCloud Keychain and the Passwords app.

Is it safe to delete a keychain file?

No. Deleting one throws away the passwords and certificates stored only in it. Remove individual items in the Passwords app or Keychain Access instead.