10/2/24
9:00 am

Using the Built-In Mac Password Manager

The Passwords app on your Mac allows you to create, store and recall strong unique passwords to make all of your online accounts more secure. In Safari the passwords are created and filled in later without even needing to launch the app. With the Passwords app you can view, search and edit your passwords.

You can also watch this video at YouTube (but with ads).

Video Transcript: Gary here with MacMost. Let's look at using the built-in Password Manager on your Mac. 
So macOS has had a built-in Password Manager for years but starting with macOS Sequoia you've got a stand alone App now. So the password's functionality isn't really new. It's just that previously you accessed it in Safari's settings or in System Settings. So before I even show you the app let's look at how you would normally use it say if you were creating a new password for a site in Safari. 
So, here I'm at a site. I'm going to use Archive.org as an example. I'm going to click this sign-up link. I'm going to enter an email address here and then I'm going to choose a screen name and now I've have to choose a password. Notice that when I click in the Field I get this little menu here that asks if I want to use a Strong Password. The icon here shows me the icon for the Password's App on the Mac and also a small version of the icon for this site. So I can just click here and it will insert a strong password. Now sometimes you may not see this here. It depends on how the site is constructed. But you often see this button to the right here. This is also part of the built-in Password's Manager on your Mac. So you can click this and you can choose to use a new strong password, use a new strong password without special characters so there won't be any dashes or punctuation or anything like that, or you can use an existing password that you may have already found for the site. In this case it also gives me the option to use recently generated passwords, remember I said it would remember that password even if things didn't go right on the sign-up page. Also I can fill in the password again that I just used. I'm going to select the first option here and go back and use this password. Now I'm going to sign-up.  
 Now later on when I want to sign onto the site and I go to the Login page, if I click on the ID or email address field here you'll see that it shows me that there is an entry already for this. So I can simply select that and it will fill that in and it will fill-in the password as well. Sometimes it may not fill in the password. Which is fine. You click on the password field and fill that independently. You also often get this little key icon here and use that to fill it in as well. 
That's the basic process. You can see for general usage you don't actually need to use the Password's App. It's only there if you need to access the passwords directly. 
By the way if you find my videos valuable consider joining the more than 2000 others that support MacMost at Patreon. You get exclusive content, course discounts, and more. Read about it right here. 
I'm going to launch Password's with Launchpad here. I'll just search for passwords but you can launch it with Spotlight. You can find it in the Applications Folder. You can add this to your Dock. Just launch it anyway that you normally launch apps. 
So the Password's app, when it starts off, it's locked. You just need to use your Mac account ID. Of course if you've got a Mac with Touch ID on a key you can use that as well. Now you're in the App. The app has a similar interface to some other apps like Reminders and Notes. You can see these pinned categories here on the left in the left sidebar but you can also turn off the left sidebar with this button here. Then you see a list of items. I've got All selected to show me all passwords. I can see a list of all passwords here. So I can scroll through this list and find the password I need. So say I need to log onto that site using another device or I just want to take that password and Copy and Paste it somewhere I can access them here. 
Here's that one I just created. I can click there and I can see the entry here. It will show me the user name. If I move my pointer over the password field it shows me the password. If I click here it gives me the option to Copy the password to the Clipboard. It also tells me what website it is for. This is actually one of the most important parts of any password manager. It's that the password is tied to a site. This prevents phishing attacks. So if you're sent by a text message or email to a site that looks like the right site but it's not. It's got maybe some other URL, like maybe archive.org.something else or archive spelled with a 1 instead of an i, then when you go to fill in the password it is not going to recognize that the password is for that site. 
You also get the ability to setup a verification code. So for sites that have two-factor authentication you would click here and you can use a setup key or a QR image. So a setup key usually is when you're on the site if they say you can setup two-factor authentication typically you click and they show you a QR code but also a short string that gives you a code that you can then Paste into here and then you can get two-factor authentication. 
Now you can also Edit this. So you can click Edit Here and you can edit all of these things. So, for instance, you've manually entered in a password by accident or something, you can actually put the password in here. Also there's the Notes Field. So you can add notes about this. So, for instance, maybe if you manage multiple accounts for your work you can have notes about each account saying what it is for. 
Now take another scenario. Say you already have a password for a site but you did that before you used the built-in password manager on the Mac. So in this case I'm going to log into this site. So here I'm going to enter my User Name and then I'm going to type my password. Notice it doesn't show me any of the passwords I have here. I can go to the Password's App. I suggest a new password in case this is actually a sign-up page not a log in page. But in this case Password's doesn't know my password here. So I'm going to type it in manually. Now I'm going to log in. When I do I get this dialogue here that asks if I want to save this password. I'm going to, of course, say yes. Now in the Password's App I can search for it. So I'm going to search using the Box here at the top and there it is. I'm going to select this and there you can see the password has been saved. 
Now you have other ways to get passwords in here. Of course you can click the Plus button here and you can enter in all the information manually or more likely Copy and Paste it. Now notice here it does say Website App or Label meaning you can just enter in any text you want in here. This gives us the opportunity to actually enter in miscellaneous data. For instance, I can enter in something like this or a Padlock or a Gate Code or something like that. In this case I can put the code here and then Save. Or if it is more complex information than that I can  actually go in Notes here and add a more detailed note about the information. But I do have to provide some sort of password. So enter in just some basic information or some sort of random password like it will suggest here just to fill that space if you need. Hopefully in the future they will let us actually add things that are just notes and don't have a password associated with them.
There are also other things you can access in here. For instance, those two-factor codes. You can jump right to them by clicking here and it will just show you a list of all the accounts that have two-factor codes and then what the current code is. Of course,  it is constantly changing. So you can see the code there for this login. You can also see it in the login itself. So if I go over to this here you can see it under Verification Code. Also it will ask to fill that in just like filling in the password when you're at the site. So you still don't need to go to the Password's App to access that code. Also, if you've got any Passkeys, which will work basically just like passwords in the Password Manager, they would be listed here. You would get a passkey from the site, the site would have to have a setup method for passkeys and every site does that a little differently. But once you do setup a passkey you would actually see them in this section. You'll also see Wi-Fi passwords here. So you see Wi-Fi passwords for all of the different services. You're probably going to see a lot here because every time you sign onto a service at a hotel, or a coffee shop, or something like that it is going to be added here. Even if you signup on your iPhone it's going to come over to your Mac because iCloud is sharing that information with all your devices. So you can go and  see a Wi-Fi password and you can actually get that password if you want. Click on it. Copy it. You can even show a QR code. It will show up there. So if you have a friend or something with a phone they can actually point it as your Mac screen to get that password. 
When you are in Passwords here and you do want to delete a password you can Control Click and Delete or you can go into it and edit and then delete password is at the bottom. You can Delete the password and there is a deleted section. If you go in here you'll notice that deleted item remain there for thirty days. It's a good safety net in case you accidentally deleted the wrong account or thought you were finished with an account but it turns out you need to login one last time to do something. You can Recover them from here by clicking here and then you've got a button to completely delete them right now or recover and they'll go back into the regular list. 
You also have a list of security recommendations here. There's nothing here right now. But let me force one. So I have an account here now with a password that is obviously a bad password. If I click here it will tell me this is an easily guessed password. But you'll see other warnings here as well. For instance the password is found in some sort of public database of leaked passwords. Then it will show that as well. 
Now there are some Settings here you should know about. You can turn On or Off whether it is suggesting strong passwords for you to use on websites or it's automatically creating passkeys in conjunction with the website. You can turn Off detect compromised passwords if you like. But a feature that I know a lot of people are going to love is this one: Show Passwords in Menu Bar. When you turn that On you get a Menu Bar item here that allows you to look at your passwords without even opening up the Passwords App. So you just enter in your code or use Touch ID and then you get a way to search your passwords right here in the Menu Bar. You can just bring that up and go into a password and easily get passwords. 
There are also some settings in other places. In System Settings under General you have the AutoFill and Password section here. Here you can Open passwords. You can also turn On AutoFill passwords and passkeys. This will affect apps as well as websites. So, of course, developers can create apps that actually allow you to use the Passwords App to fill in the password there. So passwords aren't just something for the Browser. They are also things that you can use in apps. You've got a settings for using Passwords, Passkeys, and Codes to AutoFill forms and you can turn that Off if you want. Also this is a handy one here. It's when you get verification codes as text messages you can have those automatically get deleted after you use them. 
Also a few other things you'll find in the App under File. Import Passwords. So if you're switching from another passwords manager you should have the ability there to Export those passwords as a CSV file. Then you can use this option to Import them into the Passwords App. You also have the ability here to Export all passwords. So you can export the passwords into a CSV file and then back them up somewhere. Another thing you can do here is create a Shared Group. So you can use this to share passwords with other people with trusted contacts or your family.
Now one of the basic ideas behind a Password Manager is to have your passwords on all your devices. So using iCloud you can have your passwords available on your Mac, your iPhone, your iPad, and so on. If you go into System Settings and then you go to iCloud one of the options here is Passwords. Then you find that your iPad and your iPhone also have a Passwords App, as long as you are on iOS or iPad OS 18 or newer. You'll see the same passwords across all of those. Create a new password on your iPhone you'll see it show up on your Mac. If you create one on your Mac you'll see it show up on your iPad. They will be all over. In addition to that you can also access them if you've got a Windows device. So you can look here in Help and you can see information on how to setup passwords on a Windows PC. It takes you to this Apple Support Page talking about the iCloud for Windows App and how you can use that there. 
Now I've already mentioned third party apps being able to use this on the Mac. But what about other browsers. Well Apple has allowed other browsers to access these just like other apps can. Now whether those other browsers choose to use that is up to them. So hopefully in the future we see all the other browsers adopt the ability to use the Passwords App in their Mac versions. But until then you do have the handy Menu Item at the top that I showed you so you can easily get your passwords to be able to fill out those log in pages on other browsers as well. Most users won't need a third party password's manager but it's okay if you want to use one. For instance you may like one because of its cross platform compatibility with android devices. You may also want to use one because, say, at work they are using one and sharing passwords with it. Also, it often doesn't hurt to use both. You can use the Passwords App and a third party Passwords Manager and when you create a new password it usually asks in both places whether or not you want to save that password and you can. So you can have your passwords in two places if you want to. 
If you're interested in how iCloud stores the Passwords and whether it is end encrypted here is Apple's Security Overview Document and you can see here that Passwords is listed and it is shown as End-To-End Encrypted for both standard data protection and if you have advanced data protection turned On. 
I hope you found this useful. Thanks for watching.

Comments: 23 Responses to “Using the Built-In Mac Password Manager”

Sheldon

6 months ago

Thanks bunches

Joel

6 months ago

Gary, as always, extremely informative and useful as it allowed me to compare Passwords with 1Password which I use. I would very much like to move from 1Password -> Passwords but will need to wait until Passwords catches up as 1Password's feature set is richer (i.e., categories (i.e., bank accounts, software licenses, and much more), third party bowsers, etc.). That said, I do hope to change in the future (depending on the accuracy of the data export / import due to the information volume).

Scott Flick

6 months ago

Excellent topic and very timely following iOS18 release. As always, great job Gary. Much appreciated.

Walt

6 months ago

Agreed on 1Password, this is the elephant in the room. Our use case is simply a large shared vault with some documents and all sort of things shared with the family. Everything is in the Apple walled garden. And I certainly don't want to be the first penguin in the water checking for seals.

Gary Rosenzweig

6 months ago

Walt: Walled garden? Lots of holes in that wall: There are extensions for Google Chrome and Edge, and the iCloud For Windows app too. Plus the app can be accessed independently to set and get passwords for other apps too. And passwords has been around for years now. The only change this year is that there is a stand-alone app you can use.

Mark

6 months ago

Gary, is the Password manager built on and including Keychain Access (such as in 10.14)? Or is Password manager now separate app split off from other Keychain Access functions? I still struggle with Keychain to cull old data, passwords, and certificates that I don't need. When I update, I don't want to bring a bunch of old useless stuff back from 2016 which might have important sounding IDs like "Apple ID Authentication".

Gary Rosenzweig

6 months ago

Mark: Keychain is the secure storage for Passwords, yes. Note that "Keychain Access" is an app, "Keychain" is the storage tech. For the vast majority of people, they don't need to use Keychain Access at all, or know it exists. It is for devs and IT pros to handle certificates, etc. The Passwords app acts like System Settings, Passwords in that you only see and handle passwords there, not that other stuff.

Nancy

6 months ago

Is there another video regarding the Security feature in the Passwords app? If not, I think this question is somewhat related tot his topic. If I get a security flag for a compromised password at a site/account I no longer use, what is your recommendation? I think the best thing to do is delete the password from the password app? Do you agree?

Nancy

6 months ago

Regarding the sharing of passwords with a family member and that family member happens to have a password at the same site/account? Will the password app automatically be able to determine which user name and password should be autofilled? Or will it prompt the user to select which one and will the prompt indicate which family member it belongs to?

Gary Rosenzweig

6 months ago

Nancy: I talk about it here, but not planning to do a video specifically on that. In general, the messages are self-explanatory. In that case if you really no longer use that site, then just delete that password item since you don't need it anymore. In some cases, you may want to go to that site and close the account too. Depends on what it is, really. Might as well get your personal info (even if it is just your email address) off the site.

Gary Rosenzweig

6 months ago

Nancy: It would be the same as if they had two accounts there of their own (or more). They would be able to select which login they wanted to use.

Richard

6 months ago

Hi Gary, thanks so much for this helpful video.

I like to keep a simple user password so I don't have to do a lot of typing, but of course I would like a really strong password for the Passwords app. Is there any way to do this?

Bert Mullemeister

6 months ago

Hi Gary, two comments/questions: 1 If I got the generated password while using Safari, what happens if I use Firefox and select a favourite.....will it use that password. 2 I understand you can only change the password from a particular app by going to that app and change there. Thanks in anticipation

Gary Rosenzweig

6 months ago

Richard: No. The deal is that if your account password is weak, then everything is weak. After all, how hard would it be to simply go to an online account and simply request a password rest via email for things? If you can check your email (or messages) you can get access to most things. So make a strong password for your account. Being realistic, it doesn't have to be long, but should be random. Remember, an account password is different than an online password in that someone needs physical access. So backing off from 16 characters a bit is ok.

Gary Rosenzweig

6 months ago

Bert: Until there is an extension for Firefox for Passwords, or Firefox builds it in to the Mac version, you would use the Passwords app or the Passwords Menu Bar item to get the password. Or, you could use a second password manager at the same time, which is fine.

Richard

6 months ago

Good advice as usual, Gary. Thanks very much for your reply.

Howard Brazee

6 months ago

I use Brave as my browser and can't get anything to come up. I can cut and paste from the backup app. My wife uses Safari, but she has troubles getting her iMac to read her fingerprint. I'd really love to get rid of LastPass.

Gary Rosenzweig

6 months ago

Howard: It wouldn't work in Brave unless there is an extension for Brave or they add it into Brave (unlikely).

jun

6 months ago

Thanks as always Gary. I do use it although rarely nowadays. My feeling is that of course I don't have trust issue as we all know Apple is one of those co. really serious about security etc. and I don't care much about using it on Windows or android, but what I care is it still is very simplistic compared to other players. It's quite nice to see that it has comeup with specific app instead of mind boggling hunting into that keychain access. I hope it will make it feature rich in future. Thanks.

Joost Dr. Norbert

3 days ago

To remember a secure password is not easy. Why doesn’t apple offer a passkey instead, as for instance Amazon does.

Gary Rosenzweig

3 days ago

Joost: Apple does. The Passwords app handles passkeys. If the site you are logging into offers it, the Passwords app will save it and use it.

Harold Appel

3 days ago

I would like to import passwords from a 3rd party app in the macOS Passwords but this will, apparently create many duplicates. Is there any way to avoid this or remove the duplicates after importing (other than laboriously deleting them one by one)? Thanks as usual. So helpful.

Gary Rosenzweig

3 days ago

Harold: I don't think so. I'm not sure you want it to decide what to keep and what to remove anyway. But I think either way you will have some cleaning up to do. Or, alternatively, don't bother to clean it up as there's no actual need to do so.