Your Mac has a low-level secret-managing system called Keychain, which is covered more fully in where Apple stores your passwords and passkeys. Keychain contains passwords for lots of different things that need to be both available on demand and secured against unauthorized access. This includes passwords to log in to apps and Wi-Fi networks, passkeys for websites at which you’ve enrolled to use them, credentials for local network servers, encryption certificates, and other important information your Mac needs to function securely.

If you sync Passwords with iCloud, Keychain also contains credentials for websites where you have accounts and may include your credit card details, separate from the stored Apple Pay payment card information on Macs with Touch ID or an Apple silicon Mac paired with a Magic Keyboard with Touch ID.

Because this information is valuable and potentially sensitive, a Mac encrypts the contents of your keychain. However, whenever your Keychain is unlocked, your credentials can be passed to apps, websites, and network services without any intervention on your part.

And how do you unlock your keychain? That’s the wild part: all you have to do is log in to your Mac’s user account. And—as covered in what launches on your Mac—another default setting is to log you in to your account automatically.

As noted earlier, if you have FileVault enabled, you can’t log in automatically. However, after you manually log in, you’re in the same boat as anyone else. See how to turn on FileVault.

In other words, unless you take steps to change the defaults, merely turning on your Mac might unlock your keychain!

Anyone else who might have physical access to your Mac could then log in to all your web accounts (like your bank, Amazon, or PayPal), file servers, and other resources where you’ve saved credentials (like Music or the App Store).

There are a few bright spots:

• No one can see the actual keychain entry’s secure text without knowing your macOS account login password.
• Within Safari, an unwanted party can’t get a list of all the sites at which you have passwords stored from Safari, Keychain, or the Passwords app without your password.
• Even when a password is autofilled in Safari or in an app, there’s typically no way to copy the password to view it as text.
• Macs with active Touch ID hardware and password autofill enabled will drop in your password only when you use a valid fingerprint or enter your password (System Settings > Touch ID & Password > “Use Touch ID for autofilling passwords”).

Touch ID can be built in, as with a laptop model, or for an Apple silicon Mac, provided via a paired Magic Keyboard with Touch ID. See how to set up Touch ID and Face ID.

Yet the storm cloud lingers: someone can use all your passwords when the conditions above aren’t true. These actions will help prevent that:

• Leave FileVault enabled: Because FileVault is a high-value way to prevent power-up access to your computer, most people should leave it enabled, and it is on by default starting in macOS 26. Some people may find it more trouble than the potential of losing access to their files; see how to turn on FileVault for both sides.
• Turn off automatic login, if you don’t have FileVault enabled: See what launches on your Mac for how to disable it.
• Enable Touch ID and AutoFill: This blocks access to autofilled passwords without your fingerprint or password.
• Lock your Mac after a duration: See the Mac settings worth changing.

Lock the keychain separately

For most people, setting their Mac to lock when it sleeps, when the display is off, or after a screen-saver duration has passed, as described in the Mac settings worth changing, is enough. But macOS also lets you lock the keychain after a set period, even if your Mac remains unlocked.

First, open Keychain Access, located at /System/Library/CoreServices/Applications. Click Open Keychain Access at the prompt.

Select your login keychain, and choose Edit > Change Settings for Keychain “login”. You can select “Lock after X minutes of inactivity,” pick a time delay, and click Save. (The “Lock when sleeping” option makes little sense—you should set your Mac to lock when sleeping, as that locks the Keychain and your session.)

Note that you can only change settings for the login keychain and your custom keychains, if any. You cannot change these settings for the System, System Roots, or iCloud (if enabled).

The basic idea of a sandbox is that an app has restrictions that define where it can read and write data, as well as the kinds of inputs and outputs it can monitor or make use of. It has to “keep its sand in the sandbox”: it can’t see or touch files anywhere outside its designated space, or listen to mics, view video, or capture keystrokes without explicit permission that you give it when prompted or that you configure to allow.

Apple rarely uses the term sandboxing in end-user materials, though they employ the concept all over.

The intention is to prevent buggy, corrupted, or malicious apps from messing with data and files from other apps or macOS itself. It has the additional benefit of limiting legitimate software from accessing personal information and inputs that you don’t think it needs to.

There are three kinds of sandboxing in macOS. The oldest affects apps as a whole.

App sandboxing

Available since Mac OS X 10.7.5 Lion, macOS’s app sandboxing restricts the kind of behavior apps can engage in outside their bounds—particularly their own set of data and caches.

Suppose you visit a rogue website in Safari that attempts to execute some dastardly code through an exploit someone has discovered in JavaScript, the popular programming language that powers web apps. Because Safari runs in a sandbox, that malicious code can’t affect other files: it can’t read your contacts, delete system files, add a startup item, or do any other mischief outside the browser window without your permission.

System files are additionally protected in yet another kind of sandbox. See how macOS protects its own system files.

Apps downloaded from the Mac App Store must be sandboxed (with some exceptions for older apps). In addition, Apple apps included with macOS are sandboxed, and so are many third-party apps available directly from their developers. (That’s usually because they also offer the apps in the App Store and don’t want to create two entirely different versions.)

But nothing in the design of macOS (at least, not yet) prevents you as a user from running a non-sandboxed app if you want to. Unless you get an app from the App Store or the developer tells you the app is sandboxed you have no easy way to know.

Sandboxed apps can read and write files in non-default places if you agree to let them do so. You’re prompted when you try to access a new location, and have to give simple permission: a click, not a password. That’s then remembered by macOS from then on. (Under certain rare circumstances, you might have to reauthorize an app.)

You can’t turn off sandboxing or adjust its settings. All you can really do is be alert—if an app asks for access to a folder you don’t think it should be using, that’s because the folder isn’t currently within its sandbox. Think carefully before saying yes—if it’s unexpected, the app could be trying to do something it shouldn’t.

Camera and microphone permission

Since Mojave, macOS asks you questions when an app or other software tries to use audio input or video cameras for the first time.

This was added to prevent potential snooping by malicious software, by having a deeply wired system opt-in requirement. It’s one thing for a malware developer to hack into your camera through software that runs with user-level permissions; it’s another for them to subvert the system and block the warning.

A lot of security and privacy companies offer A/V input features in their anti-malware software or standalone apps, some with more granularity (like “allow for an hour”) and a different workflow for detection. The free OverSight app from security researcher Patrick Wardle is a great place to start (along with all his other apps).

Apps don’t have to do anything special to request access. If it hasn’t been granted access, the first time an app attempts to use a camera, mic, or other audio input, macOS prompts you to approve it or not. If the app wants to bypass Apple’s built-in system, as with Zoom, you see a more severe warning about what it could access.

Once approved, manage access for apps and other components via System Settings > Privacy & Security. In some cases, deselecting an item results in a prompt to choose to quit and restart the app you changed settings for and offers Later as the other option.

Notebook Macs have a hardware disconnect switch that cuts off mic input when the lid is closed, too.

Some apps may have multiple entries in the list: one is for the user-facing app you launch and another for helper software that runs in the background.

Apps may respond differently if you deselect mic or camera permission. Some may not recognize they lack access and crash or behave erratically. Others test for access and prompt, such as Zoom after I allowed and then disabled camera access.

To let you know when certain inputs are in use, Control Center briefly displays a message showing recent use of your mic or camera. Click to reveal Control Center, and you’ll see a mic or camera icon followed by an app name, sometimes followed by “recently” if it’s active or was just active. The status message disappears quickly.

Any use of video, audio, or screen control/screen sharing lights up a colored icon in the menu bar—a green video icon, an orange mic icon, or a purple screen use icon—that indicates active or recent usage. Click the menu to reveal available specialty options for camera and mic effects, like Studio Light for your video or Voice Isolation for your mic, or to see what app is making use of your screen. (I’ve even seen two screen use icons: one for the Screen Sharing app and one for general screen-recording.)

Folder permission

In addition to app-based and A/V input sandboxing discussed above and personal-data privacy controls discussed just below, Apple uses sandboxing for all apps, which requires your permission for them to access certain folders. These locations include:

• The Desktop, Documents, and Downloads folders in your account
• Your iCloud Drive access
• Cloud storage from third parties that appears via Finder-accessible folders, like Dropbox and Google Drive
• Network volumes and removable volumes, each as a separate category of permission

The idea is that it’s suspicious if an arbitrary app needed to read from, much less write to, any of these locations without your explicit knowledge and permission. This can also help subvert ransomware, which tries to access important files wherever they are stored.

Whenever an app first tries to access items in any of these locations, your Mac prompts you to ensure you want to allow it.

If you use an external startup drive, you will see this message frequently. Every time an app wants to save a file on the startup volume, a Mac prompts for permission. By design, Apple prevents apps from saving to external volumes without a grant of permission.

As with mic and camera input, you can view and revoke permissions in System Settings > Privacy & Security: select Files and Folders and scroll to find the app.

Once you grant permission, you can only disable it—you can’t remove it from the list. The only way to remove an app from the list is to empty the list entirely using the command-line utility tccutil. It’s rare you would need to do this.

While macOS is a friendly operating system, it’s all Unix under the hood, which means it runs by partitioning access to files and apps by users and groups, selectively providing permission based on who you are and what groups you belong to.

If your Mac has only one user—you!—it’s all very simple, because you don’t need to secure yourself from yourself. However, you still need the following information, as it relates to how you manage a single-user Mac, too.

There are several important principles about user accounts, and how private your files really are covers the other side of the same question:

• There are four main types of Mac user accounts: administrator, standard, guest user, and sharing-only. Of these, administrator and standard are by far the most common. The usual reason to have more than one account is so that each person who uses a particular Mac can have a separate space for files and settings. But accounts can also be used to restrict access to certain files or resources in order to improve your security.
• Every Mac needs at least one administrator account. When you set up a new Mac or perform a clean installation of macOS, you’ll be prompted to create an administrator account before you can do anything else. That’s because only administrators can perform certain crucial tasks (see the next bullet point). You can have more than one administrator account, and in fact, it isn’t a bad idea to set up an extra one to use for testing and troubleshooting.

When something fails for me on one account, such as a software app or Safari extension, I often log in to a second administrator account on the same Mac to determine whether it’s a problem with my account or the software—or the whole Mac.

• Administrator accounts are all-powerful. Administrators can create, modify, and delete other user accounts. They can unlock any pane of System Settings, and authorize any type of software installation. They can (with a quick trip to the Terminal utility) open any file on the Mac, belonging to any user—and can change any non–system file’s permissions. They can upgrade macOS to a new version. The list goes on and on.
• Standard accounts can do most ordinary things. Standard users can run apps, work with files, and perform most ordinary day-to-day tasks. When a user with a standard account tries to do something that only an administrator is allowed to do, simply entering an administrator’s username and password (or having an administrator do so) does the trick—there’s no need to log out or switch accounts first.
• Apps get their privileges from the user who opens them. If someone with a standard account launches an app, that app can access only the files and folders available to that user. If someone with an administrator account launches an app, that app has more expansive access to files on the Mac, although sandboxing limits that scope somewhat; see how to control which apps use your Mac camera and files. A malicious or compromised app launched by someone with an administrator account might be able to do serious damage across the Mac.

You can create as many user accounts as you need, and switch between them easily. To keep your Mac secure, you should make sure you have the right number and types of accounts, as below.

Set up a standard account for others

A standard account has permission mostly to affect files and applications installed within the Home > Username folder. It’s the right kind of account to set up for people using a Mac who aren’t sophisticated users, don’t need system-level access or the ability to install apps for all users, or shouldn’t be given the same level of trust on a shared computer as its owner or administrator.

At one point many Mac experts recommended a standard account for day-to-day use even by its main user or owner, and to use the credentials for an administrator account only when you’re installing software or engaged in other tasks that require access to the depths of your system.

However, macOS has changed significantly over the last several years. System files are now locked down and can’t be accidentally deleted or overwritten. Many actions you take require a Touch ID or password confirmation. To be frank: I’ve never used a standard account as my regular login, and I don’t see a reason for anyone else to do so at this juncture, either. (I have great backups that I can fall back on if I do anything epically poorly thought out.)

If your main account is currently an administrator account but you want to make it a standard account, you can create a new administrator account (for occasional use only) and then remove the administrative privileges from your main account.

1. Go to System Settings > Users & Groups.
2. Click the Add User button.
3. Enter your password if prompted.
4. Choose Administrator from the New User pop-up menu.
5. Fill in the fields for Full Name and Account Name (that is, a short username, such as your initials). They can be anything you like, but they must be different from those used for other accounts on your Mac. Every account, especially an administrator account, should have a password that is both strong and unique.
6. Create a strong password and enter it in the Password and Verify fields; optionally enter a password hint.
7. Click Create User. If you had automatic login enabled, an alert appears, asking if you want to keep it on or turn it off. Click Turn Off Automatic Login. (This won’t appear with FileVault enabled.)
8. Choose Apple menu > Log Out Username to log out of your old administrator account.
9. Select or enter the name of the new administrator account you just created, enter its password, and click the arrow button or press Return.
10. Once again, go to System Settings > Users & Groups.
11. Click the info button next to the old administrator account, then use the credentials for your new administrator account to authenticate.
12. Deselect or disable “Allow this user to administer this computer”; this turns your erstwhile administrator account into a standard account. An alert appears, claiming that you must restart for the changes to take effect. That’s not entirely true (you need only log out), but click OK anyway.
13. Choose Apple menu > Log Out username, then log in to your old account, now a standard one, with your password.

At this point, you may be prompted to enter the Apple Account for the new account. Since this administrator account will be for occasional use only, I suggest selecting the Don’t Sign In radio button, clicking Continue, and then confirming by clicking Skip again. If it turns out you need iCloud services with your new administrator account, you can always set them up later.

Screen Time for a child account

Screen Time is Apple’s cross-device, Apple Account-linked system for monitoring device usage and, for kids and other people one serves as a guardian for, controlling access. You can use Screen Time to track your behavior and set alerts about limits.

Screen Time isn’t strictly a security feature, and Apple overhauled it in the 27 releases; the parental controls are covered separately.

Set up a guest account

As long as you’re making changes in Users & Groups, you should think about whether you want to have a guest user account. It’s enabled by default starting way back in Yosemite. That’s usually a good idea, but if it doesn’t suit your needs, you can disable it.

With a guest user account enabled, you have a spare—and, importantly, non-administrator—account that anyone can log in to without a password. When logged in, they can run apps installed for all users, browse the web, or perform any other task that doesn’t require saving private information to disk permanently. (Guest users can, however, save data to publicly shared locations.)

If you prefer to not have a guest account, you can also restart your computer in recovery mode and choose Safari as an option. This lets a guest use Safari with zero access to locally stored files. See how macOS protects its own system files.

As soon as the guest logs out, macOS deletes the guest’s temporary home folder, leaving everything just as it was beforehand. If you ever need to give someone temporary access to your computer, using the guest account is simpler than having to set up and later delete a conventional account for that person, and more secure than letting them use your account.

If you have FileVault enabled, the Guest user can access only Safari.

1. Go to System Settings > Users & Groups.
2. Click the info button to the right of the Guest User entry.
3. Enter your administrator password if prompted.
4. Enable or disable “Allow guests to log in to this computer”.

With guest access enabled, you can optionally select either or both of the following checkboxes in the Guest User settings:

• Limit adult websites: Apple blocks risqué-and-beyond sites.
• Allow guest users to connect to shared folders: This doesn’t affect the way someone logged in as a guest can access shared folders on this Mac, as you might expect. Rather, when selected, people on other devices on the network can connect to this Mac’s shared folders without supplying a username and password.

Give every user their own account

If you’re the only person who uses your Mac, you can skip this topic. But if you share your Mac with family members, coworkers, or friends, do yourself—and them—a favor and create a separate (standard) account for each person. And then, insist that everyone log in to their user-specific accounts when using the Mac. That way, any damage (accidentally deleted files, changed preferences, and so on) will be restricted to that user’s space and not affect the entire Mac.

To enable switching from one user to another without having to log out (and thus quit all your apps):

1. Click the Control Center button.
2. Click Edit Controls.
3. Enter “fast” in the search field.
4. Click the Fast User Switching icon.
5. Choose either Add to Control Center or Add to Menu Bar. You can choose one and then the other.

If you add it to Control Center, you can drag to put it where you want among other controls.

To switch users, access the list of users by clicking the account button, account name, or full name from the menu bar or opening Control Center and clicking the Fast User Switching control. Choose the name of the user you want to log in as. That list also includes Login Window: select it to drop into the Login Window screen.

We are all fallible, and the way of all flesh is to age—and sometimes we forget things. I can’t tell you how many times I have “forgotten” a password because I try to remember it, but fortunately I then try to use my fingers to type it, and they “remember” it for me.

If you can’t log in to your main account on your Mac because the password isn’t accepted, you have several options.

Resetting your password on a Mac locks your login keychain, because it’s permanently locked to the account password; see how the Mac keychain works. As a result, you will lose access to locally stored entries, and may have to reset or create a new login keychain manually.

If you forgot the password, try another account

Is there another account you’ve created and can log in to, or another user on the Mac with administrator access? Log in to that administrator account, then go to System Settings > Users & Groups and unlock the pane.

Select your locked-out account and click Reset Password. Now enter and verify the password, adding a hint if you want, and click Change Password. Log out, or use Fast User Switching, then log in to your account with that password.

Reset with the FileVault Recovery Key

FileVault recovery begins when you power on or restart your computer (see how to turn on FileVault). The process takes place using Recovery Assistant. Here’s what to do:

“Apple Account or recovery key” means something different starting in Tahoe than it used to. With Tahoe and Golden Gate, you can either enter the recovery key directly after restarting, or use another of your devices that is also logged in to the same Apple Account to retrieve the recovery key from Passwords. You can no longer use an Apple Account to trigger a macOS password reset if FileVault is enabled.

1. Go to the login window. To get there, restart your Mac or choose Apple menu > Log Out Account Name.
2. In the login window, select an account if one isn’t already selected. Then click the question-mark button to the right of the password field.
3. Click the right-pointing arrow button to restart.
4. After your Mac restarts, you see the Reset Password utility as the primary screen. This is a special restart mode that doesn’t let you exit into macOS Recovery. Enter your Recovery Key — you can type it in lowercase without dashes, and the utility adds them — then click Next.
5. If accepted, you’re asked to enter a new password with a hint, and then verify it. Click Reset Password and Verify Password.
6. Your Mac restarts. Log in with your account and the new password.

If you have upgraded to Tahoe through version 26.3 and have your FileVault Recovery Key stored in your iCloud account, I recommend resetting the key to provide better access to it across your devices, among other advantages. See where to find your FileVault Recovery Key. If you’ve updated to 26.4 or Golden Gate, Apple already made you do this!

Reset via Activation Lock

On Macs with a Secure Enclave coprocessor without FileVault enabled, you can use your Apple Account to reset your password through Activation Lock. Here’s how:

1. Follow steps 1 to 3 above.
2. Your Mac restarts and displays an Activation Lock login, showing part of your associated Apple Account. Enter your account name, click Next, then enter the password and click Next.
3. If successful, a screen appears that notes “Authentication succeeded.” If not, work through the first three steps again.
4. Click Exit to Recovery Utilities.
5. Choose Utilities > Terminal.
6. Type resetpassword and press Return. This opens the Reset Password utility.
7. Select “I forgot my password” and click Next.
8. Create a new password as above: enter, verify, and add a hint. Click Reset Password. Your Mac restarts.
9. Log in with your account and the new password.

This process is also how you reactivate a Mac if it’s been set as lost in Find My.

Reset from recovery mode

There’s a command-line password reset utility available in recovery mode, also, which you can use without having to know the administrator password. Here’s how to reset your password on an Apple silicon Mac:

1. Choose Apple menu > Shut Down. When your Mac has powered down, hold the power button until you see a prompt that says “Loading startup options.”
2. Click Options.
3. Click “Forgot all passwords?”
4. Choose Utilities > Terminal.
5. Type resetpassword and press Return. This opens the Reset Password utility, but without the prompt for a Recovery Key.
6. Select “I forgot my password” and click Next.
7. Create a new password as above: enter, verify, and add a hint. Click Reset Password. Your Mac restarts.
8. Log in with your account and the new password.