Apple builds in a huge array of tools that help if your device is physically compromised, as when someone gains access to your iPhone or computer without your permission, someone takes your device away without your knowledge or steals it in order to try to break into it, or when someone extracts hardware (like a drive) from your Mac.

Apple created the chip-based Secure Enclave technology for iPhones and iPads, then expanded it for Macs starting with Intel models. It’s an integral part of Apple silicon Macs. Secure Enclave was a big improvement for device security and data integrity.

Apple created the Secure Enclave coprocessor, first for the iPhone, as a way to provide a tamper-resistant one-way vault to handle encryption secrets, biometric information, and many kinds of private data. The design of the Secure Enclave prevents Apple from accessing information inside it, so the chip that contains it can’t be removed or manipulated without almost always destroying its contents.

Technically, the Secure Enclave is a component of a system-on-chip (SoC), a single piece of silicon that integrates all the functions that previously required separate silicon, such as a CPU, memory, and various I/O chips.

The Secure Enclave coprocessor is part of all Apple silicon Macs. It’s also found in Intel Macs with the T1 chip (for the Touch Bar) or T2 Security Chip; Apple’s support site lists the starting models. All Macs that can run Sonoma or later have a Secure Enclave. You can install macOS 26 Tahoe on all Apple silicon Macs, but only the last series of Intel models support it; macOS 27 Golden Gate works only on Apple silicon Macs. (Most Macs with a Secure Enclave can run macOS 14 Sonoma or later, but fewer work with Tahoe.)

All iPhones from the iPhone 5s onward have it, as do all iPad models introduced since the iPad Air in 2013.

Not surprisingly, Apple’s other devices with its A-series mobile chips also have a Secure Enclave: the Apple TV (HD and later), Apple Watch (all models), and HomePod (all models).

The Secure Enclave is used for a number of different purposes, some of which are directly relevant to this chapter:

• Touch ID/Face ID: Fingerprints are enrolled and stored securely within, and logins send patterns to the Secure Enclave to match.

Note: The Magic Keyboard with Touch ID enables fingerprint recognition on Apple silicon Macs by pairing directly with the Secure Enclave in a proprietary secure wireless process.

• SSD encryption: All iPhones and iPads with a Secure Enclave encrypt all data stored on their invisible “startup volume.” All Macs with a T2 chip or Apple silicon processor have an internal SSD startup volume, and that volume has always-on, hardware-based disk encryption.
• Storage of encryption keys: Apple uses the Secure Enclave to keep the raw stuff of encryption unavailable to anyone—even Apple. Developers can also make use of the Secure Enclave for keys they want their apps to store.
• Boot integrity (Mac): The Secure Enclave has some hardcoded information that prevents subverting a Mac when it starts up. Startup is a bootstrap process, like “pulling oneself up by one’s bootstraps.” Little bits of software get more complicated pieces of software running in a cascade until the OS is running. With the Secure Enclave, the first stage is loaded from read-only memory—instructions burned permanently into silicon—and each subsequent stage relies on encrypted validation to avoid hijacking.

Secure Enclave has no management associated with it that you have access to. It’s just neatly there carrying out cryptographic and validation operations behind the scenes.

Memory Integrity Enforcement

Starting with A19- and M5-family devices—the iPhone 17, iPhone Air, and M5-based Macs—Apple built in an extra tier of exploit protection called Memory Integrity Enforcement (MIE). Because of Apple’s system architecture and security focus, they have avoided large-scale malware attacks on their platforms that have plagued other companies. Generally, most of us are safe nearly all of the time from all but phishing attacks.

But it doesn’t mean your devices are immune! Smart companies look at the edges to see what’s missing to fill in the picture, and that’s what MIE does, although this may never have an impact on you. MIE is designed to block particular kinds of “mercenary spyware,” as Apple terms it: products designed to execute against specific targets, developed by companies and sold to governments, or created inside government agencies.

For a computing device to run software, the software must be loaded into memory. From memory, the operating system executes code, which carries out operations, including reading from and writing to memory, a video display, external storage, a network, and more. Memory is divided by the system into what used to be logical chunks—that is, the operating system defined these, but there wasn’t a particular prohibition against software writing in any place in memory. Some parts of memory help the operating system; some are drivers or code that manage interactions with hardware; and some are designed for user space, meant for user-loaded programs and data.

Over decades, that’s changed, where the operating system and hardware restrict how different components of a system and loaded software can write to memory. These restrictions have increasingly reduced the attack surface of malware by making it harder for an attacker to circumvent the operating system and run code where they want.

MIE blocks a common form of exploit, in which an attacker pushes more information into a response or request than the code executing it can handle. This can result in a buffer overflow, in which data spills past the end of the chunk of memory set aside for it and corrupts whatever sits alongside (typically values and pointers that other parts of the program rely on). Attackers use that corruption as a foothold to read secrets or take control of the program.

With MIE, these buffer overflows are blocked at the hardware level: every allocation of memory is marked with a secret tag. Malware can’t write into adjacent allocations because those carry a different tag, and the processor refuses at a hardware level to let data be written there, which stops the app from running. MIE also blocks attempts to read or write the same memory locations after an app releases them for other uses, because those locations receive a fresh tag or tags when they’re reallocated; this foils “use-after-free” exploits.

Apple spent years testing this solution and evaluated it against six real-world exploit chains, or sequences of exploited vulnerabilities strung together to gain control or access information that had previously been used against their platforms. Components of MIE blocked all of them. Apple says they couldn’t rebuild any of the chains to get around MIE, even by swapping in new exploits.

Security researchers reported in May 2026 that they had been able to work around MIE in macOS 26.4.1, and disclosed their findings to Apple.

Now, you will likely never be attacked by top-tier criminals or a government’s security agency. (See whether you need more security than Apple’s defaults; and if you are a target, see Lockdown Mode.) These exploit chains previously cost millions to develop and, if created by companies, were sold for huge sums to governments, which deployed them against high-value targets.

Nonetheless, by making such chains far more expensive to build and maintain, MIE reduces the odds that these techniques would ever trickle down to become attacks aimed at the rest of us.

Password lockout protections

On an iPhone, iPad, or Mac with a Secure Enclave, you can’t keep entering an incorrect password without the system taking notice and action. Or, more particularly, someone trying to break into your device cannot try over and over.

After your device has started up and reached a point at which you can enter an account password or passcode, and that secret is repeatedly entered incorrectly, Apple enforces certain limits and timeouts.

An iPhone, iPad, Mac, and even Apple Watch have the same initial timeout and lockout sequence. You can enter your password incorrectly at the login window or passcode entry field up to four times in a row without a delay between entries. However, after the fourth try, Apple adds a one-minute delay before you can try again. After the fifth, five minutes; after the sixth, 15 minutes; seventh, 1 hour; eighth, 3 hours; and ninth, 8 hours. If your tenth password entry fails, the path splits, as described below. Restarting a device doesn’t reduce the time you wait.

If you enabled the erase option on an iPhone or iPad, after the tenth attempt, the device is wiped. However, Apple notes that “consecutive attempts of the same incorrect password don’t count toward the limit.”

With an iPhone, iPad, or Apple Watch, you have to connect to another device: an iPhone or iPad to a Mac or Windows system; an Apple Watch to an iPhone. The device can’t be unlocked, but can be erased and restored.

With macOS, however, Apple provides up to 40 (yes, 40!) additional login attempts through other means to ensure you have the greatest possible options before permanent lockout:

• Restart in recovery mode (see how macOS protects its own system files). You can try up to 10 times to enter a correct password for a login account after clicking the Options button.
• If that fails, you have 10 attempts each for:
  • iCloud recovery
  • FileVault recovery
  • Use of an institutional key, if your Mac is managed by a company

If all of the above fails, Secure Enclave locks the volume: it will no longer process any effort to decrypt your startup volume or verify a password you enter. The drive’s data is unrecoverable. The Mac has to be erased and a new system installed to use it again.

The topic of passwords is huge. The key security aspect is narrower: how you secure them.

Apple devices can store and sync passwords in many ways, each with a different risk profile. What follows is how Apple and third-party apps store passwords, and the gold standard for syncing them among devices without increasing the likelihood they could be accessed—even by the company storing them for you.

Apple added passkeys in 2022, a more secure method of logging into a website without leaking secrets and while offering phishing resistance. You use them in lieu of a password plus a second factor, as they combine the same functions. Apple has integrated passkeys into their overall password-management and fill-in approach.

Starting in Sonoma and iOS 17/iPadOS 17, you can also create sharing groups with other people that include both passwords and passkeys. This solves an issue where you may share account access with family members or colleagues but still want the security of a passkey. (This is managed through the Passwords app.)

Apple lets you log in with a passkey to your account on their Apple Account website. This was added to let you log in securely when you weren’t able to use either Touch ID/Face ID or two-factor authentication. For instance, if you’re using a browser on someone else’s Mac and don’t want to enter the password, or you’re connecting via a Google browser on an Android phone.

Apple’s Passwords app can generate a verification code required for login with many two-factor authentication systems and store it as part of a website password entry. Not Apple’s, of course, just all the others.

Hardware security keys

In early 2023, Apple also added direct support for Apple Account logins on devices and their Apple Account website using a standard closely related to passkeys that stores unique login information on a removable hardware security key. These hardware security keys incorporate industry standards, making them compatible across mobile devices and desktop computers, as well as working with websites and native support built into operating systems.

Hardware security keys have to be activated, whether you’re using them with your Apple Account or on a website (Apple’s or anyone’s). On your Mac, iPhone, or iPad, you insert a key into a port (USB Type A, USB-C, or Lightning) or, with an iPhone or iPad, bring a key with NFC near your device. You then press a trigger on the key to start the interaction.

Hardware security keys are obviously physical items you need to exercise distinct precautions around. Their contents are one-way vaults, much like the Secure Enclave in Apple hardware, and can’t be backed up. Make sure you have safeguards in place to avoid losing or damaging them, and to ensure they’re not stolen. Treat them like a stack of $100 bills.

Apple requires two hardware security keys to enroll in that method for your Apple Account, for just that reason. If one is broken or lost, hey, you have a second. You can enroll more than two.

Where your secrets reside

Starting with iOS 18, iPadOS 18, and macOS 15 Sequoia, Apple made the Passwords app the primary built-in interface for accessing secrets, whether website logins or app passwords. Previously, Apple had a Settings section for Passwords in iOS and iPadOS, and a Passwords tab in Safari for macOS.

Even earlier, Apple steered you to Keychain Access, a utility that still exists, and which provides lower-level access to all manner of passwords, codes, secrets, and certificates managed on your Mac. See how the Mac keychain works. There’s no iOS/iPadOS equivalent.

On an iPhone, iPad, or Mac, you can enable Passwords via iCloud settings, which syncs all your app-based passwords and website logins across all the devices you own that are also logged in to the same iCloud account and have Passwords sync enabled.

Go to System Settings/Settings > Account Name > iCloud and choose Passwords or Passwords and Keychain. Enable “Sync this Device type.”

iOS and iPad app passwords use a mapping that associates them with a website, which can cause problems when you signed up in an app or at a website and then try to log in at the other entry point. The website address might not match the one provided by the app, or the app might not incorporate the right website domain. For instance, the website might use login.example.com while the app points to api.example.com.

You have two options to work around this when it happens. First, you can tap or click Passwords, then search for the domain, app, or site, and select the password entry. You’ll be warned about filling in the password. The better path is to open Passwords, find the entry, select it, tap or click Edit, tap or click Websites, then enter variants on the domain.

Browsers other than Safari have their own password storage systems for local storage and syncing. For example, Google Chrome can sync across all your apps linked to the same Google account and makes passwords available through a web-based password manager, which I have more to say about below. (Apple lets you use iCloud Passwords synced items with Chrome by installing an extension, described later.)

Third-party password managers are a boon for people who work across ecosystems or have more nuanced needs to share passwords and other kinds of data securely. Some offer Android, Windows, and Apple apps, plus browser-based access, and let you set up multiple shared secure vaults or storage areas with different sets of people. These third-party systems also have native plugins for Safari and other browsers.

How your secrets are secured

It’s important to know how password vaults manage the encryption and security of your data, but it can also be a bottomless well of detail. In the following entries, I explain, from a top-level view, how Apple manages these aspects for the Apple Keychain and for Passwords synced via iCloud, how other well-designed password managers do the same, and Google’s shortcomings in that regard.

Local passwords and passkeys

On an iPhone, iPad, or Mac, passwords and passkeys are stored in a system keychain. This is invisible to iPhone and iPad users, but you can view that secure information on a Mac via the Keychain Access app. When you enter your account password or device passcode, the keychain is unlocked for use across the device, though Apple requires biometric or password/passcode authentication to apply passwords for most logins even after that.

When you launch Keychain Access, Apple shows a dialog that says, “Manage Your Passwords in the new Passwords App.” You can then click Open Passwords (highlighted in blue) or Open Keychain Access. If you never want to be prompted again, check “Do not show this message again.”

Passkeys are stored in the keychain, but you can’t view their contents—only that you created them—because they’re based on long sequences of digits that form encryption keys meant to be kept strictly private; even displaying them reduces your security. A Mac makes a passkey available when required to log in to a website. Other browsers and apps that incorporate webpage views can also tap into Apple’s system framework to securely use passkeys.

In the Passwords app, you can view passkeys in their own category, although the entry also includes the login information used when you enrolled, such as username and password.

If you have a website login with a password, initially set up with two-factor code-based verification and then transitioned to a passkey, all those elements appear in a single Passwords manager entry.

You’ll also notice that, if you use Google Chrome in Sonoma or later, the browser opens its own compatible passkey validation system for Google account logins.

Keychain data on its own never leaves your machine, and when backed up, the associated files are encrypted. Locally stored keychain entries are backed up by full-disk encryption on all Apple silicon Macs. Your device passwords and passcodes are the only real weak points.

Apple and the rest of the industry agreed on a standard for passkeys, and also agreed to make passkeys securely exchangeable among ecosystems. Well, the first part was true first; the second took years to emerge, finally becoming a reality in 2025 with the version 26 operating systems. With 1Password, Bitwarden, or Dashlane installed, you can move passkeys (and other passwords) between them and Passwords; with two or more installed, they can transfer between each other.

iCloud Keychain for synced data

iCloud relies on endpoint security with locally stored encryption keys that never leave your Mac, iPhone, or iPad. Data is encrypted in transit, and the strongly encrypted data when synced or stored in iCloud is useless without these device-based keys, which are stored in the Secure Enclave on any hardware that has one.

With two-factor authentication (2FA) enabled on your iCloud account—more or less mandatory these days—it’s effectively impossible for someone in most circumstances to gain access to your synced and stored Passwords entries. They would need all three of the following:

• Your iCloud password
• Either, with standard code-based 2FA:

— Access to one of your trusted devices that they had the passcode or password for or could otherwise unlock to receive a 2FA token, or a trusted phone number (or hijack a phone number)

— The device password for one of your other Apple devices that’s already synced. When you add a new device to iCloud syncing of Passwords, Apple has you prove yourself by entering the password for an existing device in your set.

• Or, with an Apple Account locked to hardware security keys for 2FA, access to one of the two or more hardware security keys associated with your Apple Account.

However, there’s one flaw in the above, which is covered in how thieves steal iPhone passcodes: if someone can obtain your iPhone and its passcode, they may be able to use the phone to trigger a reset of your Apple Account password. See how to turn on Stolen Device Protection for advice on preventing that.

Don’t worry about entering your passcode for Passwords syncing: Apple doesn’t know your passcode or store it or transmit it unencrypted. Instead, when you enable Passwords syncing on any device, part of the process bootstraps distributing a set of cryptographic elements securely to other devices. It does so by encrypting that set with the password of the device you’re using—but only the one-way encrypted form of the password is used.

On another device, if you don’t enter exactly the same password, when it’s also transformed in the same way, it won’t match the stored version, and it won’t be able to decrypt the syncing keys to add the device you’re on—and blocks a cracker who doesn’t know your other devices’ passwords, too.

A well-designed third-party manager

The system I described just above for Passwords is the same one that’s been implemented by 1Password. (I don’t recommend any other third-party password manager.)

It’s a zero-knowledge security model for syncing across the cloud, in which the parties handling data can’t actually see the secrets and have no access to keys. As you add devices to cloud syncing, you have to prove you have other devices and secrets first. This is true for both companies’ access to your data stores via their websites: all encryption happens locally in the browser; none is ever sent to the companies; and each login session requires proof of certain elevated secrets that no one can intercept.

1Password’s system syncs files blindly, with storage vaults encrypted and stored that way on 1Password’s servers. The master password for the vault is never transmitted in any way, nor are unencrypted entries.

1Password’s approach is close to Apple’s. The big difference? Apple copies all passwords to local storage and doesn’t allow web-based access to entries, even though they’re all stored with device-based encryption at iCloud.com. With 1Password, there’s no permanent local storage, but you can use a secure method for browser-based access if a native app isn’t available.

Google password encryption

If you use Google for password management—or as part of your password-management approach—I recommend upgrading to the device-based encryption option they introduced a few years ago.

Tip: You can check whether you already have it set up: you might have enabled it or been walked through it by Google already. Follow the same steps below.

Use Google Chrome (not another Chromium-based browser) for the following steps:

1. In the top-right corner of the browser window, click the More button and choose Passwords and Autofill > Google Password Manager.
2. Click the menu button and click Settings.
3. If you see Set Up next to “On-device encryption,” click the link and follow the steps. If you see an open-in-new-window button, on-device encryption is already enabled.

You can avoid Google’s password system and rely on Apple’s by installing iCloud Passwords for Chrome. It’s a Chrome extension that manages the local security issues for accessing Passwords. Unlike Google’s system, it works with Chromium browsers.

Apple’s iCloud Drive is integrated into macOS, iOS, and iPadOS, and lets you use your free or paid iCloud space to store and share files.

A shared folder requires an Apple Account to access, and the contents are all accessible to whomever is invited or has the link, depending on the permissions you set. Up to 100 people can be invited to a folder. Only folders you create can be shared—not ones that Apple manages or that are created for apps. Storage space is occupied only in the sharing party’s iCloud account, which makes it handy if other people don’t have large iCloud storage subscriptions.

iCloud Drive appears in macOS by default as an item in the Finder window sidebar. You can select it there, or you can choose Go > iCloud Drive or press ⌘-Shift-I. On an iPhone or iPad, use the Files app.

With Advanced Data Protection enabled, iCloud data is secured end-to-end among your devices. It’s also E2EE secured with devices of anyone with whom you share if you all have ADP enabled.

Share a file or folder in iCloud Drive

1. Select the items to share. On a Mac, Control-click or right-click any file or folder stored in iCloud Drive, or select several and Control-click one of them, then choose Share from the contextual menu. On an iPhone or iPad, touch and hold a file or folder and choose Share; or tap the More button, choose Select, tap the button beside each item, and tap the Share button.
2. A share popover appears. Choose Send Copy or Share a Link from its pop-up menu. Send Copy sends a download link and has no further options. Apple renamed several of these labels in iOS 27, iPadOS 27 and macOS 27 Golden Gate; the functions are unchanged, and earlier releases call this Collaborate.
3. If you choose Share a Link, set the permissions by clicking or tapping the text below that label:
   • Under Who Can Access, choose “People you choose” to limit access, or “Anyone with the link” to open it up. Earlier releases call the first option “Only invited people”.
   • From Permissions, choose “Can edit” for read and write access, or “Can view or download” for read-only. Earlier releases call these “Can make changes” and “View only”.
   • Enable or disable “Allow access requests”, called “Allow others to invite” in earlier releases.
4. Select people or groups from recent interactions in Messages and elsewhere, or click one of the options, like Mail or AirDrop, to share the link.
5. Complete the process in the dialog, sheet, or app prompt that appears. If you copy a link in the 27 releases, you are warned that sharing with a group means approving access for each member; you can proceed, or choose Allow Anyone with the Link instead.

Once shared, the item is marked in the Finder or the Files app:

• In macOS, you can opt to show a Shared By column in the Finder. It may be enabled in some iCloud Drive views. If not, and you want to turn it on, choose View > Show View Options and check Shared By. With that column active, you see Me for you or the name of the sharing party for files or folders shared by others. All files that aren’t shared show Not Shared, which feels like overkill.
• In macOS with the Shared By column disabled and in iOS/iPadOS, you see a label next to a file in the Finder or next to or beneath it in the Files app that reads Shared by Me if just a link is used or an invitation hasn’t yet been opened. The label displays With Person or People when an invitation is accepted. The last person to modify may appear instead, such as Modified by Dave Johnson.

To make changes, the easiest way to access these shared items is via the Shared view. On an iPhone or iPad, tap the Shared button in Files; on a Mac, choose Go > Shared in the Finder (⌘-Shift-S). Select the items as above either in the Shared view or by choosing the same set of original items. Touch and hold on an iPhone or iPad or Control-click/right-click to reveal the Manage Shared Folder item.

Choose Manage Shared Folder to reveal a dialog that shows the sharing details. You can see with whom the item is shared, and you can remove and add members (if you have permission), change permissions, or change invitation parameters. If and when you’re ready to stop sharing, click or tap Stop Sharing.

iCloud.com allows similar options for sharing files, although the sequence is a little different and options are far more limited:

1. Log in to iCloud.com and click iCloud Drive.
2. Select a single file or folder and then click the Share File or Folder button. Email and Copy Link destinations are available.
3. Click Share Options to access permissions that are identical with those found on an iPhone, iPad, or Mac.
4. When you’ve made your choices, click Share.

Dropbox

Dropbox is an exceedingly popular service for simple syncing across devices that offers several different ways to share files with strong controls on access. It has integrated macOS support, as well as full-featured apps for iOS/iPadOS and other major platforms, and a sophisticated web app.

On a Mac, Dropbox uses Apple’s framework for cloud-storage providers to add icons to the right of files and folders in the Finder in its folder. The Dropbox folder is the only one that’s synced, and it’s located by default in your home folder. Files and folders may be online only or online and stored locally.

Some features require a paid Dropbox subscription.

Control-click or right-click a single file or folder inside the Dropbox folder on a Mac or tap the More button to the right of a file or folder in the Dropbox app for iPhone/iPad. You can now access several options by choosing:

• Share: This opens a dialog or sheet with extensive options to let people have access to a file or folder. You can invite people, create publicly available or password-protected links for sharing, and set an end-date for access. Use this option for sharing items that you want people to have ongoing access to, particularly for folders that you might optionally want to let people drop items into or modify. (Shared folders count against other people’s Dropbox storage limits.)
• Transfer a Copy: Dropbox lets you send files without providing any access to your Dropbox space. The transfer can be password protected and have an expiration date. On a Mac, you use the contextual menu; in the iPhone/iPad app, you start in the files view and tap the plus button, then select files to transfer.
• Copy Dropbox Link: Choosing this on a Mac (or via the Share > Copy link pathway on an iPhone/iPad) creates a public link that anyone who has it can use to download the particular item. For certain kinds of files, like images and PDFs, the link allows viewing inline on a website, too.

Google Drive and OneDrive

Two other major firms’ apps don’t offer file-level Finder integration, but can sync files automatically and provide Mac access via a web app. Both also have iPhone/iPad apps.

The advantage of both is that you might already have paid for storage:

• Google Drive: Google Drive provides access to the 15 GB of free storage available for all Google individual accounts or to the larger pool of paid Google One tiers that start at 100 GB for $19.99 per year. Business accounts include a higher starting storage allocation. Google allows public and invitation-based links with varying permission, but doesn’t offer setting an expiration date.
• Microsoft OneDrive with Microsoft 365: Anyone can get 5 GB of file storage (plus 15 GB of email storage) in Microsoft OneDrive by setting up a free Microsoft 365 account. For $1.99 a month or $19.99 a year, you can upgrade to Microsoft 365 Basic with 100 GB each for files and email. At $9.99 a month or $99.99 a year (one person) or $12.99 a month or $12.99 a year (up to six people in a family), Microsoft 365 Personal offers 1 TB of file storage and 100 GB of email per person. The Personal plan also adds access to desktop Microsoft apps. OneDrive’s sharing options are comparable to those of Dropbox, with options for sending invitations, creating a public link, and setting an expiration date for the link.