Recover passwords from current user's Login Keychain #

without root:

$ security dump-keychain -d login.keychain
keychain: "/Users/user/Library/Keychains/login.keychain"
    "acct"<blob>="Netgear"
    "desc"<blob>="AirPort network password"
data:
"plain text password shown here"

with root:

$ sudo keychaindump
user@example.com:mail.example.com:plaintextpass1
user:TimeCapsule._afpovertcp._tcp.local:plaintextpass2
admin:proxy.example.org:plaintextpass3

Output has been abbreviated for clarity.
security is especially helpful in this common scenario:
- user has forgotten password
- automatic login is enabled
- root access unavailable
as the user's Login Keychain entries can be saved before resetting the forgotten password (see update below for recovering saved macOS user passwords, which obviates the need to reset).
Running security as root will eliminate the need to press "Allow" for each entry.
More:

UPDATES:

For a similar Windows "exploit", see Dump cleartext passwords of logged in user(s).
See also Recovering saved macOS user passwords.

/mac | Nov 03, 2012

Subscribe or visit the archives.