Recover/Crack Password from Keychain in OS X 10.15 Catalina, via known items in keychain and potentially from logs?
4
votes
1
answer
384
views
I am racking my head for an [old login password] (pass1) that is gone from my keychain but still in a Time Machine backup. The password I seek [encrypts an external drive] (pass2), which used to unlock automagically by virtue of being in the keychain so I did not memorise it. However losing (pass2) now would also mean losing a good deal of data.
I still know some of the passwords in that keychain (pass3), but I have forgotten the master password (pass1). Unfortunately I have been using complex passwords for some time now and will not be able to brute force it with the likes of hashcat easily.
Nevertheless, I hope to recover the old login password (pass1) by deducing what the hash and salt of the keychain is from the other known passwords (pass3).
Does macOS store remnants or clear version of passwords in any locations?
edit: I was quite lousy with my password and found some old passwords in Copyclip, an app that logs text copied to clipboard (security risk, yes); I also have Near Lock which I think might log some keystrokes but I am still investigating, and am wondering if there might be other somewhat common places that might have passwords stored due to poor security practices.
Asked by T Lau
(41 rep)
May 30, 2025, 08:51 PM
Last activity: Jun 1, 2025, 02:58 PM
Last activity: Jun 1, 2025, 02:58 PM