everyday mac tools

"accountsd wants to use the login keychain": which password it wants

· 6 min read

The prompt “accountsd wants to use the login keychain” is almost always a real macOS message. accountsd is the system process that looks after the accounts in Internet Accounts, such as iCloud, Mail and Calendar, and it needs something stored in your login keychain. If the prompt keeps coming back, your Mac login password and the keychain’s password have drifted apart. Try your previous Mac login password first.

What the prompt is

The dialog’s wording is a template: “APP wants to use the “KEYCHAIN” keychain.” Here the app is accountsd and the keychain is “login.” Under it macOS says “Please enter the keychain password,” with a password field, Cancel and OK. Your login keychain is the file that holds the saved passwords and account tokens for your user. It normally opens by itself when you log in, because its password is your Mac login password.

When it can’t open, every process that needs it has to ask. That’s why the prompt can appear over and over, and why it often shows up right after you sign in or open Mail, Calendar or System Settings.

This prompt has no Always Allow button. That one belongs to a different prompt, “APP wants to use your confidential information stored in “ITEM” in your keychain,” which asks about a single saved item in a keychain that’s already open. Here the whole keychain is shut, so clicking Cancel only puts the question off until the next process asks.

Why the passwords drifted apart

The keychain’s password is set when it’s created and updated when you change your login password in the usual way. Apple’s Keychain Access guide says the login keychain password is normally the same as your user password, and if they differ, the keychain won’t unlock at login.

They fall apart when your Mac password was changed in a way that skipped the keychain:

  • it was reset from macOS Recovery,
  • an administrator reset it,
  • it was reset using your Apple Account.

In each case the Mac login now works with the new password, while the keychain still wants the old one.

Which password to type

Try these two in order:

  1. Your previous Mac login password. This is the likeliest answer. Type the one you used before the reset.
  2. Your current Mac login password. Worth one try, in case the prompt is a one-off.

A wrong guess just returns you to the same dialog. If you keep failing, stop and move to the next section rather than trying many combinations.

If the old password works, the prompts stop for now, but the keychain still uses that old password, so they’ll be back after your next login. Make the two match while you remember it: open Keychain Access, choose Edit > Change Password for Keychain “login”…, give the old password as the current one and your Mac login password as the new one.

If macOS offers to update the keychain

Sometimes macOS notices the mismatch at login and says “The system was unable to unlock your login keychain.” It then offers two choices, which it describes this way: if you remember your old password you can update the keychain password, and if you don’t, you can create a new login keychain.

  • Update Keychain Password. macOS asks for your old password. The keychain is kept, and its password now matches your login password.
  • Create New Keychain. Starts an empty login keychain.

In the warning text, macOS adds that the user’s previous keychain still exists, and that if you find the previous password you can reach it and the passwords it contains. So choosing a new keychain doesn’t destroy the old one by itself.

If you’ve lost the old password

The last resort is resetting the default keychains. Read what it costs first. Apple’s guide says resetting the default keychain deletes all the passwords saved in it, and the button’s own description says you will lose all items currently stored in the login and Local Items keychains. Apple recommends doing this only when Apple Support advises it, and it finishes when you log out and back in.

Before you reset:

  1. Check what you’d lose. If you use iCloud Keychain, the passwords it syncs are also on iCloud and your other devices, so they should return once the Mac syncs again. Anything that lived only in this Mac’s login keychain, such as passwords some apps save for themselves, doesn’t.
  2. Make sure you know your Apple Account password, since you’ll sign in to iCloud again.
  3. Keep the old file if you can. Copy login.keychain-db from ~/Library/Keychains to a folder you won’t touch. Leave it alone, and don’t open it unless you find the old password.

Then, to reset:

  1. Open Keychain Access. On recent versions it sits in /System/Library/CoreServices/Applications, and you can open it from Spotlight.
  2. In the menu bar, choose Keychain Access, then Settings.
  3. Click “Reset Default Keychains…” and follow the prompts.
  4. Log out and back in. Sign in to your accounts again when asked.

To keep the two from drifting apart again, change your Mac password in settings rather than resetting it: Apple’s Keychain Access guide says that keeps the keychain password in step. In System Settings, click Users & Groups, click the Info button next to your user name, then Change, and type the old and new passwords.

Is it malware

The genuine prompt comes from macOS itself and names a process, here accountsd. You can check that process on your own Mac in Activity Monitor: search for accountsd and you’ll find it running under your user name. Its program file lives in /System/Library/Frameworks/Accounts.framework, a folder only macOS can change.

What to watch for is a look-alike. Never type your password into something that appeared inside a web page, however much it resembles a Mac dialog. A real system prompt isn’t part of a page: it can be moved outside the browser window and it doesn’t disappear when you close the tab. If you’re unsure, cancel it, quit the browser and see if the prompt is still there. How phishing targets Mac users shows what the fakes look like.

For more on what each sign-in controls, see signing in to a Mac. If you’d rather rely less on saved passwords, see when passkeys can replace them.

Questions

Is “accountsd wants to use the login keychain” a virus? No, in nearly every case. accountsd is a built-in macOS process for Internet Accounts, and the prompt is macOS asking to open your login keychain. Only a password request that appears inside a web page should worry you.

Why does the keychain prompt keep coming back? The keychain is still locked, because its password doesn’t match your Mac login password. Each process that needs it asks again. Entering the old Mac password stops it until the next login; changing the keychain’s password to your login password stops it for good.

Can I just click Cancel? You can, and nothing breaks at once, but accountsd still can’t open the keychain, so the prompt returns and the accounts that needed it may not sign in. This prompt has no Always Allow button. Fix the password mismatch instead.

Will I lose my passwords if I reset the keychain? You lose what’s stored only in the local login keychain, which Apple’s guide says is deleted by a reset. Passwords kept in iCloud Keychain sync back once you sign in again. Keep a copy of the old keychain file before you reset.