Apple has quietly built one of the best password managers right into your Mac — and most people have never opened it. It’s free, it’s encrypted end to end, and starting with macOS Sequoia it finally has its own app instead of hiding inside Settings. Here’s exactly what iCloud Keychain and the new Passwords app do, and how to use them.
iCloud Keychain vs. the Passwords app — what’s the difference?
They’re two halves of the same thing:
- iCloud Keychain is the encrypted vault and sync engine. It stores your saved logins, passkeys, credit cards, and Wi-Fi passwords, and keeps them up to date across every device signed in to your Apple Account.
- The Passwords app (new in macOS Sequoia, iOS 18, and iPadOS 18) is the front door to that vault. Before it existed, your passwords were buried in System Settings or Safari preferences. Now they live in a proper app you can open from the Dock, Spotlight, or Launchpad.
Turn on the vault once and the app just shows you what’s inside. You don’t pay for it, and there’s no separate account to create.
How to turn on iCloud Keychain on your Mac
- Open System Settings and click your name (Apple Account) at the top.
- Click iCloud, then Passwords (older macOS calls this section “Keychain”).
- Switch on Sync this Mac.
Do the same on your iPhone and iPad (Settings > your name > iCloud > Passwords) and everything stays mirrored across all of them automatically.
Turn on AutoFill so your Mac types passwords for you
This is the part that saves you time every single day. Go to System Settings > General > AutoFill & Passwords and turn on AutoFill Passwords and Passkeys. Now, whenever you land on a login field in Safari, your Mac offers the right saved account — confirm with Touch ID and you’re in.
Using Chrome or Edge instead of Safari? Apple offers an official iCloud Passwords browser extension so autofill works there too, and even on a Windows PC through iCloud for Windows.
What the Passwords app actually holds
Open the app and you’ll see a sidebar with a handful of sections:
- All — every saved login, searchable.
- Passkeys — the passwordless sign-in credentials that replace passwords entirely (more below).
- Codes — built-in two-factor (2FA) verification codes, so you don’t need a separate authenticator app.
- Wi-Fi — every network password your devices have ever saved.
- Security — alerts for weak, reused, or leaked passwords.
- Deleted — a recovery bin for anything you removed recently.
Share passwords with family using shared groups
Since macOS Sequoia, the Passwords app can create shared groups — a folder of logins that stays in sync with people you trust. Open Passwords on your Mac, click the + button in the sidebar, choose New Shared Group, name it (for example "Household"), and add people from your Contacts who use iCloud. Drag any saved login or passkey into the group and everyone you invited sees it instantly on their own Apple devices; edit a password once and it updates for the whole group. It's the built-in, free way to share a streaming or Wi-Fi login without texting it in plain text.
Passkeys: the password replacement
A passkey is a login that has no typed password at all — you sign in with Touch ID or Face ID, and there’s nothing for a hacker to steal or phish. When a website supports them, your Mac offers to save a passkey instead of a password, and it syncs through iCloud Keychain like everything else. Apple is a member of the FIDO Alliance driving this passwordless standard, so more sites add support every month.
Built-in two-factor codes
If you’ve been copying 6-digit codes out of a separate authenticator app, stop. The Passwords app can store the 2FA secret alongside the login and generate the rotating code itself — and autofill can even drop it into the code field for you. One app, one Touch ID tap, done.
Security alerts catch your weak spots
The Security section flags passwords that are easy to guess, reused across multiple sites, or that have shown up in a known data breach. It’s a free, always-on audit of your login hygiene — tap a warning and it walks you straight to changing the password.
Is it safe?
Yes. Everything in iCloud Keychain is protected with industry-standard, end-to-end encryption — Apple can’t read your passwords sitting on its servers. A new device can’t join your Keychain unless you approve it, and day-to-day access is gated behind Touch ID or Face ID. The one honest gap: unlike some paid managers, Apple’s app doesn’t (yet) offer secure notes for storing arbitrary secrets.
The catch: it’s an Apple-only club
iCloud Keychain shines when your whole setup is Apple — a Mac, an iPhone, and an iPad all sharing one encrypted vault with zero friction. That seamlessness is a big reason people move to the Mac in the first place. If you’re still on an aging or Intel MacBook, a clean Apple-silicon MacBook Air gets you Touch ID, instant autofill, and years of macOS updates. Our refurbished MacBook Air M1 models start at $450, and you’ll find more discounted Macs, iPads, and accessories on the Apple clearance page — every one tested, cleaned, and covered by our one-year warranty.
Frequently asked questions
Do I need to pay for Apple’s password manager?
No. iCloud Keychain and the Passwords app are completely free and built into macOS, iOS, and iPadOS — there’s no subscription and no separate account.
What’s the difference between Keychain Access and the Passwords app?
Keychain Access is the old, technical utility (still in Applications > Utilities) mainly for certificates and system secrets. For your website and app logins, use the new Passwords app — it’s the friendly, everyday tool.
Can I use it on Windows or Chrome?
Yes. Install iCloud for Windows and the iCloud Passwords extension for Chrome or Edge, and your saved logins autofill on a PC too.
What if I forget my actual Mac login password?
That’s a different problem from the Passwords app — see our full guide on how to reset a forgotten Mac password.
Will my passwords sync to a new Mac automatically?
Yes. Sign the new Mac in to the same Apple Account, turn on Passwords in iCloud settings, approve the device, and your entire vault — logins, passkeys, and 2FA codes — appears within moments.