How can I access the encrypted value of a local user account password in osx? Would it be possible to check against it or even copy it to another account?

2 Answers 2


The hashes were in /var/db/shadow/hash/ in 10.6 and earlier, but they are stored in /var/db/dslocal/nodes/Default/users/username.plist in 10.7 and 10.8.

You can print the hash data with DaveGrohl (sudo dave -s $USER) or something like this:

sudo defaults read /var/db/dslocal/nodes/Default/users/$USER.plist ShadowHashData | tr -dc '0-9a-f ' | xxd -p -r | plutil -convert xml1 - -o -

If automatic login is enabled, the password of the login keychain is also stored in /etc/kcpassword encrypted with XOR cipher.

sudo ruby -e 'key = [125, 137, 82, 35, 210, 188, 221, 234, 163, 185, 31]; IO.read("/etc/kcpassword").bytes.each_with_index { |b, i| break if key.include?(b); print [b ^ key[i % key.size]].pack("U*") }'

  • Brillant, how do you learn such an intimate knowledge of OS X?
    – c-o-d
    Apr 26, 2014 at 18:29
  • This is not quite right. The "break" should only happen when (b == key[i% key.size]), but I found your code enlightening. Thanks! Nov 25, 2015 at 0:51

I don't know that much about it, but from what I could gather using opensnoop:

login accesses the local directory service (possibly related to some Kerberos stuff -- maybe that's the underlying implementation for the local directory, it reads /Library/Preferences/edu.mit.Kerberos, /etc/krb5.conf, /usr/etc/krb5.conf etc.).

dscl, the directory service command line utility, then cd Local/Default/Users/yourusername, read reveals the usual unixy account-related stuff, plus: GeneratedUID: 1A5EF9B7-4DB6-4C01-919A-xxxxx (don't know the implications, so I censored a little) -- you can also read this UUID via Accounts.prefPane in System Preferences.app.

That matches a filename in /private/var/db/shadow/hash/ also accessed by login!

I guess your best bet is to rename/copy the files with the GeneratedUID name, or change the reference in the directory service.

Included all my "research" to allow you to retrace my steps and allow for refutability.

I don't have the time to trash and restore my user accounts, so you're on your own now. Good luck.

TLDR: Open Accounts.prefPane, check your UUID (right-click your user in the list) and look for a file by that name in /private/var/db/shadow/hash/. Don't know if it works at all. Good luck.

  • To expand on my answer, /private/var/db/shadow/hash/ really contains the password hashes (not like encrypted passwords, there's no way to restore them directly). Also see here and here.
    – Daniel Beck
    Oct 9, 2010 at 9:05
  • 1
    I love googling for obscure system directories to find out what they're for :-)
    – Daniel Beck
    Oct 9, 2010 at 9:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.