I know Mac keep hash (SHA) of the password in a file but i don't remember the location somebody can help me please ?

  • 2
    Why do you need to know the location of the file with the hashes? What you are trying to achieve? Mar 15, 2013 at 22:51

5 Answers 5


In recent versions of OS X (I forget whether this changed in 10.6 or 10.7), the shadow hashes were moved from /var/db/shadow/hash/<generateduid> into the main user database as an attribute in /var/db/dslocal/nodes/Default/users/<accountname>.plist. You can get them from the .plist directly (with e.g. the defaults command), but it's probably best to go through directory services with the dscl command, especially because that can also tell you what format it's in (SALTED-SHA512-PBKDF2 in this example):

$ sudo dscl . read /Users/joeuser AuthenticationAuthority
AuthenticationAuthority: ;ShadowHash;HASHLIST:<SALTED-SHA512-PBKDF2> ;Kerberosv5
$ sudo dscl . read /Users/joeuser dsAttrTypeNative:ShadowHashData
 62706c69 73743030 d101025f 10145341 4c544544 2d534841 3531322d 50424b44 4632d30
3 04050607 0857656e 74726f70 79547361 6c745a69 74657261 74696f6e 734f1080 4a52f1
ce a8cbadda 6c0e5483 9e7c3663 4d3c3327 d6dc6ad9 eb6ae851 d5837201 e15d8a58 641cf
ab0 46fc7b18 4bfafab7 8b44a6a6 424a241e 239ee429 12a7c304 2de27551 218257a7 a26e
f16d ceeac49f 5e3161c3 b63cab11 f6d92601 85cc134a 4e8ca7ad 7bd826be fc08606e eb1
2c642 5ec370e8 95ffb534 42488365 61649a73 4f1020f7 54827b04 dd6f6c24 799a8cb8 d1
5243a6 42a3cef4 566100d3 177cfeec b251f211 6532080b 22293136 41c4e700 00000000 0
0010100 00000000 00000900 00000000 00000000 00000000 0000ea

The hash should be located at /var/db/shadow/hash under the GUID for the user.

The user GUID can be found by running:

dscl localhost -read /Search/Users/<username> | grep GeneratedUID | cut -c15-

  • There is no directory named "shadow" in "db" for me
    – Rodd
    Mar 15, 2013 at 23:09
  • If you don't have root, you'll have to boot into single-user mode. If you just need to reset the root password, follow the guide here: kashiv.com/2012/04/16/…
    – Josh
    Mar 15, 2013 at 23:34

A bit of irony ... passwords of course there is a Mac OS)

Maybe they can even see in the terminal:

security dump-keychain -d ~/Library/Keychains/login.keychain

How to reset your Mac OS X password without an installer disc

How to reset password for Mac OS X 10.7 Lion

Reset password, search change file at reset password time.

  • 1
    this file look like the "master file" of Keychain Access. But in Keychain Access there is not the login password...
    – Rodd
    Mar 15, 2013 at 23:28
  • @Rodd may be reset password and search file change in reset time?
    – STTR
    Mar 15, 2013 at 23:56

The hashes were in /var/db/shadow/hash/ in 10.6 and earlier, but they are stored in /var/db/dslocal/nodes/Default/users/username.plist in 10.7 and 10.8.

You can print the hash data with DaveGrohl (sudo dave -s $USER) or something like this:

sudo defaults read /var/db/dslocal/nodes/Default/users/$USER.plist ShadowHashData | tr -dc '0-9a-f ' | xxd -p -r | plutil -convert xml1 - -o -

If automatic login is enabled, the password of the login keychain is also stored in /etc/kcpassword encrypted with XOR cipher.

sudo ruby -e 'key = [125, 137, 82, 35, 210, 188, 221, 234, 163, 185, 31]; IO.read("/etc/kcpassword").bytes.each_with_index { |b, i| break if key.include?(b); print [b ^ key[i % key.size]].pack("U*") }'


As I know, Mac is also based on Linux (I could be wrong), can you check on the root folder for a file which is called "pwd" ?

  • 1
    Mac OS X is derived from BSD which was based on (but not derived from) UNIX, just as Linux was based on (but not derived from) Minix which was also based on (but not derived from) UNIX. Mar 15, 2013 at 22:47
  • Well, I never used a MacOS but I think it has the same file system with Linux based PC's. So there must be a pwd file on the root folder. Mar 15, 2013 at 22:49
  • The only "root" folder i found is in /var/root but no "pwd"..
    – Rodd
    Mar 15, 2013 at 22:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.