Keychain - Search by password

[walterhpdx]

Is there a way to search Keychain passwords for a specific password? I know if I want to find out my password for GMail, I can go and search Keychain for "Google" or "GMail" and Keychain will find sites that match and allow me to get my password. But this is different. I want to find out what sites use password "abcd1234" so that I can go and change them. However, from what I have been able to tell, you can't actually search by a specific password. Anyone found a way?

 

[Lunder89]

I don't think you can search for the actual password. But if it is stored in Safari, opening the Safari preferences and the Passwords tab, you can just use the arrow key to tap down, when you "select" a sites username and password, the password is shown. Spotting for a specific password should be a fast thing. Sort of.

If you have macOS Mojave and you reuse the password on multiple sites, Safari will even give you a little yellow triangle in the settings window.

 

[Mikael H]

Is there a way to search Keychain passwords for a specific password? I know if I want to find out my password for GMail, I can go and search Keychain for "Google" or "GMail" and Keychain will find sites that match and allow me to get my password. But this is different. I want to find out what sites use password "abcd1234" so that I can go and change them. However, from what I have been able to tell, you can't actually search by a specific password. Anyone found a way?

If you think about it, that would be horribly unsafe. Remember that you have to re-authenticate to view passwords in Keychain Access. This is to ensure not anyone can walk up to your computer while you're away and forgot to lock it, and collect passwords from you.

Also, best-case, you really shouldn't have to - or even be able to - remember specific passwords other than the ones you use to access your machine and to access your password manager.

 

[walterhpdx]

If you think about it, that would be horribly unsafe.

Oh trust me, I know. But if you get notified of a breach and you know that site's password, it's a good idea to abandon that password on every other site.

 

[Mikael H]

Oh trust me, I know. But if you get notified of a breach and you know that site's password, it's a good idea to abandon that password on every other site.

Yep;
With Keychain, that’s unfortunately a manual process. 1Password has that built-in, including an immediate check against haveibeenpwned so you get warned against known bad passwords.

 

[hobowankenobi]

Yep;
With Keychain, that’s unfortunately a manual process. 1Password has that built-in, including an immediate check against haveibeenpwned so you get warned against known bad passwords.

For anybody following along, there are several well regarded products available.

1 Password and LastPass are probably the leaders, but there are others...and yet more.

Bumped into this one the other day, free version looks pretty good. Have not used it, but Avira has been a legit AV company for well over a decade...could be worth a look.

AVG also has a free product; seems like many of the traditional security companies are jumping in. More choices = great.