Apple Keychain
| Format | Apple Keychain |
|---|---|
| Short name | Keychain |
| Category | database |
| Platforms | macOS, iOS |
| Crush support | Supported (SQLiteParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Apple's password management system storing credentials, private keys, certificates, Wi-Fi passwords, payment data, and secure notes. On iOS, implemented as a single SQLite database at /private/var/Keychains/keychain-2.db — the file itself is not encrypted, but each item is encrypted with two AES-256-GCM keys: a metadata key for its attributes (protected by the Secure Enclave, cached in the application processor) and a per-row key for the secret value (unwrapped only by the Secure Enclave), both bound to the item's protection class. Records contain: account name (acct), service (svce), server, access group (agrp — identifies the owning app), protection class, and the encrypted secret (data). On macOS: Login Keychain (~/Library/Keychains/login.keychain-db, .keychain before 10.12) and System Keychain (/Library/Keychains/System.keychain) use a separate big-endian database format beginning 'kych', not SQLite; Local Items/iCloud Keychain is a keychain-2.db (SQLite) with a user.kb keybag under ~/Library/Keychains/<UUID>/. If iCloud Keychain sync is enabled, keychain-2.db may contain credentials from all the user's Apple devices. Encrypted iTunes/Finder backups contain the keychain as keychain-backup.plist, decryptable offline with the backup password except for ThisDeviceOnly items. On devices with a Secure Enclave (iPhone 5s and later) the class keys can only be unwrapped on the device itself; older devices allow offline decryption with extracted class keys.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | 53 51 4C 69 74 65 20 66 6F 72 6D 61 74 20 33 00 | SQLite format 3. | SQLite magic — keychain-2.db is a standard SQLite database |
Known extensions
.db, .keychain, .keychain-db
References
- Apple keychain data protection (Apple Security Guide) https://support.apple.com/guide/security/keychain-data-protection-secb0694df1a/web
- MacOS keychain database file format (libyal/dtformats) https://github.com/libyal/dtformats/blob/main/documentation/MacOS%20keychain%20database%20file%20format.asciidoc
- Extracting and decrypting iOS Keychain (ElcomSoft / DFIR Review) https://dfir.pubpub.org/pub/gqqxl93l
- Deep dive into Apple Keychain decryption (Passware) https://blog.passware.com/a-deep-dive-into-apple-keychain-decryption/
Cite this entry
Crush Format Reference, “Apple Keychain”. https://kalink0.github.io/crush-forensics/formats/keychain/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction