macOS Keychain (file-based)

Format	macOS Keychain (file-based)
Short name	kych
Category	database
Platforms	macOS
Crush support	Not yet supported
Status	Reviewed
Last reviewed	2026-10-05

Forensic relevance

The legacy file-based macOS Keychain format used by files such as login.keychain-db and System.keychain. The file starts with the ASCII signature 'kych' and contains a CSSM-style database with tables for keychain items such as generic and internet passwords, certificates and cryptographic keys. Many item attributes, including account, service/server information and metadata, are stored separately from the protected secret data. Secret data is encrypted (3DES-CBC) with item keys wrapped by a database key, which is protected by a master key derived from the keychain password (PBKDF2-HMAC-SHA1); System.keychain is unlocked via /var/db/SystemKey. For forensic analysis, the database can contain credentials, certificates, private keys and other authentication material, while metadata can remain useful even when secrets cannot be decrypted. This file-based format is distinct from the SQLite-based data protection keychain (for example keychain-2.db), which uses a different implementation and format.

Signatures

Offset	Hex	ASCII (non-printable as .)	Description
offset 0 (0x0)	6B 79 63 68	kych	Signature 'kych'

Known extensions

.keychain, .keychain-db

References

MacOS keychain database file format (libyal/dtformats) https://github.com/libyal/dtformats/blob/main/documentation/MacOS%20keychain%20database%20file%20format.asciidoc
chainbreaker — macOS keychain forensic tool (n0fate) https://github.com/n0fate/chainbreaker

Cite this entry

Crush Format Reference, “macOS Keychain (file-based)”. https://kalink0.github.io/crush-forensics/formats/kych/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.

Entry in the source at this commit · Change history of the source · Report a correction