Tidying your keychain

I recently noticed that my keychain holds many passwords, most of which I don’t need. Can I delete them, and if so, how? Yes, but keep backups in case you need access in the future. If you’re not using iCloud Keychain, these are stored locally in your login keychain, which opens automatically when you log in. Never tamper with the System or System Roots keychains.

In addition to your regular Time Machine or similar backup, make a copy on an external drive of your current login keychain from ~/ Library/Keychains/login.keychain-db, put this somewhere safe, then open Keychain Access. Ensure that login is selected in the upper left list of keychains. It’s clearer to work separately with passwords, any secure notes, certificates, and keys. To delete an item, select it in the main listing and then choose Edit > Delete, or Ctrl-click and use the contextual menu command Delete “n” (which names each item). It’s safe to delete expired certificates (those with icons marked with a red cross), and any passwords that haven’t been modified for a long time.

If you make a mistake you can’t undo, make a copy of your backup login keychain using a different name, and copy it to your ~/ Library/Keychains folder. Open it, using your login password, then copy and paste missing items into your current login keychain. Don’t worry if your keychain seems large — they work fine with over 1,000 items.