# Your login keychain won't travel anymore

> On Tahoe, copying a login keychain to another Mac fails even with the right password, and the Secure Enclave is why.
- Title: Your login keychain won't travel anymore · Der Flounder
- Summary: On Tahoe, copying a login keychain to another Mac fails even with the right password, and the Secure Enclave is why. On Secure Enclave Macs running Tahoe, a…
- Keywords: macos, keychain, secure enclave, mac admin, tahoe, technology, startups, login, won't, travel, anymore, Der Flounder
- Source: Der Flounder — https://derflounder.wordpress.com/2026/09/08/manually-copying-login-keychain-files-from-one-mac-to-another-no-longer-works-on-secure-enclave-equipped-macs-running-macos-tahoe
- Published: 2026-09-08T22:43:56+00:00
- Read time: 2 min
- Topics: macos, keychain, secure enclave, mac admin, tahoe, technology, startups
## What the login keychain is
macOS makes one for every user account. Its password matches your login password, so it unlocks automatically when you sign in.
## Where it lives on Tahoe
It's a SQLite database called login.keychain-db, sitting in /Users/username/Library/Keychains.
## The old trick that worked
For years you could copy that file to another Mac, type the keychain password, and get your saved secrets back.
## Tahoe broke it
On Macs with a Secure Enclave, the password alone no longer opens a copied login keychain.
## Two keys, not one
Apple encrypts keychain items with two AES-256-GCM keys: a metadata key for fast searching and a per-row secret key for the actual values.

> Keychain items are encrypted using two different AES-256-GCM keys: a table key (metadata) and a per-row key (secret key).
## The Secure Enclave holds them
The metadata key is cached in the main processor for speed, but the secret key has to go through the Secure Enclave every single time.

> The secret key always requires a round trip through the Secure Enclave.
## Why the copy fails
The decryption keys stay in the source Mac's Secure Enclave. On a second Mac, the password is right but the keys simply aren't there.
## The test setup
Rich Trouton copied a login.keychain-db from an Apple Silicon Mac into a macOS VM with an identical username and password.
## A VM makes a clean control
Virtual machines have no Secure Enclave. If the keys really live there, the VM has no way to reach them.

> VMs don't have a Secure Enclave.
## What happened at login
Instead of unlocking, macOS built a brand new login keychain. The copied one was renamed to login_renamed_1.keychain-db.
## The logs name the failure
securityd logged SecKeychainLogin failed: -2147413984, password was supplied. The password reached the unlock attempt and still wasn't enough.

> SecKeychainLogin failed: -2147413984, password was supplied
## Not a typo, a lockout
Because the password was confirmed correct in setup and the log shows it was supplied, a mismatch is ruled out. Hardware binding is what's blocking it.
## What this means for admins
Stop treating the keychain file as portable. Move credentials through account migration, iCloud Keychain, or a password manager instead.
## Key takeaway

On Secure Enclave Macs running Tahoe, a login keychain is bound to the machine that made it. Migrate accounts properly instead of copying the file.