Help importing [Safari passwords: Solved]

System

This discussion was created from comments split from: Introducing 1Password.community.

phxmac89

Different topic as the discussion thread was closed on the one I really need help with, but can I please receive remote assistance in exporting Safari/Keychain passwords as a csv file please? I'd greatly appreciate it.

Ben

Hi @phxmac89

Thanks for taking the time to write in. To clarify: are you looking to import from Safari / Apple's Keychain to 1Password? If so, have you see MrC's converter, here:

Moving to 1Password from another password manager

Please let us know. :)

Ben

phxmac89

Hi! Yes I have seen it, and I tried it, but I must've done something wrong or Big Sur blocks it? I'm not really inclined technically and saw that remote assistance was available. I'd love it if someone could remote in my Macbook Pro to help assist.

MrC

@phxmac89

Exporting Safari passwords (stored via iCloud Keychain) can be done via a script I wrote called Get_Safari12_Passwords (it works on Safari 12 and up). It is an AppleScript that controls the Safari user interface, grabbing the credentials and storing them in a CSV file.

Unfortunately, I cannot offer remote assistance for this, since your confidential data will be exposed as the script operates.

Watch a screen video of how the process works here, then head over to the converter suite thread next. I'm here if you need additional guidance.

phxmac89

Oh my gosh! Thank you so much! Okay, I'll check it out.

phxmac89

@MrC So I was able to export my Safari passwords. I tried running the Keychain script, but it only exported 26 items - when my iCloud keychain has over 300 passwords.

MrC

@phxmac89 ,

When iCloud Keychain is enabled on your Mac (and other devices), then Safari passwords get stored there. You should see those in Safari's Preferences > Passwords dialog, which is where the script operates (as you saw). The script can only copy what Safari shows in that dialog.

If iCloud Keychain is not enabled, then Safari will show your Mac's local Keychain passwords, and it has no access to those stored in the iCloud Keychain.

So that I'm clear, you say "I tried running the Keychain script" - do you mean Get_Safari12_Passwords, or do you mean the AppleScript code shown in the README.html? I've addressed what the former can pull. The later code is only helpful for anything in a local Keychain.

And when you say "So I was able to export my Safari passwords" - does that mean that Get_Safari12_Passwords only pulled 26 items (and yet you see 300 within Safari's Passwords dialog?

Apple's terminology for, and block-box nature of, its various Keychains makes this all a bit confusing.

phxmac89

@MrC,

Sorry for the confusion! Haha yes, Apple's terminology is wild. LOL.

I ran the Get_Safari12_Passwords, and it pulled from Safari > Passwords dialog. That script pulled about 136 passwords from Safari.

I didn't run anything to pull from my iCloud Keychain. Yes, I have iCloud Keychain turned on and have for a year or so now. My iCloud Keychain is showing me I have passwords for over 300+ items though.

So there is no way for me to pull all my passwords from iCloud Keychain, right?

MrC

@phxmac89

Given that you have iCloud Keychain enabled, and ran Get_Safari12_Passwords, this statement:

I didn't run anything to pull from my iCloud Keychain

doesn't make sense to me. When iCloud Keychain is enabled, Get_Safari12_Passwords get's what's in Safari, and those are the iCloud Keychain items.

Are you using Keychain Access and looking at the iCloud entry there? If so, many of those items are not Safari passwords. To see the possible Safari passwords, search Keychain Access for "web form password" using its Search box.

phxmac89

@MrC I'm confused, I didn't know that! Sorry about that.

I opened Safari > Preferences > Passwords, that's how it exported.

I did not open up the Keychain Access app on my Mac and did not export the iCloud Keychain directly from the Keychain Access app on my Mac.

I'll look that up!

MrC

@phxmac89 ,

It's confusing.

The Get_Safari12_Passwords script grabs whatever is shown in Safari.

Keychain Access is a macOS utility that can show you the items stored in the various macOS / iCloud keychains. It's generally used only as a viewer, or simple editor of a keychain entry. It does not export password items (it used to, but no longer does).

How did you know you have 300+ iCloud Keychain items, and how do you know which ones are Safari passwords?

phxmac89

@MrC,

Wonderful! I've scrolled through and it looks like it's all my passwords.

That stinks! You'd think Apple would allow such a tool as Keychain Access to export!

I just counted the items in the Keychain Access app (iCloud option). But now that you've shared with me, it does look like the tool itself shows different types of passwords. There's Airport network, Web form, skipCheckCert, application password, Internet password, and other categories here. I'm guessing the Internet password ones are the Safari ones.

MrC

@phxmac89 ,

Ok, great. You've made excellent progress then.

Yup, it's unfortunate the beautiful walled garden can also be a trap at times too.

There are many items within the keychain(s), from encryption keys to various device passwords. The keychain converter can directly access items in any local keychain. You can run it, tell it which local keychain to access, provide the passwords when asked, and it will decrypt the items and place them in a 1PIF file which you can import into 1Password. It will ignore items inside the keychain that are of no value to you (it has some complex rules and heuristics to know which items to ignore).

Unfortunately, since there are no local files available to access with iCloud Keychain, the keychain converter cannot access these. It used to be that you could mass copy iCloud Keychain entries into a local keychain (via copy / paste), but this has not worked reliably since Sierra.

williakz

Great discussion, thanks. Saved to disk.

Quick question (tangentially related, I hope): I've got an elderly relative who forgot the password (not a 1P user, alas) to an ISP-based email account. I have full remote access to the machine (iMac) via Screen Sharing. Can I find the "missing" password by rooting around in Keychain Access?

Ben

@williakz

tangentially

Indeed. ;)

Can I find the "missing" password by rooting around in Keychain Access?

Do they have the email account in question added to the built-in Mail.app? If so, I suspect that is a possibility, though I don't know enough about how Mail.app stores these accounts to say for sure and/or where exactly within Keychain Access to look. Failing that the best bet would likely be a call to the ISP.

I hope that's helpful. :+1:

Ben

williakz

Thanks @Ben

MrC

@williakz ,

Yes, the passwords for the SMTP / IMAP / POP servers, if enabled, are stored in the Keychain. Search SMTP or IMAP, and look at the found entries. Check both the "iCloud" and "login" keychains.

williakz

Thanks, @MrC, into the void I go. I'll be sure to report on what I find (if I ever find my way back out).

ag_ana

:+1: :)

phxmac89

@MrC,

Thank you so much for your help! I was able to export the passwords from Safari.

MrC

@phxmac89

You're welcome. That's great to hear.

Enjoy 1Password!