If there’s one thing that you need to remember about keychains, it’s how they can prompt you for a password to grant access to them. This is important, as it’s something that malicious software may try to emulate so that it can take over your Mac. Remember that the password to your default file-based keychain is your normal user password, as well as protection for all your secrets within that keychain, and you’ll understand why this is targeted by attackers.

You will also get perfectly legitimate requests for that and other keychain passwords. Although the login keychain is normally kept unlocked while you’re logged into your Mac, the macOS security system determines whether each request for passwords, certificates, and its other contents are correctly authorised. If the app isn’t trusted or the keychain is locked, then the security system, not the app, displays a dialog asking you for the password to that keychain to authenticate before it will provide the password or other secret to the app.

That authentication dialog is very important: although malware might try to forge it, it contains distinctive features you should always look for:

• The icon consists of a locked padlock, on which is superimposed a miniature icon representing the app or component that has asked to access the keychain.
• The bold text names the app or component which has called for keychain access, and states which item it’s asking to access: here, a named secure note.
• The smaller lettering specifies that it’s asking for the keychain password, that is the password used to unlock the named keychain, not your Apple ID or any other password.
• If you’re in any doubt about its authenticity, click on the Deny button and the request will be denied.
• If you’re in any doubt about its authenticity, you can open Keychain Access, lock the keychain there, and repeat the action while watching the keychain to ensure that it’s unlocked and handled correctly.

Note that it doesn’t provide or ask for your user name, only the password for that keychain.

Older versions of macOS may display this slightly differently, but still contain the same key items of information to reassure you that the request is genuine. While Ventura has changed many of these dialogs to its new vertical format, this remains unchanged, and shouldn’t change in Sonoma either.

That request to unlock a keychain is quite different from other requests for your admin user’s password to obtain authentication for other purposes, such as a process running a privileged helper. In Ventura and later, that has adopted the new format and should contain the following:

• The icon consists of a locked padlock, on which is superimposed a miniature icon representing the app or component that is asking for your password.
• Bold text names the app making the request.
• Below that is a general indication of the purpose of the request.
• Below that is the instruction to Enter your password to allow this.
• There are two text boxes, to contain your user name (already completed) and password.
• There are only two buttons, one of which may be OK or something more specific, and the other is Cancel.
• If you’re in any doubt as to its authenticity, click on the Cancel button to deny the request, and consult the app’s documentation.

That too may be forged by malicious software, so you need to be familiar with its layout and contents.

The simple summary is that, if you’re ever in any doubt that a request for a keychain or admin user password is completely genuine, click on Cancel or Deny, and check with the app concerned whether the request is expected.