You erased your Mac for a clean install of Golden Gate, copied your old login.keychain-db back from a backup, and added it in Keychain Access. It opens. Your password is accepted, or seems to be. But the passwords, secure notes and Wi-Fi keys you expected aren’t there, or the file is renamed and a new empty keychain appears in its place.

This isn’t a glitch you can fix with the right click. On Macs with a Secure Enclave, which includes every Apple silicon Mac, a keychain file copied by hand is no longer a reliable way to move or restore secrets. Here’s what changed, what still works, and how to make sure you aren’t relying on a backup that can’t be opened.

What changed

Mac admin Rich Trouton documented in September that copying a login.keychain-db file from one Secure Enclave Mac to another stopped working on macOS Tahoe. With the correct password, macOS still couldn’t unlock the copied file; it renamed it login_renamed_1.keychain-db and created a fresh login keychain, which is the standard fallback when a login keychain won’t unlock. Howard Oakley reproduced the same result.

The likely reason is that the keychain’s protection is now tied to hardware keys in the Secure Enclave. It is also possible that restoring to the same Mac fails after a clean install, because erasing the Mac erases those keys. Golden Gate hasn’t changed this.

Two things were already true before this:

  • The Local Items and iCloud keychains, where most website passwords live, have never been copyable as files. Apple’s own guide says so.
  • Keychain Access can export certificates and keys, but not passwords.

What still works

  • iCloud Keychain. If it was on, sign in with the same Apple Account on the new install and turn on Passwords & Keychain in iCloud settings. Passwords and passkeys sync back. This is Apple’s supported route.
  • Migration Assistant. Moving from one Mac to another, or restoring from Time Machine during setup, transfers keychains as part of the migration. It is the supported path for local keychains, unlike copying files by hand.
  • Exporting from the Passwords app. In the Passwords app, you can export your passwords to a file, and import them on another Mac or into another password manager. The file is unencrypted, so store it carefully and delete it when you’re done.
  • A separate password manager with its own encrypted export or sync is independent of the Mac’s keychain entirely.

If you’ve already done the clean install

  1. Don’t delete the old keychain file, even if it won’t open. Keep it, and the Time Machine backup, until you’re sure nothing is missing.
  2. Turn on iCloud Keychain if you used it before, and wait for passwords to sync.
  3. If you still have the old installation, on another disk or as a Mac you haven’t erased, start from it and export passwords from the Passwords app, or use Migration Assistant to move everything.
  4. Reset what you can’t recover. For accounts whose passwords are gone, use each site’s password reset. For two-factor codes that lived only in the keychain, use the backup codes each service gave you, or contact the service.

Test your backup before you need it

The real lesson is that a backup you’ve never restored is a guess. Spend five minutes now:

  • Check where your secrets live. Open the Passwords app and see whether your important logins are there. If you don’t use iCloud Keychain, they are in Local Items and exist only on this Mac.
  • Make a second, readable copy of anything irreplaceable: an export from Passwords stored somewhere safe, or a password manager with its own backup.
  • Keep two-factor backup codes for important accounts somewhere other than the Mac, such as printed and stored securely.
  • Never keep a recovery phrase or master secret only in the keychain. If losing the Mac’s keychain would lose you money or an account, it needs an offline backup.

The short version

On Apple silicon Macs, a login.keychain-db copied by hand won’t reliably open on another Mac or after a clean install, even with the right password. Use iCloud Keychain, Migration Assistant or a Passwords export to move secrets, and check today that your important passwords and two-factor codes have a copy you can actually open.