CSVKeychain AppleScript script

This repo contains scripts to export all your password items and secure notes from Apple's Keychain.app into plain text files in CSV format, merge such files and import them back into a keychain.

No trick or reverse engineering is used: exporting is performed by Apple's security tool, using macOS's assistive support to streamline the process.

The current master should work in (High) Sierra. Earlier versions of macOS/OS X are not supported.

How to use

To import/export password items, open the AppleScript script in Script Editor. The script may be run from source.

Before running the script, go to System Preferences > Security & Privacy > Privacy > Accessibility, and allow Script Editor to control your computer. This step is required to avoid SecurityAgent to prompt you with a dialog for each item you want to export. It basically allows AppleScript to press the Allow button in such dialogs for you.

You may also build the script into an application if you want. In this case, you must grant the app control of your computer in the same way.

The script always asks for the password to unlock your keychain (you recognise the dialog by the Script Editor icon). Since that dialog is not very secure, it is recommended that you change your keychain's password in Keychain.app before exporting your keychain, and restore the original password afterwards. You may also be asked to unlock your keychain by SecurityAgent (which you do by providing your keychain's password). So, you may have to enter your keychain's password once or twice. After that, SecurityAgent will keep prompting for a password for each exported item, but the script should fill it out for you automatically, so no further action from you will be required.

The script makes a backup of the keychain before importing or exporting data. Backups are timestamped and saved into the same folder containing the keychain. In any case, it is a good idea to keep a separate backup, just in case.

When importing items into a keychain, matching items already present in the keychain are overwritten if their timestamps are older than the timestamps of the items being imported. If there are items without timestamps in the CSV file, the script will ask the user what to do with them. Note that this will be asked once and the choice applied to all the items being imported.

Also note that all new or updated items are assigned the current time as their new timestamps. There is no possibility to retain the original timestamps from the CSV file.

Finally, access control lists are not exported.

Troubleshooting

If you get this error:

This script will be terminated prematurely because the following error has
occurred:

security: SecKeychainUnlock [...]: The user name or
passphrase you entered is not correct. (Error number: 51)

open Keychain.app and lock your keychain. Then, run the script again.

Merging files

A Ruby script is provided to merge two CSV files containing password data into one. See ./merge_csv.rb --help for the details.

Is it possible to export the Local Items (aka iCloud) keychain?

Note: the workaround described in this section does not appear to work in macOS High Sierra or later. You may have better luck with Get passwords from iCloud keychain directly and Get passwords from Safari.

Not directly. The Local Items keychain, located at ~/Library/Keychains/<UUID>/<name>.db, is a SQLite database containing obfuscated data, so its format is different from the format of a standard keychain. As far as I can see, security cannot dump such keychains, and I do not know of any tool that would do that.

You may proceed as follows:

1. In Keychain.app, create a new keychain: File > New Keychain…
2. Select the Local Items keychain in the sidebar, then select all the items (or the ones you want to export) and copy them by choosing Edit > Copy.
3. Select the keychain created at step one and choose Edit > Paste.

Such process is painful, though, because Keychain.app will keep asking for a password for each item. You may automate such process with a bit of scripting. For your convenience, the script that allows you to fill in the password prompts for you is reported below:

tell application "System Events"
	repeat while exists (processes where name is "SecurityAgent")
		tell process "SecurityAgent"
			set frontmost to true
			try
				keystroke "PUT YOUR KEYCHAIN'S PASSWORD HERE"
				delay 0.1
				keystroke return
				delay 0.1
			on error
				-- do nothing to skip the error
			end try
		end tell
		delay 0.5
	end repeat
end tell

You may run this directly from Script Editor. A similar approach can be used to export /Library/Keychains/System.keychain.

Note: Keychain.app won't allow you to paste some items (most likely, automatically created by the system, not yours). In such case, the snippet above will produce a script error and Keychain.app will show an error dialog, too. Dismiss both and run the script again. Repeat every time you get an error.

Migrate passwords and notes into KeePass

If you want to import the CSV file generated by CSVKeychain into a KeePass 2 database and you are on macOS, you may need to convert it to XML first. For such purpose, add a category column to the CSV file using the included add_category.rb script. Then, use my csv2keepassxml to generate a KeePass 2 XML file.

License

Copyright (c) 2011–2018, Lifepillar

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.