macOS Tahoe 26.4 Adds Entropy Files to Login Keychains and Backup Workflows

macOS Tahoe 26.4 made a consequential change to login keychains that’s easy to miss in the release notes: on systems running this version or later, keychain decryption depends on a protected entropy file as well as the user’s password. That alters what a usable backup or copy of a keychain needs to contain, and it has knock-on effects for Time Machine, Migration Assistant and command-line inspection.

The update was released on 24 March 2026. The details below add to an analysis published on release day. Apple’s documentation covers the user-facing changes, including eight new Emoji, alongside enterprise, developer and security notes:

• User release notes;
• Enterprise release notes;
• Developer release notes;
• Security release notes.

Keychains now depend on an additional file

For login keychains used in macOS 26.4 or later, the user password is no longer the only required input for decryption. A protected entropy file is also needed. In practical terms, a backed-up or copied keychain without its corresponding entropy file can’t be unlocked. Keeping the keychain file alone is therefore not enough to preserve access to its contents.

This is a change to the material required to recover a keychain, not a new user-facing password step described in the source. The distinction matters most when keychains are copied, restored or moved between Macs: the related entropy file must accompany the keychain through whichever workflow is being used. A backup that contains the keychain but omits that file may preserve the data without preserving the ability to decrypt it.

Apple describes the implementation in the final section added to Technical Note TN3137, “On Mac keychain APIs and implementations”. The note was first published on 1 November 2022 and updated on 24 September 2026. Apple cautions that its descriptions of implementation details aren’t part of the API and may change without warning. That caveat is important for developers and administrators: TN3137 helps explain observed behavior, but shouldn’t be treated as a stable interface contract.

System storage and backups

Tahoe 26.4 adds /var/db/SystemKeys, a directory protected by System Integrity Protection (SIP), to hold keychain entropy files. The directory can be accessed only when SIP is turned off. That access constraint makes this a system-managed part of the keychain arrangement rather than an ordinary location for users to browse or manage directly.

Time Machine’s handling changes along with the storage layout. Backups of Data volumes now include the protected directory and protect it in the backup. That connection is central to recovery: if a keychain requires an entropy file, preserving the file as part of the backup supports the keychain’s later use. The source doesn’t specify every restore scenario or configuration, so teams shouldn’t assume that all backup and recovery paths behave identically without testing their own process.

For anyone maintaining backup procedures, the practical check is whether the full workflow preserves both pieces: the keychain and its required entropy file. This is especially relevant when a process involves copying files outside Time Machine or restoring only selected data. The change makes the relationship between keychain recovery and system-level backup contents more explicit.

Migration Assistant and command-line inspection

Migration Assistant now copies required entropy files into /var/db/SystemKeys when performing a one-Mac migration from a backup. This is the mechanism that lets the corresponding keychains be unlocked after migration. Similar copying may occur during a two-Mac migration when needed, though the wording is cautious: that behavior may happen, rather than being described as universal.

That distinction is useful when planning migrations. A migration tool can account for required supporting files, but the available information doesn’t establish that every migration route handles every keychain case in the same way. If a move between Macs is part of a managed deployment or recovery plan, test the actual source, backup and destination combination rather than relying on the one-Mac behavior as proof of all paths.

The security command-line tool also gains a small but useful diagnostic option. show-keychain-info now accepts -s to display the salt for each file-based keychain. Where a keychain uses an entropy file, the reported salt is the name of that file. TN3137 explains and demonstrates the option, but the change hasn’t been added to man security.

For practitioners, that leaves a gap between the command’s behavior and its local manual page. The technical note is the available reference for this option, while the command can help identify the entropy-file relationship for a particular keychain. The broader takeaway from 26.4 is less about a new interface than about recovery dependencies: keychain handling now relies on associated system data, so migration and backup checks need to account for that data explicitly.

A volume-layout change to watch

The update also adds an empty pkg directory to the Data volume, with a firmlink to /pkg. The link appears non-functional until macOS 27. More detail is available in this account of the boot-volume structure change. For now, its presence is a filesystem observation, not evidence that users or administrators should expect a working /pkg location in Tahoe 26.4.

The keychain change has the clearest immediate operational consequence: preserve the entropy file alongside the keychain, and verify that the backup or migration path carries both. The open questions are how consistently less common migration routes handle those files and whether Apple’s command documentation will catch up with the new diagnostic option.