macOS keychain dump

security dump-keychain -d ~/Library/Keychains/login.keychain-db

Dumps the user's login keychain with decrypted passwords: internet credentials, WiFi keys, app passwords, and certificates with their private material, all in a single command with security.

When you have a shell as a macOS user and want their stored credentials: site passwords, WiFi networks, mail apps, VPN. If the keychain is already unlocked (active user session), -d returns the secrets directly; if not, it will prompt for the user's password or the keychain's.

If the keychain is locked and you don't know the password, the dump fails and leaves an attempt log. Also don't use it if discretion is the goal: keychain access generates TCC prompts and stays in unified logs, plus the command is one of the most monitored by macOS EDRs.