system_profiler SPHardwareDataType | grep 'Hardware UUID' | awk '{print $3}'
Thank you for your answer.If you run this command in Terminal is will show you the hardware UUID for your Mac. Then look in that keychains folder and if you have iCloud Keychain turned on there will be a folder there that matches that UUID. Inside that folder is the database for the iCloud Keychain. If you are backing up that keychains folder, it would include the iCloud database files.
Code:system_profiler SPHardwareDataType | grep 'Hardware UUID' | awk '{print $3}'
The passwords saved in the iCloud Keychain are shown in the Local Items keychain section of the Keychain application and are not duplicated in the login keychain. Notes are part of the login keychain though.
So there is a folder in the Keychains that matches my UUID with four files: keychain-2.db, keychain-2.db-shm, keychain-2.db-wal, and user.kb. You mean my iCloud-saved passwords are in those?
Also, I don't have a Local Items section in Keychain; only login, iCloud, System, and System Roots. Passwords saved in iCloud are only visible in the iCloud keychain.
Hmm, I'm not really sure that's the case. Here's what I just did:Yes... exactly.
I am on El Capitan and the iCloud keychain is called Local Items. I believe on earlier versions of OS X it was called iCloud like you are seeing on yours. I can't recall which OS X version this change happened.
Ah, glad that's sorted outHmmm... odd. Something must have happened when I updated to El Capitan then because I know mine was called iCloud before and I did and still do have iCloud Keychain turned on and it is now Local Keychain.
I just turned iCloud keychain off then back on and it renamed it back to iCloud in keychain like it used to be.
When you disable iCloud keychain you get an option to delete the passwords from the Mac. I did not try it, but I assume if you said to remove them the contents of that UUID folder would be removed.
No they are definitely separate and that UUID one is the iCloud keychain. If you open Finder and note the modified date/time of both then make changes to both keychains you can tell.Ah, glad that's sorted out
Actually, that didn't happen. I chose to delete the passwords from my Mac, and the contents of the UUID folder remained intact. So my guess is that it's one huge database residing in the files in the Keychains folder, i.e. everything in the login section, System section, etc. So no iCloud-specific files?
In that case it's strange that the contents of that folder weren't deleted when I disabled iCloud Keychain and chose to delete the passwords from my Mac. Because they were indeed gone from Keychain. Edit: But left was some application passwords, now in Local Items. So the content of the files must've gotten trimmed to reflect the new number of items in the keychain — a keychain that the iCloud and Local Items section share.No they are definitely separate and that UUID one is the iCloud keychain. If you open Finder and note the modified date/time of both then make changes to both keychains you can tell.