Password · guide

Forgot macbook password, and what a reset quietly costs

By Alberto Gulotta · Updated 16 September 2026 · 17 min read

Forgot macbook password: restart, then enter a password up to three times and click the question mark beside the field. Apple offers one of three reset routes there, and macOS Recovery holds a fourth. The account comes back in minutes. The saved passwords do not.

Which password the Mac is asking for, and what each one opens
Password	What it unlocks	If you have lost it	Source
Your Mac login password	The user account on this machine	Resettable, by three routes below	Apple
Your Apple Account password	iCloud, purchases, and one of the reset routes	Reset separately, on Apple’s account pages	Apple
Your FileVault recovery key	The encrypted disk, when nothing else will	Asked for during recovery; without it the reset may not complete	Apple
Your login keychain password	Every password Safari and the system saved for you	Not reset with the account. A new, empty keychain is created instead	Apple

Apple’s three messages, word for word. The question mark only appears after a password has been entered up to three times, which is the reason it can look absent.

Restart, and get to the login window. Apple’s instruction for a Mac that will not restart normally: “press and hold the power (or Touch ID) button on your Mac for up to 10 seconds, until your Mac turns off. Then turn it on again.”
Type it once more, deliberately. Apple asks for three specific checks before anything else: that it is the login password and not “the password, email address, or phone number of your Apple Account”; that Caps Lock is off, because “the password field shows a Caps Lock symbol”; and that the Input menu is “set for the correct language”.
Enter a password up to three times, then look for the question mark. The reset offer is not there at first. Apple: check again “after entering a password up to three times”. Clicking the question mark then shows a hint, or a reset message.
Read which reset message you were given. Apple lists three, and they are not interchangeable: “Restart and show password reset options”, “Reset it using your recovery key”, or “Reset it using your Apple ID”. Which one appears depends on how the Mac was set up, not on what you would prefer.
If there is no message at all, go to Recovery. Start up from macOS Recovery, and when asked to select a user whose password you know, click “Forgot all passwords?” — the button that leads to the same reset from the other side.
Answer the prompts as they come, including the awkward ones. Apple names them: signing in to your Apple Account, selecting the startup disk, entering the FileVault recovery key, allowing the Mac to deactivate — “this is temporary” — and allowing it to “create a new keychain to store the user’s passwords”.
Set the new password, restart, and then deal with the keychain. The account is back. The saved passwords are not, and the section below is about that.

Four moves, in Apple’s order. Leaving the third out leads to Recovery for a reset the login window would have offered.

Two things that are not options, whatever else you read

There is no way past the login password itself. Apple’s opening paragraph offers one verb and it is not the one people arrive looking for: “if you can’t remember the password to log in to your Mac, or the password doesn’t work, you might be able to reset the password.” Reset, not bypass. Anything advertised as removing the password without one of Apple’s routes is either about a much older Mac or is not what it says it is.

And a locked account is a wait, not a fault. If the Mac says the account is locked after repeated attempts, Apple’s instruction is to “wait until the stated time has elapsed, then restart your Mac and try again”. Continuing to type is the one thing that extends it.

The FileVault recovery key is the branch that decides how the afternoon goes. It is generated once, at setup, and Apple asks for it by name during the reset: “if asked to enter your recovery key, enter the letters and numbers of the recovery key. A recovery key does not include the letters I (i) or S, or the numbers 1 or 0.” Those four exclusions are worth reading twice by anyone transcribing a key off paper. If it was saved to your Apple Account the reset proceeds; if it was printed and lost, the reset may not complete at all — unless the Mac is new enough for the route Apple added below. That is still the best argument for writing it down somewhere physical today rather than looking for it on the day it is needed.

The sentence on the right is Apple’s, from inside the reset procedure. It is the part worth reading before you start, rather than after.

The keychain, which is the real cost of a reset

The account comes back in a few minutes. What does not come back is the list of every password the Mac had saved for you, and Apple says so inside the procedure rather than before it.

Apple’s own wording, mid-reset Among the prompts it lists: “if asked to create a new keychain to store the user’s passwords, allow your Mac to create a new keychain.” New, because the existing one is locked with the login password you no longer have, and changing the account password does not change the keychain’s.

Which means the saved passwords are not lost, they are shut The old keychain file stays on the disk. It opens only with the old password. If the old password comes back to you later — and it often does, once the pressure is off — there is something to open. Wiping the Mac to tidy up is the move that turns shut into gone.

And it is the gap in the coverage of this question Of the five results on the first page for this question on 29 August 2026, the longest runs to about 2,300 words and does not use the word keychain once. Counted on their text as it reached us that day, not estimated. The procedure is well covered everywhere; the thing it costs is covered almost nowhere.

Why the question mark hides. By the time this is worth searching for, the password has usually been typed a dozen times and the field has done nothing but shake. Apple’s page explains the timing in a single line: if there is no reset message or question mark, “check again after entering a password up to three times”. The offer is deliberately delayed. So the first useful move is not a clever one — it is to type something wrong three times on purpose and then look at the field again.

The three messages are a description of your setup, not a choice. A Mac linked to an Apple Account during setup gets the Apple ID route. A Mac with FileVault turned on and a key saved locally gets the recovery key route. A Mac that has neither gets the restart route into Recovery. Reading which message you were given tells you what the machine already knows about you, and it stops the search for a route that was never enabled.

What FileVault changes, and the one number worth writing down. With the disk encrypted the password stops being a gate on the account and becomes part of how the volume is opened: Apple “uses the AES-XTS data encryption algorithm to protect full volumes on internal and removable storage devices”, the mode NIST approved in Special Publication 800-38E “as an option for protecting the confidentiality of data on storage devices”. What matters on the afternoon is the fallback: when FileVault is turned on “a recovery key is generated. The recovery key is a sequence of 24 random numbers and letters.” And Apple is explicit that it is not interchangeable with the other Apple thing of the same name: “a FileVault recovery key is a 24-character alphanumeric code created when FileVault is turned on. It’s not the same as an Apple Account recovery key.” Two 24-character strings, two different jobs, one of which will not open your Mac. And there is now somewhere else to look before giving up: “if you don’t have your FileVault recovery key, but the Mac requesting it is using macOS Tahoe 26 or later, the key might be available in the Passwords app on one of your other devices, such as an iPhone, iPad, or other Mac.” The other device has to be signed in to the same Apple Account with iCloud Passwords & Keychain turned on — which is the same arrangement the security guide describes from the other end: the key “is stored in the keychain so that it can be retrieved using the Passwords app”.

Why changing the password does not take an hour. The volume is not re-encrypted when you reset. Apple designed it so users can “change their password (and in turn the cryptographic keys used to protect their files) without requiring reencryption of the entire volume” — the password unlocks a key rather than being the key. That is the same architecture that explains the keychain: what a reset replaces is the wrapping, and anything wrapped with the old password stays wrapped.

And the thing to do once you are back in. Change the password to one you will not lose again, and put it somewhere physical — written on paper, in a drawer, in handwriting. A Mac login password is not a password you can store in a password manager, because the manager lives behind it. That is the whole awkwardness of this particular one: it is the password that has to exist outside every system that could remember it for you.

The reset routes, the three-attempt rule, the prompts during recovery, the new-keychain sentence, the 24-character recovery key and the statement that the password can be reset but not bypassed are quoted from Apple’s support page, read on 7 September 2026; the encryption algorithm and the reason a reset does not re-encrypt the disk are quoted from Apple’s Platform Security guide, read the same day. What XTS-AES is approved for is quoted from NIST Special Publication 800-38E. The count of how often the first page of results mentions the keychain is ours, made on their text.

Where to start

Four ways in.

“There is no reset option on screen.”: It appears late — the three routes
“It says my account is locked.”: That is a wait — see what is not an option
“It is asking for a recovery key.”: FileVault — what is not an option
“I am back in, and Safari forgot everything.”: The keychain — the keychain

The three routes

An Apple Account link, a FileVault recovery key, or the restart into Recovery. Which one appears is a fact about your setup, not a preference.

Sharing a wifi passwordTwo routes, and the difference between giving access and giving the password itself.Open this guide → Saved passwords on an iPhoneWhere the phone keeps what it saved, and who else can open the list.Open this guide → The Opera password managerThe third drawer: what a browser keeps, and the two questions Opera never answers about it.Open this guide → The Firefox password managerWhere Firefox keeps its copy, and the Primary Password nobody warns you about.Open this guide → The Apple password managerTwo names, one drawer, and a ten-attempt limit written into firmware.Open this guide → Is Bitwarden safeTwenty-five published audits with the auditors named, and the password nobody can reset.Open this guide → Backing up a MacBookWhat a backup covers, how long it takes, and the step that is easy to leave out.Open this guide →

What is not an option

The login password cannot be bypassed, only reset. A locked account is a timer. And the recovery key is the branch that decides the afternoon.

Password-protecting a folderWhat device encryption covers, and where its recovery key is written down.Open this guide → Two-factor and two-stepWhat the standard asks for, and why the two names describe one thing at two widths.Open this guide → After a data breachWhat a leaked list is worth, and the order to work in once yours is on one.Open this guide → Erasing a locked iPhoneThe same sentence on the phone: the passcode is reset, never bypassed.Open this guide →

The keychain

A reset creates a new, empty keychain. The old saved passwords are not deleted; they stay locked behind the password you could not remember.

When an authenticator stops workingThe clock, the app version, and the feature that was withdrawn rather than broken.Open this guide → Turning two-factor offWhere the option still exists, and the two clean-ups afterwards.Open this guide → Identity theftWhat can be done with the pieces already public, and how the first hour goes.Open this guide → A ChatGPT passwordThe Apple Account password again, this time as the thing standing behind a ChatGPT sign-in.Open this guide →

Afterwards

A Mac login password is the one that cannot live in a password manager, because the manager lives behind it. Paper, in a drawer, in handwriting.

What a network security key isThe other secret a machine asks for, and the protocol that decides its worth.Open this guide → Malware, in plain termsWhat the word covers, how it arrives, and the part that is not technical at all.Open this guide → Your digital footprintWhat is already public about you, and which parts can be taken down.Open this guide →

Questions people also ask

What do I do if I locked myself out of my MacBook?

Restart, type the login password once more with Caps Lock and the input language checked, then enter a password up to three times and click the question mark beside the field. Apple offers one of three reset messages there; if none appears, start up from macOS Recovery and click “Forgot all passwords?”.

Can I reset a MacBook password without an Apple ID?

Sometimes. The Apple Account route is only one of three: the other messages Apple lists are “reset it using your recovery key” and “restart and show password reset options”. Which you get depends on how the Mac was set up.

Do I lose my files when I reset the password?

No. The account and the documents stay. What does not survive is the login keychain: Apple asks you mid-reset to “allow your Mac to create a new keychain”, and the saved passwords in the old one stay locked behind the password you forgot.

Why is there no question mark next to the password field?

It usually appears only after a few attempts. Apple: check again “after entering a password up to three times”. If it still does not appear, restart and try again, then go to Recovery.

Can I get into a Mac without the password at all?

No. Apple: “if you can’t remember the password to log in to your Mac, or the password doesn’t work, you might be able to reset the password.” Reset is the only verb on the page.

Not covered here. It will not cover a Mac managed by an employer or a school, where the reset routes are controlled centrally and the help desk is the shorter path.

It will not cover a locked Apple Account, which is a separate recovery with its own waiting period.

And it will not offer a way in without the password. Apple says there is not one, and the tools that claim otherwise are selling something else. What holds instead is simple: the reset routes and the sentence about the new keychain are quoted from Apple’s own support page and Platform Security guide with the date each was read, and the counts were made on the sources themselves.

Locked out of an account, in four places

The same evening, four different companies. Each one publishes a condition that decides whether you get back in, and none of them shows it on the screen where the attempt fails.

The same job, in the other places it comes up: How to reset Gmail password when recovery keeps refusing; How do I change my Facebook password, and what stops a reset; How do I change IG password, and what the reset email hides; How to factory reset iPhone without password or computer: 3 ways; Microsoft Authenticator app not working, and why the clock comes first

Sources

Apple Support — If you forgot your Mac login password: the three-attempt rule, the three reset messages, the Recovery route, the prompts including the FileVault recovery key and the new keychain, that a recovery key contains no I, S, 1 or 0, that the FileVault recovery key is a 24-character code and is not an Apple Account recovery key, that on macOS Tahoe 26 or later the key may be found in the Passwords app on another device signed in to the same Apple Account, and that the only route Apple offers is to reset the password — support.apple.com, read 16 September 2026.
Apple — Platform Security, Volume encryption with FileVault: the AES-XTS algorithm, the 24-character recovery key, that it can be viewed in System Settings and is stored in the keychain for the Passwords app, where it can be escrowed, and why changing the password does not re-encrypt the volume — support.apple.com, read 16 September 2026.
NIST Special Publication 800-38E — Recommendation for Block Cipher Modes of Operation: the XTS-AES Mode for Confidentiality on Storage Devices: the approval of the mode used by FileVault, and its stated limit that it does not authenticate the data or its source — csrc.nist.gov, read 7 September 2026.

Written by Alberto Gulotta

Founder and editor of AI Tools Primer, writing from Palermo, Italy. Thirty-five years of taking computers apart, starting with a Commodore 64 — the long version is on the about page.

Something wrong on this page? Write to aitoolsprimer@gmail.com and it gets fixed.

Written on 7 September 2026 · last checked 16 September 2026.

Independence and limits

No affiliate links and no paid placements anywhere on this site. Nobody pays to appear here, and no company has seen this page before you did.

This is general information, not professional advice. Where a page touches money, health, safety or the law, it names its source and the date it was read — and your situation may still differ. See the privacy page and the cookie policy.