Your pouch password

Your pouch’s key reaches your Macs through iCloud Keychain. That’s what lets a new Mac open your pouch without any setup, and it means your pouch is as safe as your Apple Account, the way Apple Passwords is. A pouch password adds a second lock: with it, someone who manages to restore your iCloud Keychain still can’t open your pouch.

Do you need one?

It’s optional, and off unless you add it. Add one if:

• you keep recovery codes, a seed phrase or anything else that would let someone into another account;
• more than one person uses your Mac account;
• you’d like your pouch to stay closed even if your Apple Account doesn’t.

Carriel requires one before it will hold your Apple Account’s own recovery key. Without it, the account that opens your pouch would be the account that key recovers.

Add one

1. Open Settings › Security in the Carriel window, and choose Add a Password… beside Pouch password. Carriel also offers this when you first set it up.
2. Type the password in Carriel’s own password panel, then confirm with Touch ID. The window never sees it.
3. Make a recovery key too, so a forgotten password isn’t the end of your pouch.

Choose something long that you don’t use anywhere else. Carriel suggests one: six random words from the BIP-39 list of 2,048 words, about 66 bits, easy to type and very hard to guess. You can type your own instead. Carriel doesn’t store your password. It stretches it with Argon2id, a deliberately slow and memory-hungry function, so each guess is expensive.

On your other Macs

Each Mac asks for the password once, when it first opens your pouch. After that it opens your pouch with Touch ID, like the Mac you added it on.

Change it

Choose Change… in Settings › Security. You don’t need the old password: a Mac that opens your pouch with Touch ID can set a new one, and your other Macs keep working.

If you forget it

• If any of your Macs still opens your pouch with Touch ID, change the password there. That’s all.
• If none does, open it with your recovery key, then set a new password.
• If you have neither, nobody can open your pouch: not you, not us. That is what the password is for, so keep a recovery key.

Turn it off

Choose Turn Off… in Settings › Security. Carriel asks for the password and Touch ID, because turning it off makes your pouch easier to open.