---
title: ezkey vs Keychain Access — ezkey.app
description: Both use the macOS login Keychain. Keychain Access is the system UI. ezkey is a menu bar extra for generic passwords with substring retrieve. Same file, different job.
---

# ezkey vs Keychain Access

Keychain Access is Apple’s app for every kind of Keychain item. ezkey.app is a tiny extra for generic passwords: save, retrieve by name or substring, reveal, copy. They can see the same login.keychain-db items when Name/Where and Account match. Use Access for certificates and ACLs. Use ezkey if you live on one Name field in the menu bar.

## Same database

ezkey opens `~/Library/Keychains/login.keychain-db` through Security.framework. Keychain Access shows that file as the login keychain. If you save `my-app-api-token` in ezkey, Access should list it with Name and Where set to that string and Account set to your user. The [glossary](/glossary/) is the field map.

## Different job

|  | Keychain Access | ezkey |

| --- | --- | --- |

| Scope | Passwords, keys, certs, notes | Generic passwords only |

| Find | Search box, lots of columns | Exact Name, then substring list |

| Always in the menu bar | No | Yes |

| Clipboard timer | No | 30 seconds if unchanged |

| Password to show a secret | Every time | Every time, even items it saved |

| ACL editor | Yes | No |

| Source | Closed, from Apple | MIT, github.com/edtadros/ezkey |

## When Keychain Access is better

Certificates, code signing identities, looking at Access Control, inspecting iCloud items. ezkey will not grow into that. If you need those tools, open Access. That is not a failure of ezkey. It is the division of labor.

Access is also the right place when an item will not delete, when two items share a confusing Where, or when you need to see which apps are trusted. ezkey will not show ACL entries. If Retrieve fails with a prompt you do not understand, open Access, find the item, and read Access Control. Then decide whether to allow it. Items ezkey saved list no trusted apps, so ezkey asks for your login password every time, even after Always Allow. That is on purpose. ezkey has no login of its own: without the prompt, anyone using your unlocked Mac could open ezkey and read your keys. Access asks the same way when you show a password.

## When ezkey is better

You save and retrieve a handful of API tokens every week. You know the Name. You do not want to hunt Kind columns. You want a masked field and a copy button. You want `security` to keep working. Then a menu extra that only does generic passwords is calmer than Access. Build it yourself. See [for developers](/for/developers/).

ezkey will not import a CSV of passwords. It will not show your Safari logins. If Access is open because you are hunting a Wi-Fi password, stay there. If Access is open because you cannot remember the `-s` string for a generic password you created last month, the extra’s substring list is the feature.

## Related answers

- [security add-generic-password](https://ezkey.app/guides/security-add-generic-password/): The CLI both of you sit on.
- [Save API keys securely](https://ezkey.app/guides/how-to-save-api-keys-securely-on-mac/): The actual procedure.
- [Keychain vs 1Password](https://ezkey.app/compare/macos-keychain-vs-1password-for-api-keys/): Different layer.
- [Security](https://ezkey.app/security/): Why ezkey asks for your password every time.

## Will an item I create in Access show up in ezkey?

If it is a generic password, account is your Mac user, and you search the Name/Where string, yes. Other item classes will not.

## Can ezkey edit Access Control lists?

No. Use Keychain Access.

## Does ezkey replace security(1)?

No. It is compatible with add/find-generic-password for the fields it uses.

## Why isn’t ezkey sandboxed?

A sandbox would store items where the security CLI cannot see them. Compatibility with CLI items is the point.