Crate keychainbreaker 

Parse and decrypt macOS Keychain files (login.keychain-db).

This crate is a Rust port of the Go library at https://github.com/moond4rk/keychainbreaker.

Quick start

use keychainbreaker::{Credential, Keychain};

let mut kc = Keychain::open_file("/path/to/login.keychain-db")?;
kc.unlock(Credential::password("hunter2"))?;
for entry in kc.generic_passwords()? {
    if let Some(pw) = &entry.password {
        println!(
            "{}@{}: {}",
            entry.account,
            entry.service,
            String::from_utf8_lossy(pw)
        );
    }
}

Keychain::password_hash can be called without unlock to export a hashcat-mode-23100 / John-the-Ripper hash for offline cracking.

Structs

Certificate

An X.509 certificate record. Certificates are not encrypted at rest; data is always populated when the keychain is opened successfully.

GenericPassword

A generic password record (services, applications, custom items).

InternetPassword

An internet password record (web sites, mail servers, file shares).

Keychain

A parsed (and possibly unlocked) macOS keychain database.

KeychainBuilder

Builder for Keychain when a custom Logger is needed. For the common cases without a logger, prefer Keychain::open_default, Keychain::open_file, or Keychain::open_bytes directly.

NopLogger

Logger implementation that discards every event. Used by default.

PrivateKey

A private-key record. data is the decrypted PKCS#8 key material.

Enums

Credential

A credential for Keychain::unlock / Keychain::try_unlock.

Error

All errors produced by the keychainbreaker crate.

Traits

Logger

Diagnostic logger used internally by the parser and unlock pipeline.

Type Aliases

Result

Convenience alias for core::result::Result with this crate’s Error.