password-sync

Two-way merge between Apple Passwords (iCloud Keychain) and Chrome (Google Password Manager) on macOS, so both browsers autofill natively — no iCloud Passwords extension, no 6-digit pairing codes.

Live sync between the two stores is architecturally impossible (iCloud Keychain is end-to-end encrypted to Apple devices), so this repo implements a periodic, semi-automated CSV merge instead. Each run needs you present for a few Touch ID touches — Apple requires a human for every export/import.

Contents

File	Purpose
Password Sync.command	Double-click entry point — primes macOS permissions once, then runs pw-sync
pw-sync	Orchestrator: exports both sides, merges, drives both imports, shreds CSVs
pw-merge.py	Merge engine: normalizes/joins the two CSV formats, resolves conflicts
pw-sync-daily	launchd-triggered dialog: asks daily, opens Terminal running pw-sync only on confirm
com.robbie.pw-sync.plist	LaunchAgent (daily at 10:00) — install per below

Install

# ~/password-sync is on PATH (see ~/.zshrc) — no symlinks
cp com.robbie.pw-sync.plist ~/Library/LaunchAgents/
launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/com.robbie.pw-sync.plist

First run (Chrome side empty): pw-sync --baseline Then remove the iCloud Passwords extension from every Chrome profile (chrome://extensions) — that kills the pairing-code prompts for good.

Usage

pw-sync                    # interactive conflict resolution
pw-sync --prefer apple     # auto-resolve conflicts, Apple wins
pw-sync --prefer chrome    # auto-resolve conflicts, Chrome wins

The daily LaunchAgent shows a dialog at 10:00; clicking Sync Now opens a Terminal running pw-sync. Later (or 5 min of no response) skips the day.

Behavior & guarantees

• Merge key is (host, username); www. and paths are ignored.
• Entries unique to one side are copied to the other.
• Same key + different password = conflict → prompt (or --prefer).
• Duplicate keys within one store are never touched.
• TOTP secrets (OTPAuth column) only exist on the Apple side and are preserved.
• Deletions never propagate — delete a login on both sides or it comes back.
• Plaintext CSVs live only in a chmod 700 dir under ~/Library/Caches, are securely deleted (rm -P) on exit via trap, and are gitignored.

What doesn't need syncing

• Passkeys — Chrome on macOS uses iCloud Keychain passkeys natively via the system Touch ID dialog; can't be exported to CSV and don't need to be.
• 2FA codes in Chrome — Google Password Manager can't store TOTP; fill with right-click → AutoFill → Passwords (Touch ID, no pairing code).