Touch ID for Terminal sudo#

Enable this and sudo prompts for your fingerprint instead of your admin password. It works in Terminal, iTerm2, VS Code, and any other terminal on the machine.

Requirements:

  • A Mac with a Touch ID sensor, or a Magic Keyboard with Touch ID.
  • An admin account.

Read this before you edit anything#

A syntax error in a PAM file can lock you out of sudo completely. There is no undo prompt. Protect yourself:

  • Open a second terminal window and run sudo -v in it before you start. Leave that window open. It holds an authenticated sudo session you can use to repair the file.
  • Only add the exact line shown below. Do not delete or reorder existing lines.

Method 1 — macOS 14 Sonoma and later (recommended)#

macOS 14 added /etc/pam.d/sudo_local. macOS updates do not overwrite this file, so the setting survives upgrades.

  1. Copy Apple's template into place.
sudo cp /etc/pam.d/sudo_local.template /etc/pam.d/sudo_local

  1. Enter your account password when prompted.

  2. Open the copy in nano.

sudo nano /etc/pam.d/sudo_local
  1. Find this line and delete the leading # and the space after it.
#auth       sufficient     pam_tid.so

The result must read:

auth       sufficient     pam_tid.so

  1. Save with Control + O, then press Enter to confirm the filename.

  2. Exit with Control + X.

  3. Test it. A Touch ID prompt appears instead of a password prompt.

sudo ls

Method 2 — macOS 13 Ventura and earlier#

Older macOS has no sudo_local. Edit /etc/pam.d/sudo directly.

A macOS update can overwrite /etc/pam.d/sudo and remove your change. Re-apply these steps after any major system update.

  1. Open the file.
sudo nano /etc/pam.d/sudo

  1. Enter your account password when prompted.

  2. Move the cursor to the line directly below the #%PAM-1.0 comment at the top.

  3. Add this line. It must sit above every other auth line.

auth       sufficient     pam_tid.so

  1. Save with Control + O, press Enter, then exit with Control + X.

  2. Test with sudo ls.

Why the order matters#

PAM reads auth rules top to bottom. sufficient means "if this rule passes, stop and allow". If pam_tid.so sits below pam_opendirectory.so, the password check runs first and Touch ID never gets a turn. Put it first.

Troubleshooting#

  • No prompt inside tmux or screen. These detach the process from the GUI session, so the Touch ID dialog cannot appear. Install pam_reattach and add it above the pam_tid.so line.
brew install pam-reattach

Then add this line immediately before pam_tid.so:

auth       optional       /opt/homebrew/lib/pam/pam_reattach.so
  • Apple Watch does not work. Unlock-with-Apple-Watch does not substitute for Touch ID at a sudo prompt. You must use the sensor.
  • Nothing changed. Confirm the file has no leading # on the line, and that the line is above the other auth entries. Then open a new terminal window — the change applies to new sudo invocations.
  • You are locked out of sudo. Use the second terminal window from the warning above to restore the file. If you did not open one, boot into Recovery Mode and repair /etc/pam.d/sudo from there.

Sources#