Touch ID in Third-Party Mac Apps: Which Support It and What to Do When They Don't

A third-party Mac app can only use Touch ID if its developer built it in through Apple's biometric APIs, so there is no system switch that adds it to every app. Some apps have a setting for it, such as 1Password, Bitwarden and KeePassXC, and Terminal can accept it for sudo after a one-line config change. For any app with no Touch ID option, the only way to get it is an external lock such as Lockish, which asks for Touch ID before the app opens.

Why doesn't Touch ID just work in every app on my Mac?

Touch ID is a sign-in check that apps request. When an app wants to confirm it's really you, it calls Apple's LocalAuthentication framework, and macOS shows the familiar fingerprint prompt. Your fingerprint data never reaches the app. The app only gets a yes or no.

The catch is that the app has to ask. If a developer never added that call, the app opens for anyone at your keyboard. The toggles in System Settings → Touch ID & Password (unlock your Mac, Apple Pay, App Store purchases, Passwords autofill, fast user switching) only cover Apple's own features. They don't extend to third-party apps.

Touch ID also needs a Mac with a sensor: a MacBook, or a desktop with an Apple Magic Keyboard with Touch ID (Apple silicon Macs). Without one, apps fall back to your login password.

Which popular third-party apps have a Touch ID setting?

Most of the apps that support Touch ID store secrets, so it's worth checking these first:

• 1Password: Settings → Security → Unlock using Touch ID.
• Bitwarden (desktop app): Settings → Unlock with Touch ID. If you use the browser extension too, the desktop app has to be set up first for the extension to use biometrics.
• KeePassXC: has a Touch ID quick-unlock option in its security settings.
• Terminal and iTerm2: not an app setting, but Touch ID can approve sudo (next section).

Two things to know. First, this usually unlocks the app after it has locked itself, rather than stopping it from opening. Second, it only exists where the developer chose to add it. Banking apps, messaging apps, notes apps and most utilities have no such option. For the password-manager details, see how to lock a password manager with Touch ID.

How do I use Touch ID for sudo in Terminal?

Since macOS 14 (Sonoma), Apple ships a template that survives system updates. Editing the old /etc/pam.d/sudo file gets overwritten on update, so use this instead:

bash sudo cp /etc/pam.d/sudo_local.template /etc/pam.d/sudo_local sudo nano /etc/pam.d/sudo_local

In the file, remove the # at the start of the line containing pam_tid.so, so it reads:

auth sufficient pam_tid.so

Save, open a new Terminal window, and run any sudo command. You should get the Touch ID prompt, with the password as a fallback. It won't work over SSH. Inside tmux it needs an extra helper (pam_reattach), so don't be surprised if it falls back to the password there.

What if the app has no Touch ID option at all?

Your choices:

1. Lock the whole Mac (⌃⌘Q). It's free and built in, but all-or-nothing. Your music, downloads and everything else stop being usable by anyone else too.
2. Use a separate macOS user account for whoever else uses the Mac. Strong separation, but clunky for a quick "can I borrow your laptop".
3. Put the lock outside the app. This is what Lockish does. It covers a protected app with an overlay and asks for Touch ID (or your login password on a Mac without a sensor) before you can use it. The app itself needs no support for any of this.

People tell me they buy Lockish for exactly this gap: locking a password manager or a banking app on a shared or family Mac without locking everything else. Here is what it does in practice:

• Every window of a locked app is covered as it appears, on every display.
• Keystrokes and shortcuts can't reach a locked app.
• You choose an idle timeout per app, from 10 seconds to 60 minutes.
• Apps lock when the screen locks or the Mac sleeps.
• ⌘L locks everything at once.

It needs macOS 14.0 or later and one permission, Device Control and Data Access (called Accessibility before macOS 27). It never asks for Screen Recording. It costs $9.99 once after a 7-day free trial with no card, and there's no tracking in it; everything runs on your Mac.

Is app-level Touch ID actually secure?

It depends on what you're guarding against. It's good against someone who walks up to your unlocked Mac, such as a flatmate, a coworker or a child. It is convenience protection, not hardened security. A determined attacker with admin access to your Mac could work around any app lock, Lockish included. It also doesn't replace FileVault, which encrypts your disk. Turn FileVault on in System Settings → Privacy & Security → FileVault, and treat app locking as the layer on top.

For how this compares with Apple's own controls, see Screen Time vs app lock. For the wider approach, see protecting sensitive apps with Touch ID.

Common questions

Can I make every app on my Mac ask for Touch ID?

Not with a built-in setting. macOS has no per-app lock, and apps only show a Touch ID prompt if their developer added one. A tool like Lockish can add the prompt to any app you choose, from outside the app.

Why does my app say Touch ID is unavailable?

Usually the Mac has no sensor, for example a desktop Mac with no Touch ID keyboard, or the lid is closed on a docked MacBook. Check that fingerprints are enrolled in System Settings → Touch ID & Password. On Apple silicon desktops, a Magic Keyboard with Touch ID fixes it.

Does Touch ID work for third-party apps on Macs without a sensor?

The prompt falls back to your Mac's login password. Apps that rely only on biometrics, with no password fallback, won't offer it at all. Lockish, for instance, asks for your login password when there's no Touch ID.