Kernel Seeds { News/Updates }

When I started writing Keychain in June 2001, I was 27 years old, living in Albuquerque, New Mexico, and writing articles for IBM developerWorks to support my young family. Gentoo Linux was a thriving new Linux distribution, still working its way toward 1.0. Portage was a young package manager, and I was in the middle of writing emerge while redesigning the Gentoo website.

I connected to the Internet through a 256K DSL modem. Wi-Fi existed, but it was still a new and optional technology. The fastest Power Macs used PowerPC G4 processors running below 1GHz and supported less than 2GB of RAM. Apple laptops were PowerBooks; the MacBook name did not yet exist. The iPhone was still six years away, and the original 5GB iPod was still several months away from being announced. September 11 had not yet happened.

It was in that world, while writing my OpenSSH Key Management series for IBM developerWorks, that I created a small shell script to make encrypted SSH keys and ssh-agent practical for everyday use. That script became Keychain. Keychain 1.0 was released in August 2001, and I formally introduced it to developerWorks readers in Part 2 of the series the following month.

On July 23, 2026, I released Keychain 3.0.0, marking 25 years of Keychain development. This was not a minor update, but a ground-up rewrite and rethinking of how Keychain should work in modern environments. Twenty-five years later, its central purpose remains the same: keep one long-running agent available across your terminals and sessions, so encrypted keys can remain secure without requiring you to enter the same passphrase over and over again.

Nearly everything around that central idea has been rebuilt.

What Keychain 3 Accomplished

The 3.0.0 release incorporates the work delivered through all three public Keychain 3 betas. Some of the key technical milestones include:

• A ground-up Python 3 rewrite without giving up single-file deployment. The historical Bourne shell implementation has been replaced by a tested, auditable Python package, distributed as a self-contained keychain.pyz with no third-party runtime dependencies. It runs on Python 3.9 or newer, can be copied directly into your path, and can simply be renamed to keychain.

• One coordinated agent experience across terminals and sessions. Keychain discovers, validates, starts, and reconnects to a long-running agent per user and host. Managed ssh-agent sockets now live at stable, host-specific paths under ~/.keychain/, avoiding fragile temporary socket directories.

• Coordinated multi-terminal initialization. When several shells discover missing keys at the same time, they cooperate instead of racing for a lock or displaying duplicate passphrase prompts. Any waiting terminal can take over an inaccessible prompt, and all participants are notified when key loading completes.

• A modern interface with strong 2.x compatibility. The action-oriented command surface includes add, agent, list, env, inspect, help, and man. Traditional Keychain 2.x invocations remain supported through an explicit compatibility layer; intentional differences are documented under keychain man topic:compat.

• Configuration, inspection, and documentation built into the tool. Persistent preferences can be stored in an optional ~/.keychainrc. The new keychain inspect action presents a detailed view of agent, runtime, configuration, permission, and environment state. The complete versioned manual ships inside the zipapp through keychain man, while --explain shows exactly how Keychain understands a particular command line.

• Broader key support. Keychain can load PKCS#11 providers for smartcards and hardware-backed SSH keys, and explicitly prove and warm native GPG signing and decryption capabilities instead of assuming that a credential operation succeeded.

• Native macOS confirmation support. Keychain 3 introduced a zero-dependency graphical Allow/Deny confirmation path for --confirm, built from facilities already included with macOS.

• Hardened state handling and testing. Agent sockets, pidfiles, locks, coordination state, and waiter endpoints are ownership- and permission-checked. Errors from malformed arguments, external commands, timeouts, and operating-system failures are presented cleanly rather than escaping as Python tracebacks. The test suite covers modern and legacy CLI behavior, real SSH and GPG integration, multi-terminal coordination, and platform-specific behavior.

The result is still recognizably Keychain: a focused tool that can be downloaded as one file, placed in your path, and used without introducing another service or dependency stack to manage. But underneath, it now has a modern foundation for testing, security hardening, documentation, and continued development.

Get Keychain 3

Download keychain-3.0.0.pyz from the Keychain 3.0.0 release page. You can run the .pyz directly, or install it under the familiar keychain name:

$ chmod +x keychain-3.0.0.pyz
$ sudo install -m 755 keychain-3.0.0.pyz /usr/local/bin/keychain
$ keychain inspect

You can also visit the official Keychain project home, read why Keychain moved to Python, or report issues on the GitHub issue tracker.

Twenty-five years after its initial release, Keychain is moving forward again.