Secure input on a Mac: why some apps go blank to key displays
Secure input is a macOS protection that sends your keystrokes only to the app you are typing in, so no other app can watch them. Password fields turn it on while they have focus, and Terminal’s Secure Keyboard Entry keeps it on for everything you type in Terminal. While it is on, key displays, text expanders and every other app that watches the keyboard get nothing, which is why an overlay goes blank. If it goes blank in every app, something has left secure input on, and one Terminal command tells you what.
What secure input is
Most of the time, an app with the right permission can watch the keyboard. That is how a key display knows which key to light, and how a text expander knows you typed its abbreviation. Secure input is the exception. When an app turns it on, macOS delivers keystrokes only to the app with keyboard focus and keeps them from everything else until that app turns it off again.
It comes on in a few common places:
- Password fields. A standard password field turns secure input on while it has focus and off when you leave it. That covers the password prompts macOS itself shows, the password fields in most Mac apps, and the password boxes on web pages in Safari and other common browsers.
- Secure Keyboard Entry in a terminal. Terminal has a Secure Keyboard Entry item in its Terminal menu. While it has a checkmark, nothing you type in Terminal reaches other apps. iTerm2 has the same item in its iTerm2 menu. Even with it off, Terminal turns secure input on by itself while sudo or ssh asks for a password.
- Apps that handle secrets. Any app can turn secure input on, and apps that deal with passwords use password fields for the parts that matter, such as a password manager asking for its main password.
It protects the keys, not the screen. A password shown in plain text, through a “Show password” box or an eye icon, is visible to anyone watching or recording the screen.
What it looks like from a key display
There are three patterns, and each points to a different cause:
- The overlay goes quiet in a password field and picks up again when you leave it. That is secure input working as designed.
- Typing never shows in Terminal or iTerm2, but shows everywhere else. Secure Keyboard Entry is on in that app.
- Typing stops showing in every app, and your text expander app stops working at the same moment. Some app has turned secure input on and not turned it off.
Typebar uses the Accessibility permission to see which keys you press, and secure input keeps keys from every app that watches the keyboard, so no setting in Typebar or in any other key display gets around it. That is the point of it. What Typebar does is tell you why it has gone quiet: when macOS marks a field as secure, nothing typed shows and the pill says “Typing hidden in a password field”. In a recording, that line tells your viewers the overlay is working and the password stayed private.
Not every blank overlay is secure input. Typebar’s own privacy settings hide typing on purpose too:
| What you see | Why | What to do |
|---|---|---|
| Nothing typed shows in a password field | Secure input, by design | Nothing |
| Nothing typed shows in Terminal or iTerm2 | Secure Keyboard Entry is on | Turn it off for the recording |
| Nothing typed shows in 1Password, Bitwarden, Keychain Access or Passwords | Typebar’s “Hide typing in these apps” list | Leave it; shortcuts still show |
| Letters show as dots | Hide letters is on in Settings > Privacy | Turn it off if you want letters |
| Nothing shows or plays at all | Typebar is paused | Choose Resume |
| Nothing typed shows in any app | An app has left secure input on | Find it, below |
Find the app that holds secure input
macOS has no window that shows which app holds secure input, but the system records the process that turned it on. Open Terminal and run:
ioreg -l -w 0 | grep -o '"kCGSSessionSecureInputPID"=[0-9]*'
If it prints nothing, secure input is off and the blank overlay has another cause. If it prints a line such as "kCGSSessionSecureInputPID"=612 (sometimes the same line twice), the number is the process ID of an app that has asked for secure input. More than one app can ask at once, so after you deal with the one it names, run the command again. To turn the number into a name, run this with your number in place of 612:
ps -p 612 -o comm=
It prints the path of the program, which usually makes the app obvious. You can also find the number in the PID column of Activity Monitor, in Applications > Utilities.
Two results are worth recognizing:
- Terminal. If you run the command in Terminal with Secure Keyboard Entry on, it reports Terminal itself. Choose the menu item again to turn it off, then run the command again.
- loginwindow. A path ending in
loginwindowis the part of macOS that draws the login and lock screens. It sometimes keeps secure input after the lock screen has gone.
Turn it off
Only the app that turned secure input on can turn it off. No key display can do it for you, and that is deliberate: a protection any app could switch off would protect nothing. So the fix depends on what the command found.
- An app with a password field. Switch to it and close the window or sheet asking for a password, or click into a different field. If it names your browser, look for a sign-in page with its password box selected. If it stays on, quit the app and open it again.
- Terminal or iTerm2. Choose Secure Keyboard Entry in the Terminal or iTerm2 menu to turn it off.
- loginwindow. Lock the screen with Control-Command-Q (⌃⌘Q), then sign back in with Touch ID or your password. If that does not clear it, log out and back in.
- Nothing else works. Restart the Mac.
Run the ioreg command again afterwards. When it prints nothing, keys reach your key display again, and your text expander works again too.
Recording a terminal tutorial with Secure Keyboard Entry on
Secure Keyboard Entry is a sensible everyday setting if you type passwords and tokens in Terminal, and it leaves a terminal tutorial with a blank overlay. You do not have to choose one for good:
- Before you record, turn off Secure Keyboard Entry in the Terminal menu.
- Around password prompts, know what your terminal does. Terminal turns secure input on by itself while sudo or ssh asks for a password, then puts your Secure Keyboard Entry setting back, so the key display goes quiet for the password. Other terminal apps may not do this, so test once with a harmless prompt before you record. If the keys show, turn that app’s Secure Keyboard Entry on for those moments, or pause the overlay: in Typebar, choose Pause from the menu bar menu or press the Pause shortcut you set in Settings > Privacy, then Resume once you are past the prompt.
- When you finish, turn Secure Keyboard Entry back on.
Record a terminal session that shows every key you press covers the rest of a terminal recording, and Show keys in a recording without leaking a password covers the logins that are not in Terminal.
What secure input means for privacy
Outside secure input, a key display sees ordinary typing: anything you type outside a secure field is visible to apps you have given Accessibility or Input Monitoring permission. That is why it matters which apps you allow, and what they do with what they see. Why a keyboard overlay needs Accessibility permission on a Mac explains the permission itself.
Typebar needs only Accessibility, and nothing you type is saved or sent anywhere. For the places secure input does not cover, it adds the hidden apps list, Hide letters and Pause. It is $9 once for up to 5 Macs, with a free 24-hour trial.
Questions
Is secure input a bug?
No. It is a macOS protection for passwords, and it is doing its job when a key display goes quiet in a password field. The problem is an app that turns it on and leaves it on after you have moved on.
Why does my text expander stop working at the same time as my key display?
Text expander apps watch your typing the same way key displays do, so secure input blocks both. When one stops in every app, the other usually has too, and the ioreg command above finds the cause for both.
Should I leave Secure Keyboard Entry on in Terminal?
If you type passwords and secrets in Terminal and rarely record it, it is a reasonable default. Turn it off only while you record, and back on afterwards.
Can Typebar show my password if secure input is on?
No. macOS never hands it the keys, so there is nothing to show. In a password field, the pill says “Typing hidden in a password field” instead.