Need help with firmware_password_manager?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

127 Stars 24 Forks MIT License 40 Commits 0 Opened issues


A Python script to help Macintosh administrators manage the firmware passwords of their computers.

Services available


Need anything else?

Contributors list

# 265,893
39 commits

Firmware Password Manager 2.5

A Python script to help Macintosh administrators manage the firmware passwords of their computers.



Download the latest installer here!


If you have any comments, questions, or other input, either file an issue or send us an email. Thanks!

System Requirements

  • Python 3.7+ (which you can download here)
  • Pexpect 3.3+ (which you can download here)
  • Pyinstaller (which you can download here) Only needed if you wish to rebuild either binary.


Place the script (or binary) in a root-executable location. We use

. Make sure it is executable.


Remove the script/binary/application.


Why set the Firmware Password?

In a nutshell, the firmware password in Apple computers prevents non-privileged users from booting from a foreign device.

The firmware password is one of three interlocking methods used to secure Apple computers. The other two are: using strong passwords on user accounts and FileVault to apply full disk encryption (FDE). Strong account passwords are always the first line of defense. FDE effectively scrambles the information written a storage device and renders it unreadable by unauthorized persons. Using all three methods can make a computer unusable should it be lost or stolen.

Depending on the age of computer, removing the firmware password can be easy or incredibly difficult, please refer to the Notes section for more information about removing the password.

Firmware Password Manager

When I began this project there wasn't a solution available for actively managing firmware passwords, other than the "set-it-and-forget-it" method. This approach seems error-prone and difficult to maintain beyond more than a small handful of machines. My solution centers on maintaining a single list of current and formerly used passwords that I call the keyfile. This approach allows the administrator to easily bring any number of machines up to the current password, and identify those whose firmware passwords aren't in the master list and need additional maintenance.
will use your keyfile to set a firmware password on a machine with no existing firmware password, attempt to change the existing firmware password to your new password or remove the current password. The script is best used when it can be installed and left on the machine for future use. This allows the admin to then create an installer package containing the keyfile and a postflight action to run FWPM. Or the admin could create a launchagent to run FWPM at every boot

Version 2 represents a complete rewrite of Firmware Password Manager (FWPM). The previous version, a shell script, always felt brittle to me. The new version is written in Python. I also focused on utilizing

, rather than the outdated

How FWPM keeps track of the current password

When FWPM successfully sets or changes the firmware password it computes a hash based on the contents of the keyfile and stores the results in nvram. When FWPM is run again on a client it will compare the hash of the current keyfile and the hash stored on the machine, if they are different it will signal the need to change the firmware password to a new value.

A hash can be thought of as the finger print of a file. The goal of a hash function is that no two files will share the same hash value. FWPM uses SHA-256 to generate the hash, or the SHA-2 hash function at a length of 256 bits (32 bytes). Rather than simply hashing the password itself, FWPM hashes the entire keyfile for additional security.



firmware_password_manager [-h -v] [-c /path/to/configfile]




| Prints help information and quits.
| Prints version information and quits.
--configfile CONFIGFILE
| Specifies the location of the required configuration file.

The configuration file

Here is the default configuration file included with FWPM:

use_firmwarepassword: yes
management_string_type: hash

[keyfile] path: /YourVolume/this/location/example_keyfile.txt use_obfuscation: No remote_type: smb server_path: server_path username: user_name password: pass_word

[logging] use_logging: true log_path: /tmp

[slack] use_slack: true slack_identifier: hostname

slack_info_url: slack_info_channel: #fwpw_manager_info slack_info_bot_name: FWPM informational message

slack_error_url: slack_error_channel: #fwpw_manager_errors slack_error_bot_name: FWPM error message

The configuration file is broken up into sections roughly approximating the command line flags used in the previous versions.



Type Purpose
usefirmwarepassword Boolean Turn FW password on or off.
managementstringtype String Select the type of management string to use: hash or customstring. Hash will be used if no value is present. customstring will use the value in the following variable.
customstring String If you elect to use customstring, enter it here.
userebootonexit Boolean If you want FWPM to force an immediate reboot on success.



Type Purpose
path String Path of the keyfile to be used.
useobfuscation Boolean Use keyfile obfuscation.
remotetype String The remote server address to be used.
server_path String The path of the keyfile on the server.
username String User with adequate privileges on the server to access the keyfile.
password String Password for the user.



Type Purpose
uselogging Boolean Create a log file for FWPM.
logpath String Path of the log file.



Type Purpose
useslack Boolean Use Slack messaging.
slackidentifier String Method of identifying the message sender on Slack.
slackinfourl String Slack URL for informational messages.
slackerrorurl String Slack URL for error messages. If not defined messages will be directed to the info channel.

The keyfile

The script works with a text document I call the keyfile. It contains the new password, as well as any previously used passwords. Having previously used passwords available allows the script to update machines that may have been missed during previous runs of the script.

The script requires a specific format for the keyfile. Each line contains the following: a note string, a colon, and a password string. I assume the newest passwords will be at the end of the file, and the script will try those first. Only the

note has a special meaning, others are ignored.

Here is the keyfile format:


new the new password to be installed.
note any other note strings cause the password to be treated as previously used.

new|a hash mark will cause the password to be treated as a previously used entry.

Here's an example keyfile: ``` previous:mGoBlue other:brownCow


new:goUtes ``

Version 1 made use of the
current` note to designate what was thought to be current password. Version 2 discovers the current password on its own and will ignore this note.


The keyfile contains, of course, incredibly sensitive information. When the script successfully completes or encounters an error, it attempts to securely delete the keyfile from the disk.

Slack integration

We make heavy use of Slack in our office. The

option directs FWPM to send informational messages to a slack channel. You simply need to add the URL and channel information for your Slack group to the script. Please see Slack's documentation for additional configuration options:

This image shows example FWPM messages in Slack:



option allows you to select how machines are identified in Slack messages. This feature request was issue #2. These flags are mutually exclusive.


IP The IP address of the machine is used. Previous default.
MAC The MAC address of the current device is used.
computername The computername is used.
hostname The fully qualified domain name is used.
serial The machines serial number is used. If an error occurs discovering the previous methods, FWPM will fall back to this method.

nvram string

To make the most of FWPM, we suggest using the

flag to store the hash of the keyfile used to create the current firmware password. This allows you to use a variety of tools to remotely check the status of the firmware password on a machine. Using this flag the script will create an SHA-2 hash of the new keyfile and store it in non-volitile RAM (nvram) when the password is changed. The hash can then be accessed locally through the terminal or remotely with SSH, ARD or other tool.


flag allows you to define any string to place in nvram. You could record the date the password was changed last or a cryptic hint to help you remember the password in the future (not recommended).


Version 2+ of FWPM uses Apple's

tool to make changes to the firmware password.
was shipped beginning with Mac OS X 10.10 "Yosemite". If you need to manage firmware passwords on OS X prior to 10.10, consider using the previous version of Firmware Password Manager.

Common error messages


Keyfile does not exist. The script was not able to find the keyfile define by the user, check the path again.
No Firmware password tool available. The script was unable to find the firmwarepasswd tool. Check that it has not been moved.
Asked to delete, no password set. The user selected the -r/--remove flag to remove the firmware password, but no firmware password is set.
Malformed keyfile key:value format required. The keyfile is not properly formatted. Follow the instructions above.
Multiple new keys. multiple passwords are defined as new in the keyfile, you will need to comment or rename the additional new keys.

No password in the keyfile has the
note, you will need to properly identify the password you wish the use.
Asked to delete, current password not accepted. For this error to appear something very odd and unexpected has happened, contact the author.
Bad response from firmwarepasswd. This is a catchall error stating that firmwarepasswd encountered an error.
Current FW password not in keyfile. This is an critical message that the keyfile does not contain the current password.
nvram reported error. This is a catchall error stating that nvram encountered an error.
An error occured. Failed to modify firmware password. This means one of the above errors likely occured. Keep reading the log to find the exact error.

JAMF Integration

FWPM was originally written to work with our unique management system. During the python rewrite, I made an effort to make FWPM independent of any specific administration philosophy and making it easier to integrate into future management solutions. I've included sample scripts for integrating FWPM into JAMF Casper, UNIX and ARD. The source is included in the example scripts folder.

JAMF FWPM installation policy

You will need a policy to ensure that the FWPM binary is installed on each of your client machines.

JAMF FWPM controller script

The controller script directs the automated configuration and launch of FWPM. It contains the new and old firmware passwords, the logic to error check and create an obfuscated keyfile and configuration file, and launches FWPM.

Editing the keylist variables

    'previous': ["oneOldPassword", "AnotherPasswordWeUsed"],
    'new': "myNewFWPW!"

Editing the configuration file variables

    'flags': {
        'use_fwpw': True,
        'management_string_type': 'hash',
        'custom_string': '',
        'use_reboot_on_exit': False,
        'path_to_fw_tool': '',
        'use_test_mode': False,

'keyfile': {
    'path': '/tmp/current_fwpw.txt',
    'use_obfuscation': True,

'logging': {
    'use_logging': True,
    'log_path': '/var/log/fwpm_controller.log',

'slack': {
    'use_slack': True,
    'slack_identifier': 'hostname',

    'slack_info_url': '',
    'slack_error_url': '',


Please see the previous discussion of the configuration file for info on these values.

JAMF JSS extention attribute

We can leverage the nvram string and smart groups in JAMF Casper to automate the distribution of an updated keyfile package and direct clients to change their firmware passwords. We do this by defining an extension attribute (EA) in the JSS. We've included the script we run in the repository for FWPM 2.0.

The EA script runs during recon and pushes the hash up to the JSS. We then define a smart group that contains any machine not sharing the same hash as the current keyfile. This makes it possible to apply a policy directing those machines to download the new keyfile package and run FWPM.

The following image shows the EA page in the JSS:


This image shows the two possible smart group built using the EA:


Here is how the smart groups are built:


Skeleton Key

Skeleton Key was written to add a GUI to the firmwarepasswd command and Firmware Password Manager and give it mulitple ways to obtain the keylist file. Skeleton Key is designed to be used by technicians with limited experience or access.


Using Skeleton Key

Upon launching Skeleton Key, you must enter a valid administrator password to proceed.


You may also see the following message, press OK to continue.


This is the main interface for Skeleton Key. It can be broken down into three areas: Current State, Modifiers and Status messages.


Current State

The Current State area will tell you if there is a Firmware password in place, and if the keyfile you have given it was read correctly.




The Location area is where you will specify the location of the keyfile you wish to use. You can copy it directly from the JSS FWPM controller script, from a remote file share, from a local disk or entered directly into the application.

Retrieve from JSS Script

This option allows you to specify the JAMF server that contains the FWPM Controller script for your environment. Skelton Key will parse the script and find the keylist automatically.

Fetch from Remote Volume

This option allows you to specify a remote SMB or AFS file share where your keylist is located. Enter the complete URL, username and password.

Retrieve from Local Volume

A standard MacOS X Open File dialog will appear allowing you to navigate to your keyfile.

Enter Firmware Password

This option allows you to directly enter the current or new firmware password of the machine.


Keyfile hash

When a keyfile is read successfully into memory, the hash will appear here. The hash is used in the JAMF Smart Group, to tell which machines are up to date and which need to be updated.


Status Messages

Any informational or error messages will appear in this location.

Rebuilding the binary

I use pyinstaller to build the binary. As long as you maintain the file structure, you should be able to rebuild the binary with the following command:

pyinstaller --onefile


If you have forgotten the firmware password for a machine your available options depend upon the age of the machine.

Only Apple Retail Stores or Apple Authorized Service Providers can unlock the following Mac models when protected by a firmware password:

• iMac (Mid 2011 and later)
• iMac Pro (2017)
• MacBook (Retina, 12-inch, Early 2015 and later)
• MacBook Air (Late 2010 and later)
• MacBook Pro (Early 2011 and later)
• Mac mini (Mid 2011 and later)
• Mac Pro (Late 2013)

If you can't remember your firmware password or passcode, schedule an in-person service appointment with an Apple Store or Apple Authorized Service Provider. Bring your Mac to the appointment, and bring your original receipt or invoice as proof of purchase.

If you have an earlier machine, it's much easier:

  1. Shutdown the machine. Remove the battery, if possible.
  2. Change the configuration of RAM by removing a module.
  3. Restart the machine and zap the PRAM 3 times. (Hold down Option, Command, p and r after you press the power botton, and wait for three restarts)
  4. Shut the machine down and remove the battery, if possible.
  5. Reinstall the RAM module.
  6. Restart and the firmware password should be removed.

Thank you to macmule for, which helped me get things working in version 1.

Update History


Version Notes
2020.01.23 2.5 Removed flags, uses configuration file, removed management_tools, ported to python3. Added Skeleton Key and JAMF Controller script.
2019.10.23 2.1.5 Corrected issue reporting no existing firmware password.
2017.10.23 2.1.4 Using rm -P for secure delete, added additional alerting, additional pylint cleanup.
2016.03.16 2.1.2 Cleaned up argparse, removed obsolete flag logic.
2016.03.16 2.1.1 Slack identifier flag, logic clarifications.
2016.03.07 2.1.0 Obfuscation, reboot flag, bug fixes
2015.11.05 2.0.0 Python rewrite, Docs rewritten
2015.02.25 1.0.1 Added use of firmwarepasswd on 10.10
2014.08.20 1.0.0 Initial version.

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.