What causes "keychain password not provided" in moonD4rk/HackBrowserData?

Set the Password field to the macOS user's login password before calling RetrieveKey

keychain password not provided

Error message

keychain password not provided

What it means

KeychainPasswordRetriever.RetrieveKey requires the login password to unlock the keychain; when r.Password is the empty string it returns "keychain password not provided" immediately, before any keychain access or caching. This is a configuration/validation guard, not an OS failure.

Source

Thrown at masterkey/retriever_darwin.go:90

			return darwinParams.deriveKey(rec.Password), nil
		}
	}
	return nil, fmt.Errorf("%q: %w", storage, errStorageNotFound)
}

// KeychainPasswordRetriever unlocks login.keychain-db with the macOS login password (no root).
// Records are cached once and reused across browsers.
type KeychainPasswordRetriever struct {
	Password string

	once    sync.Once
	records []keychainbreaker.GenericPassword
	err     error
}

func (r *KeychainPasswordRetriever) RetrieveKey(hints Hints) ([]byte, error) {
	if r.Password == "" {
		return nil, fmt.Errorf("keychain password not provided")
	}

	r.once.Do(func() {
		r.records, r.err = loadKeychainRecords(r.Password)
	})
	if r.err != nil {
		return nil, r.err
	}

	return findStorageKey(r.records, hints.KeychainLabel)
}

// SecurityCmdRetriever queries Keychain via the macOS `security` CLI (may prompt). Results are
// cached per storage name so each browser's key is fetched once.
type SecurityCmdRetriever struct {
	mu    sync.Mutex
	cache map[string]securityResult
}

View on GitHub (pinned to 0503d04d7a)

Solutions

Set the Password field to the macOS user's login password before calling RetrieveKey
Load the password from a secure source (env var, prompt) and validate it's non-empty
Use a different retriever if the login password is unavailable

Example fix

// before
r := &masterkey.KeychainPasswordRetriever{}
key, err := r.RetrieveKey(hints)
// after
pw := os.Getenv("LOGIN_PASSWORD")
if pw == "" {
	return nil, errors.New("LOGIN_PASSWORD env var required for keychain retriever")
}
r := &masterkey.KeychainPasswordRetriever{Password: pw}
key, err := r.RetrieveKey(hints)

Defensive patterns

Strategy: validation

Validate before calling

if retriever.Password == "" {
	return errors.New("KeychainPasswordRetriever.Password must be set")
}

Type guard

func keychainRetrieverReady(r *masterkey.KeychainPasswordRetriever) bool {
	return r != nil && r.Password != ""
}

Try / catch

key, err := r.RetrieveKey(hints)
if err != nil && strings.Contains(err.Error(), "password not provided") {
	return nil, errors.New("configure the login password before keychain retrieval")
}

Prevention

Always populate Password at construction time
Validate non-empty credentials before building the retriever
Prefer loading the password from env/prompt over hardcoded zero-value structs

When it happens

Trigger: Constructing KeychainPasswordRetriever without setting Password (zero value struct or Password: "") and calling RetrieveKey.

Common situations: Forgot to populate the struct field, expected the library to prompt for the password (it doesn't), or the password comes from a config/env source that was empty.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of moonD4rk/HackBrowserData@0503d04d7a (2026-09-06). Data as JSON: /api/errors/44d5d255dbb0da84. Report an issue: GitHub.