You might be interested in knowing how to embrace Apple Passwords with a bear hug, leaving behind your current password manager. If you tried Apple’s Passwords app in the past and were disappointed, you should probably give it another try. The improvements Apple has made in the last couple of releases have brought it to what I consider parity with the most important useful features of well-designed third-party password managers.

Despite that, Passwords is focused on—no surprise—passwords and password-like items: website logins, passkeys, and Time-based One-Time Passwords (TOTPs). Many password managers include a junk drawer of other kinds of structured material you can store that doesn’t map directly to Apple’s Passwords structure. If you’re mostly using a third-party system for password-esque stuff and use all Apple devices or Apple and a Windows PC, a migration is straightforward. Otherwise, it can be hairier and could involve rethinking how you store assorted data.

You can use iCloud Passwords with Windows (and then use Microsoft Edge, Firefox, or Google Chrome). You can also use browsers other than Safari on a Mac with an iCloud Passwords plug-in or extension. However, if you or people you currently shared information with use Android, Linux/Unix, or ChromeOS, this migration won’t work for you: those platforms aren’t supported, and there’s no web app for iCloud Passwords.

Because Joe Kissell and I have written entire books that help with different components involved in a password manager migration, I’ll include references throughout to appropriate Take Control series books. For a general grounding in passwords, for example, I recommend reading Joe Kissell’s Take Control of Your Passwords, updated earlier this year.

Map the data connections

As I noted, Passwords is best at passwords (and passkeys and TOTPs), and filling them in on webpages and in apps. If you care mostly about this, you’re in luck, as you can easily migrate data of these kinds:

• Website and app logins: Account logins move to Passwords.
• Loose passwords: Ones that have no direct connection to an app or site, like a bank card PIN, also move to Passwords.
• TOTPs: These confirmation codes can be migrated. However, there’s a technical detail with how they may be stored by third parties (or Apple) that can prevent the migration and might require using a backup code; see details below.
• Passkeys: The password “industry” finally developed and rolled out a secure copying system that Apple supports that will let you move passkeys among password managers. This requires migrating on an iPhone or iPad; you can’t move these on a Mac.

Two other categories of fill-in entries that aren’t managed in Passwords can be handled—and you may already be using—in Wallet and Safari:

• Payment cards: Payment cards need to move to Wallet & Apple Pay. You have to enter these manually as AutoFill Cards, unless you’ve already done so or added the card to Apple Pay. It’s a little complicated, as I explain.
• Identities: Apple supports filling in personal or business address information through Safari using AutoFill.

(You can see Safari’s evolution on the Mac at Safari: Settings: AutoFill: your personal contact now links to Contacts, user name and passwords to Passwords, and credit cards to Wallet & Apple Pay.)

Where you will be left hanging by Apple:

• Miscellaneous secure items and attachments: If you store Social Security numbers and other account information that is distinct from a password, but you want to have available to fill in at particular websites or by searching Passwords, you can create these as entries in Passwords. In some cases, you may want to create entries in Notes (with additional security, described later).
• Structured data: You may have bank accounts, passports, driver licenses, memberships, software licenses, or other structured information stored in a password manager. That is a trickier needle to thread, as Passwords offers no support beyond a Note field.

For both of these, you might want to migrate to… a password manager. But wait! This would be one you use solely for secure storage of these miscellaneous structured or less-classifiable items, not for field-oriented secrets and accounts you want to fill in.

There’s one more important migration issue:

• Shared vaults and items: If you use a password manager that supports secure storage areas with other people—like vaults in 1Password, Dashlane, or LastPass, for example—Passwords provides something akin, though not precisely the same: Shared Groups. Because of the above provisos, many non-password items shared via a third-party manager will need to be migrated to Notes or another secured shared item-storage-based space.

Three big things that may derail the whole migration for you:

• Tags/labels: Some people make use of metadata organizational systems, like tags. These don’t transfer to Passwords at all!
• Extra data: Much like the paper card catalogs of yore had book information plus tons of annotation, accumulated over time, you may have used password manager features to add extensive notes, additional fields, include attachments, and create richly detailed records. All that will be gone, like tears in rain. True, Passwords has a Notes field, but it lacks structure, rich text, and Markdown support. If you move to another, more focused password manager, you may be able to retain this.
• Access after you’re gone: Non-Apple password managers have recovery kits that could allow a relative or other party who has that information to gain access to stored, synced data. Apple’s Legacy Contacts system, which allows an executor or other authorized person to access your data when you’re gone, excludes iCloud Keychain: no passwords, passkeys, Wi-Fi passwords, or other data. However, Legacy Contacts must be activated; until it is, it’s possible for someone who retains access to one or more of your devices to view your passwords and other data in Passwords. (See Joe Kissell’s Take Control of Your Digital Legacy, or my Take Control of Your Apple Account.

One last bit of aggravation? Passwords does not yet support removing duplicates!

Plan your migration

As you consider migrating, I urge you to run your old manager and Passwords in parallel.¹ Particularly if you store a lot of different kinds of data in your old manager, you may want to be able to consult it and migrate some of it over time. This can be a pain if you are paying an annual fee and the renewal is coming up soon. Consult the maker’s website to see whether you retain access to your data after a subscription expires and, if that bothers you, in what form.

The place to start is pruning old entries.

First, sort by last modified date. Did I know that nearly 2,200 of my 2,600 entries haven’t been modified since 2022? Some since 2008? I did not. However, you likely don’t want to delete these wholesale, because there may be secrets you can’t recover. Online backup private keys (such as with Backblaze), Bitcoin and other cryptocurrency phrases or keys, or other secrets you set once need to be retained or you lose access forever.

My strategy:

• First, export everything. These exports are unencrypted and must be performed on your Mac. The export won’t include passkeys. (See below for that pathway.) This gives you a revert point. Because there are so many export formats across systems, I refer you to the software documentation to pick the best one. Warning: That file will be unencrypted and is like plutonium. Handle with care. The best plan is to use Disk Utility to create a disk image (APFS, 256-bit AES, Sparse Bundle Image), use a password you know or that is stored in Passwords, and then export directly to that encrypted image. The reason? If you save the file elsewhere, it might be backed up to Time Machine or become accessible in a way you didn’t intend. When unmounted, the drive is as secure as your startup volume. Just don’t forget or lose the password!

• Move all the older entries into a group. You might be able to create a group, tag all entries, or, in the worst case, move to a separate vault. In 1Password, the only strategy I found was to create a new vault called Outdated Entries and move all the older entries there. Warning: When selecting, make sure you aren’t including entries from all vaults, as that might move items you share with others or that others share with you.

• Next, sort by name or title. This lets you scan through entries and identify duplicates. I found a number of items I’d already labeled “outdated,” or that were from services I couldn’t even remember. However, there were also a huge number of passwords and account logins that hadn’t been changed in more than four years—some for more than a decade! (There’s no reason to change uniquely set passwords routinely unless your current one is weak and a site is compromised. Most password managers, including Passwords, let you know about weak and reused passwords.) This process can be mighty tedious, which is why I’d recommend tackling it over time rather than all at once.

When you’re pruned, cleaned up, and otherwise reduced, you can now use the set you’re exporting; it’s time to go to the next step.

Export your secrets

Your best and first choice should be to use your iPhone or iPad; at this time, you can only perform a secure password storage transfer in iOS.² Major password managers support this transfer method, which lets you move passkeys—it’s currently the only way to migrate a passkey.³

Here’s how it appears and works in 1Password:⁴

1. Navigate to the export section of 1Password—that’s Lock (upper-left corner): Settings: Advanced: Start Export.
2. Enter your account name; the app provides a hint. Tap “Approve export.”
3. An explanation screen appears. Tap Continue.
4. Choose the destination. In this case, tap Passwords, then tap Continue.
5. Tap Continue in “Passwords,” and you’re switched to the Passwords app, where you can watch the import in progress.

While this is the best method, you can also export from most apps in CSV (comma-separated values) format, which truncates most information and likely leads to problems. Warning: You will have to re-create your passkeys. You may need to use the desktop version of the password manager to export. In Passwords for Mac, choose File: Import Passwords from File, click Choose File, select the file, and proceed. This doesn’t overwrite entries.

Now, check important accounts:

• Does the regular login work? If not, reset the password. Take this opportunity to upgrade to TOTP or a passkey if either is available.
• Does TOTP or a passkey work for logging in? If not, find a backup code or another method to generate a new TOTP or passkey.

TOTPs have a particular idiosyncrasy. They are seeded with a secret generated by a website. The site displays that code as a QR code, so you rarely need to copy it, though Password and other managers allow you to do so. When migrating an entry with a TOTP, it might appear in its URL format, which is generically like otpauth://totp/user@user.user?secret=SEQUENCE in the Notes field instead of appearing as a TOTP within Passwords. If that’s the case, you can fix it manually:

1. Copy the text after secret=.
2. Tap or click Edit.
3. Tap or click Set Up Code.
4. Paste the secret you copied into the Setup Key field.
5. Tap or click Use Setup Key.
6. Tap or click Done.

If that fails, log into the website in question and use a backup code or other means to re-enroll with TOTP.

Enter credit cards, set up AutoFill, and move to Notes

Before getting started, I strongly recommend enabling Advanced Data Protection in iCloud. ADP improves iCloud security by encrypting nearly all application data—iCloud Drive, Messages, Photos, Notes, etc.—via keys stored only on your devices, just like iCloud Keychain. Without ADP, these kinds of data are encrypted in transit and at rest using only Apple’s encryption secrets, and could be demanded via a government subpoena or someone gaining access to your Apple Account. (Note that contacts, events, and email remain encrypted at rest, not end-to-end, because of the need for compatibility with third-party software.)

Follow the steps in the link to enable. You can also still access this information via iCloud.com through a process that enables a temporary end-to-end session. (For more about ADP, see Joe Kissell’s Take Control of iCloud or my recently updated for the 27 releases, Take Control of Securing Your Apple Devices.)

Now, work through these categories:

• Payment cards: Use Settings: Wallet & Apple Pay on an iPhone or iPad, or System Settings: Wallet & Apple Pay on a Mac. Tap or click AutoFill cards and authentication. Now you can tap or click Add Card to provide the card details. This lets you fill in the card anywhere there’s a form field or wherever you can tap or Control-click/right-click in a field and bring up AutoFill as a menu item. AutoFill cards sync across your devices when Wallet sync is active in iCloud (Settings/System Settings: Your Name: iCloud: See All). For more on working with Wallet and payment cards, see my book Take Control of Apple Wallet. This information is secured end-to-end.

• Identity filling: A different kind of AutoFill, for identity information, is found in Settings: Apps: Safari: AutoFill or Safari: Settings: AutoFill. Enable Use Contact Info on an iPhone or iPad, or check “Using information from my contacts” on a Mac. Now you can tap the entry next to My Info on an iPhone or iPad, or click Edit to the right of the checkbox label. This lets you pick an entry—you probably already did—and populate it with all the things you’d want to fill in on a form, including multiple addresses. Safari doesn’t protect identity information with ADP. However, the type of address and other information you would use are likely the least important to protect in what would be a very unlikely break-in to an Apple Account or one of your devices.

• Fill in Notes: As I noted earlier, the structured entry style of third-party password managers doesn’t mesh well with either Passwords or Notes. Passwords has a single Notes field, which may be enough for some entries, but not the more detailed ones I describe. The Notes app is structured around entries, but it’s not well designed for hundreds or thousands, and it lacks inherent field data or structure. Judge what you’re storing in your old password manager to figure out if Notes could work. With ADP enabled, it offers strong security. For migrating structured data intact, read on!

Migrate structured data

If you’re looking to move structured entries, I suggest checking out Strongbox, but not for passwords, passkeys, TOTPs, and the like. Its developer offers a free syncing version (for iPhone, iPad, Mac, and Apple Watch) with everything you need except Touch ID/Face ID unlocking. That requires the Pro flavor at $24.99 per year, which includes several other features.⁵

Strongbox, unlike some managers, allows you to sync via a file under your control or through its secure syncing service, depending on your preference. This lets you keep your, er, digital strongbox under your personal control, if that matters to you. It can import from all major password manager export formats.

In testing, it preserved my 1Password structured data extremely well. This included tags. It also arranged my vaults into what it calls groups, letting me retain a sense of what I was sharing with others.

The one complication is that if you want to use one of the migration processes above to copy your items into Passwords, you have to do one of two things after performing your migration:

• In your old manager, delete all passwords, passkeys, and TOTPs. This is dangerous in my accounting, as it reduces your ability to have a parallel working solution, and you could accidentally delete secrets you need to keep.
• Import everything into Strongbox, then select all the passwords, passkeys, and TOTPs from Strongbox, and empty the trash. This gives you two copies of everything: Passwords and old password manager for secrets; Strongbox and old password manager for structured data.

When you’re ready to abandon your old password manager, maybe weeks or months from the migration, you can retain a securely stored backup copy or perhaps retain access depending on the product, while not using it actively or paying renewal fees.

Working in groups

Sharing your passwords and other secrets with other people remains Passwords’ weakest aspect, because Apple offers only Shared Groups. Each entry can be stored only in your personal Passwords storage or in Shared Groups. Otherwise, you have to duplicate an entry, which can cause such entries to drift out of sync.

In the Passwords app, select any entry, then click or tap the Group pop-up menu. You can then choose an existing group or create a new one. When you make your choice, the password, passkey, or other item is now exclusively found in the Shared Groups section, not copied! Passwords doesn’t offer a copy or duplicate feature, so you have to re-create the entry if you want to share it with two or more groups that aren’t a complete overlap of the same people.

It may be easier to understand from a family perspective. Let’s say you have items you share only with your spouse, others with your children, and some with both. You can’t create a “spouse” group and a “children” group. You need to have one for your spouse, one for your children, and one for the whole family. This is where there’s real room for improvement by Apple.

The password rhymes with orange

I know this is a whole rigmarole, but I’m actually impressed that it’s finally doable in a reasonable manner. A couple of years ago, it was not. It was possible a year ago, but I wouldn’t have recommended it. Now, if you’re careful with each step, maintain a backup, and keep your old manager running in parallel as you complete the migration, you should be able to achieve success.

This article was updated on Sept. 10th to add missing details about fixing a broken TOTP import.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

I know there’s no connection between my local area network and our house’s plumbing system, but when the faucet started running uncontrollably literally seconds after I fixed a network outage, I had to wonder: did we have a poltergeist? The jury is still out. But I can tell you that my hour of fruitless examination of router settings is to your benefit: you won’t have to do this when it happens to you.

The weakest TP-Link

As a guy known for Wi-Fi since the early 2000s, you might think my house is ablaze with wireless signals.¹ Yes, it is: we have six Wi-Fi access points and gateways in a relatively small house by modern standards (about 1,200 sq. ft. on the main floor and 800 in the finished basement). But we also have Ethernet strung through the house to connect most of them, with powerline networking adapters where that doesn’t work due to the ancient and mysterious innards of the walls. The innards’ outsides are covered with heavy, old plaster, which absorbs some of the power of the Wi-Fi signals—hence the large number of emitters.

Normally, this works fine. We have four TP-Link routers, some purchased a while back, and a Netgear Nighthawk as our primary base station, which distributes network addresses and is connected to the fiber-optic ISP router.² When something goes wrong, it’s usually an issue with a router crashing, even though its various green lights remain in a happy state.

This time, something was more deeply wrong. The TP-Link routers showed orange Internet connection lights, which in this case meant they were connected via LAN to the Netgear, but they couldn’t reach the Internet. Perversely, I seemed to be able to connect from my iPhone and my office Mac, which has both Ethernet and Wi-Fi connections active.³

TP-Link has one of the most irritating admin approaches for its routers of nearly any networked product I’ve ever used. You can connect directly, but it’s difficult to store the device’s password because it uses a potentially changing local IP address on your LAN. There’s also a centralized system where you can use an app called Tether or a TP-Link website to log in remotely to a router, even when you’re on the same LAN, rather than finding its local address. Tether also scans the local network, letting you connect even when Internet access is disrupted.

Without the routers “seeing” the Internet, I couldn’t use the website, and Tether worked erratically. I eventually was able to figure out the IP addresses of two of the four routers, connect via a web browser, and find a working password for one of them. (To reset the password, you have to factory reset the router. That’s for a future day.)

But I remained baffled. My ISP gateway was up. My Mac could reach the Internet. The Netgear router seemed to be routing my Mac’s traffic to the Internet. Some of the devices on our network were also connected to the rest of the world. Had my TP-Link routers been compromised? Was something more sophisticated going on? Nope.

It’s coming from inside your smart house

Some of you may be yelling at me from the safe distance of your phone or computer. “Glenn, Glenn, why didn’t you check DNS?” The circulatory system of the Internet may be the IP-addressed traffic that passes over the series of tubes that make up the network. But DNS is the helpful labeling system, like an editorial cartoon that uses captions like “taxes” and “fat cats” to mark characters in an illustration. DNS turns human-readable domain names into the underlying numbers required for connections.

Surely DNS was working? My iPhone, Mac, and other devices were resolving addresses, or turning them from names into numbers. Then I found a clue in Network Time Protocol (NTP), a somewhat obscure bit of plumbing that also makes things tick. When I went to Advanced: Administration: NTP Settings on the Netgear, the last time it had been able to grab the current time and date was hours earlier. That seemed problematic.

Digging more deeply, literally, I found that the dig Unix command couldn’t pull up IP addresses from the Netgear router. On a LAN in which you’re using DHCP to handle local address assignment, your router may require that you enter Internet IP addresses for one or two DNS servers, or it might retrieve them automatically from your ISP. When a device on your network requests an address, the DHCP server assigns an address and tells the device to use the router address for DNS resolution. The router relays your requests to the real DNS server.

I tried dig @10.0.0.1 apple.com (use the router to return the IP address for apple.com) via Terminal on my Mac, and it timed out. I then tried the same lookup using my ISP’s DNS servers. Same timeout. The Mac had no problem with domain lookups, however, nor did my iPhone.

Now comes the time to insert a head-slapping emoji. Some time ago, and I can’t recall how long ago, I set my Netgear router to use my ISP’s primary and secondary DNS addresses. I know many people have switched to Google, Quad9, Cloudflare, or other free, public DNS servers to improve lookup speeds, which, at one point, would have helped speed up network operations tremendously because ISPs invested so little in their DNS operations.

However, using public DNS can cause issues in particular cases. For one, it can confuse content delivery networks (CDNs), which try to guess the closest server to you topologically based on your DNS lookup request to their servers. When that works, you’re getting the shortest path and likely faster throughput. Public DNS can misdirect CDNs, resulting in severe slowdowns in data transfers for big files and with streaming. Much of that has been resolved, but not all of it. I had had some issues, so I reverted from one of the public DNS services to my ISP’s servers. (This has largely been solved now.)

So what happened? My ISP, CenturyLink, must have had a DNS failure. I couldn’t get replies from its DNS servers when I checked (directly or via my router). I found postings later from other CenturyLink customers around the same time, but no public message from the company.

Why did my Mac and iPhone keep resolving? My Mac’s Ethernet connection had a manually set DNS server that was an alternate one provided by my ISP, one that apparently continued to work. I can’t explain the iPhone situation, unless it’s possible that iOS will pull DNS over a cellular connection when it fails over Wi-Fi—I don’t know that it does that, but I don’t have another explanation.

I removed my ISP’s DNS values, replaced them with 1.1.1.1 (Cloudflare) and 8.8.8.8 (Google), clicked Apply, and an hour of my time suddenly was marked on my internal spreadsheet as “wasted.”

Where I went wrong

I’m always trying to learn from my mistakes, particularly because I turn mistakes into opportunities to write columns like this one to save time for you, dear reader. In this case, I was led astray by the half-working network and the fact that, seemingly, only one brand of router in one configuration was failing. I should have remembered to start with DNS—and I will in the future.

If you’ve read this long, I’m sure you’re dying to know about the faucet. I had just finished fixing the network, walked to the freezer, grabbed a fruit-only frozen treat, and was walking across the kitchen when a small stream of water came out of the faucet. I tested the taps. I put the frozen delight back into the freezer, turned off the taps while my spouse was on speaker so we could figure out which tap’s cartridge decided at that moment to give up the ghost, and ordered a replacement. This was another kind of DNS failure: do not spout!

For further reading

While this column may have given you less confidence in me than you had before you read it, I share much more information about Wi-Fi, networking, and troubleshooting in my book Take Control of Wi-Fi Networking and Security.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

Wallet on iPhone is a bulging catch-all. Apple stores all your payment card information there, and it’s an interface for adding and removing cards, as well as viewing associated details. It’s the place where you interact with your Apple Card (like scheduling payments or viewing transaction reports), the Apple Card savings account, and Apple Cash. But it also handles related but miscellaneous categories of other things: tickets for events, reward cards, membership cards, your library card… really, anything with a number, a scannable code, or a connection to payment winds up there.

Despite all that, Wallet has been deficient: you couldn’t easily add items to Wallet that the party issuing them hadn’t formatted and made available with an “Add to Apple Wallet” button, whether from a website or within its app. Starting in iOS 27—coming in September but available in a public beta now—you can use a new pass-creation tool to make your virtual billfold even larger. Third-party tools still fill the gap for iOS 26 and earlier users, or for those who want customization that Apple isn’t providing in Create a Pass.

Make your own Wallet entry

In iOS 27, open the Wallet app and tap the Add button in the upper-right corner. You’ll notice that among the options you’re familiar with, Create a Pass appears. Tap that.

If you have a device that supports Visual Intelligence and the pass has a barcode or QR code, tap Continue, and Wallet opens a camera sheet.¹ When you tap the shutter button, Visual Intelligence analyzes the image and tries to extract elements, like your name, the organization name, or the code. If it can’t, it will offer a Try Again and Create Pass Manually dialog.

If it’s successful, Wallet next displays a preview screen. You can tap Add to accept the pass as it appears, or tap Edit Pass to modify the fields shown and the contents of those fields.

There’s a quirk in editing fields that baffled me for a while, but I teased out the answer in testing. Apple pre-populates field areas, marked with white rounded rectangles with subtle glowing edges. If you tap the Edit button (in the lower-right corner) and choose Add/Remove Fields, you cannot add new field areas. (See the figure for how I’ve labeled this.) What you can do is tap on an existing field within a field area to change it, or you can tap within a glowing rectangle (the field area) to add another field. This is not a great interface, and I expect it will mature.

Tap the Palette icon to change the background color or choose a different background image from a small set in the Wallet library.

If Visual Intelligence isn’t available or you want to build the pass element-by-element:

1. Tap Create Pass Manually.
2. On the Choose Pass Template screen, pick the data format and default color scheme to use for your pass: Standard, Membership, or Event. This pre-populates different fields for you to fill out. (You can change the color later via the Palette icon.)
3. Next, tap fields to enter data. Each field has a label in smaller type and placeholder text in larger type.
4. Tap Add Code to scan a barcode or QR code.
5. When finished, tap the blue checkmark.

You can then tap the Palette icon to change its appearance, or tap Edit: Add/Remove Fields icon to further edit the pass.

After the pass is added to Wallet, you can tap it, tap the More button, then tap Edit Pass. You can also tap Pass Details to see the raw information added. The View Original Photo button lets you bring up the picture you took if you used Visual Intelligence.

If you’re not yet using the iOS 27 beta or want options that Apple isn’t offering, you could try one of these free tools. Be aware, however, that Wallet passes have to be signed, so any data you provide to these companies is sent to them in the clear. Both have details in their privacy policies about how they protect your data.

• Wallet Creator (iOS app) has over 80 prebuilt templates for existing businesses, or you can roll your own pass or card. Wallet Creator says the app collects no data. However, the App Store’s description for the app, under “Our Terms of Use & Privacy Policy,” provides more information about how data is sent to a server, processed, and deleted.

• WalletWallet (web app) is a single-page form to create a pass. The page offers no privacy information, but it’s built using a business-oriented API the company makes, and that API has this explanation on the trip your data takes.

My book on Wallet, Take Control of Apple Wallet, will be updated later this year to incorporate all of this new information.

iPad and Mac have empty pockets

While Apple brought the Phone app to iPad and Mac in iPadOS 26 and Tahoe, the company still treats Wallet as a second-class citizen on those two platforms, even though both allow the use of Apple Pay. I’d love to have Wallet synced and fully available for managing all cards, not just payment-related ones, as a standalone app in the future.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

We trust Apple with a lot of our data. In general, that hasn’t seemed like a bad idea; in particular, compared to its competitors, Apple seems to ensure that it can inspect or interact with very little of our data. The company has built its platform and its reputation on being an elegant, frictionless, hands-off conduit. While we can make many complaints about Liquid Glass, its increased focus on invasive (and poor) advertising, its software quality, and much else, Apple has kept its corporate nose cleaner than anybody else. Its transparency and documentation are, oddly, worse than its actions and clear intent.

I was thinking about this when I received an email from an anonymized iCloud Hide My Email account, asking for more detail about how Apple managed the transition from the old method of presenting or escrowing (in iCloud) your macOS FileVault Recovery Key to the new method, in which the key is stored in Passwords. This transition, which I’ve documented in a few places, was a step forward in privacy and security.

But not transparency! I’ll explain, but you can’t find an explanation on Apple’s site about the transition. The support documentation remains out of sync with Tahoe. That leaves it to yours truly to explicate.

Don’t trust and verify

The Electronic Frontier Foundation recently published a newsletter with a round-up of how fitness wearables, like rings, watches, and bands, preserve your privacy from government intrusion, as well as whether they protect you from unwanted security invasions by using end-to-end encryption (E2EE). (The former often requires the latter: governments typically can’t break through E2EE.)

I want to quote two full paragraphs to make this point:

In the end, we found that only four of these companies (Apple, Google, Whoop, and Oura) promise to notify users of law enforcement requests in publicly available documentation. And just two of those companies, Apple and Google (which also owns Fitbit), currently publish transparency reports on how often they hand users’ data to the government.

Support for end-to-end encryption—a method that ensures your personal data is only accessible by you, and not the company who makes the device and manages the cloud storage—is more rare than transparency reports among wearable device makers. The Apple Watch is the only popular fitness wearable that supports end-to-end encryption.¹

Apple wasn’t an early player with E2EE. Really, it was seen as the kind of thing only true security geeks cared about, even while people like EFF and other digital privacy advocacy groups and individuals warned us that our data was only lightly protected. Over time, as the criminal, exploitative, and political monitoring and extraction of our secrets became clear, Apple kept stepping up.

The Secure Enclave is a keystone of those moves, as the tamper-resistant silicon subsystem allows devices to keep locally generated security keys entirely private. Most of these keys never leave the Secure Enclave! Rather, it’s the encryption hub.²

iCloud initially had a fairly cursory level of protection, with the then-Apple ID account password serving as the only real bar. Two-step verification in March 2013 provided better account protection, but didn’t cover iCloud backups, which could be retrieved without that second step. A rash of celebrity account leaks in late summer 2014 led Apple to extend two-step to iCloud data within a couple of weeks. The next year, it upgraded security to the more rigorous two-factor authentication, which later became mandatory.

As part of its response to the iCloud data hijacks, Apple began to beef up iCloud. It began rolling out E2EE for all the device-based services it could, leaving synced data still relatively lightly protected. (iCloud data is always encrypted with Apple’s at-rest keys, which only it ostensibly has access to, and in transit with HTTPS. However, a security breach at Apple or someone able to hijack one end of an in-progress HTTPS sync allows access to that unencrypted data.)

Then, suddenly, months after shipping major updates to its operating systems, Apple announced Advanced Data Protection in December 2022. Enabling this feature put the E2EE aegis over nearly all synced or stored data at iCloud; mail, contacts, and calendar entries remain an exception because of their interoperability with third-party apps and services. You can view Apple’s document that explains what level of protection applies to data, with and without ADP enabled.

With that in mind, let’s talk about the Recovery Key transition.

Recovery Key is not recovered? I think not

The particular reader question driving this was their concern about the FileVault Recovery Key that was in place when the Tahoe-driven transition occurred. Was the old key destroyed and a new one created and stashed in Passwords? Or was the old one just moved over? If the latter, isn’t that a security hole, if a tiny one?

My initial reply wasn’t entirely glib, but I said, having not documented the upgrade, I believed Apple explained the process when it occurred. But I couldn’t find any screen captures of how that occurred. Apple’s documentation remains in the past—it doesn’t mention the Passwords method at all. The Passwords User Guide perversely mentions the Recovery Key, but not how to interact with turning it off or on.

People who had FileVault disabled (whether they never turned it on, or turned it off at some point) did receive an alert during the upgrade:

Your Mac is Ready for FileVault: FileVault keeps your Mac safe by encrypting your data and protecting it with the password you use to log in. If you forget your password, you can use your Recovery Key to reset it.

Clicking Not Now bypassed the process; Turn On opted the user into the new Passwords-based storage for the Recovery Key.

I’ve explained in previous columns how FileVault provides an extra layer of protection. FileVault requires a Recovery Key, so you have recourse if your password stops working, you forget it, or corruption happens in the boot data. This shouldn’t happen, but it can. The Recovery Key and your password (transformed by a cryptographic formula—or hash—after you enter it) are both “key encryption keys,” delightfully named KEKs. Neither directly encrypts your data. Each instead unwraps the key that the Secure Enclave uses to unlock your drive for use in macOS.³ (You can find out a lot more about this topic in my Take Control of Securing Your Apple Devices, a revised version of which, including “27” betas, will be out shortly as a free update.)

Apple never knows your macOS passwords, and it shouldn’t know your Recovery Key. That was the flaw with iCloud escrow: your Recovery Key could be retrieved by someone with your Apple Account information who had access to your Mac.

With that said, how did Apple manage the transition from the old system to the new one that uses Passwords? Into this lacuna of details, jump I with inferential logic about what Apple must have done.

With a “show me once” Recovery Key: Apple would generate this key, show it to you, then destroy it. The company (and macOS) didn’t need a record of it, because its purpose was to be used to decrypt another key: don’t have the key, can’t decrypt that other key. If you opted for that method, Apple had to destroy the existing KEK to replace it with a new one derived from the newly created Recovery Key.

With an iCloud escrow key: The same scenario applies from a different angle. Apple can’t retrieve your escrowed key unless you use your Apple Account. That isn’t a per se security weakness, but Apple doesn’t need that escrowed key, and it doesn’t want to decrypt it at iCloud to send it to you. I would warrant that the company once again destroys the KEK, creates a new one, and that’s what’s stored in Passwords. Anything else leaves a potential gap in my explanation of why Apple made this change in the first place.

Now, you say, if macOS generated the key and it stored it in Passwords, doesn’t it “know” the key? Not exactly. The key is ostensibly generated in memory, added to Passwords, and destroyed. To have accessed the key, an attacker would need to be monitoring your screen or grab particular memory locations at an exact moment. If someone has undetected remote observation of your Mac display, the game is already over.

Passwords uses end-to-end encryption with device-based secrets. You can enter a device password or use biometrics to unlock Passwords (or chained biometrics with an Apple Watch linked to your Mac). That’s as secure as we can get to protect any password. If someone wanted to access your Recovery Key through Passwords, they need access to one of your devices; cracking your Apple Account and its second-factor or passkey authentication wouldn’t help—and that’s a big stretch to begin with. Nor does just having your macOS account name and password without the ability to have physical or remote screen access to your device.

I believe Apple handled this transition awkwardly. The company could have provided more clarity about the requirement to change how a FileVault Recovery Key was stored, and explain exactly what measures it took to ensure security across that transition. And it could update its support pages!

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

The reckoning is coming. Apple has done it before, and it’s doing it again. After macOS 27 Golden Gate, you will no longer be able to run legacy Intel apps using Rosetta 2. After the 26.4 update in March, when running any affected app in macOS 26 Tahoe, you see a notification banner when you launch affected software or a background component launches that uses Intel code:

Support Ending for Intel-based Apps. This version of “[App Name Here]” will not open in a future release of macOS. Learn how to update to an Apple silicon version. [Learn More pop-up menu]

There is one carveout noted for “certain older, unmaintained games that rely on Intel-based frameworks,” so far unnamed.

With information in hand, you can plan how to deal with Intel-only apps that have been abandoned, or the developers have seemingly no interest in updating. Printer makers are, so far, the worst.

A history of looking backward

Apple has done this before—many times, in fact. I’ve argued in the past that one of Apple’s key strengths, and a key to the continuity of the Mac’s operating system, is how well it’s managed transitions across chip architectures, frameworks, and operating system changes.¹

Look at what Apple has managed:

• Motorola 680×0 to PowerPC (silent emulator)
• Mac OS 9.1 (or later) to Mac OS X (Classic)
• PowerPC to Intel (Rosetta, original flavor)
• 32-bit to 64-bit code (warnings)
• Intel to Apple silicon M-series chips (Rosetta 2)

At each of those milestones, Apple offered either advance warnings about a future lack of compatibility, an emulator tool, or both. Does anyone have fond memories of running QuarkXPress using Classic in Mac OS X in its early days? When it crashed, which was often, it only took down the Classic “app” and didn’t require a Mac restart.

To be fair, Apple could have continued to let older software run for as long as it was willing to devote time to maintaining emulators or compatibility layers. We could be using apps written for Motorola 68030s on our M5 Macs right now! However, it makes increasingly less sense to support the past after a reasonable transition, particularly one that stretches years and sees the company discontinuing compatible hardware.

Apple released the last Intel-based model in August 2020, introduced its first M-series computer in November 2020, and halted sales of computers with Intel inside in 2023.

As part of this shift, you receive the Intel software warning, not just the first time you launch an affected app or an Intel-based component or even Terminal-accessed binary runs, but the next time you do it after a restart. Yes, it is trying to bug you to get a newer version of your software. Golden Gate also pulls an interesting trick: When you upgrade, it removes the Rosetta emulator. You’re prompted to install it the first time you need Intel code. I guess this is an extra spur to remind you.

Because Intel-only apps will continue to work under Rosetta until you install macOS 28 Dumbarton, these reminders will continue for at least another 16 months or so.² Once you upgrade to macOS 28, those apps and components will simply stop working.

Sunsets can be beautiful

Apple includes a helpful tool in Golden Gate in System Settings: General: About. Click Details next to Intel-based Apps, and a dialog box appears that lists everything installed that requires Rosetta. As a nice touch, Apple shows you apps launched in the last year, along with when, so you know the most critical to upgrade or swap out.

You can also examine any app in the Finder, choose Get Info from the File menu, and note the warning next to Kind. Apple allows apps to be compiled as universal binaries that include both Intel and Apple silicon code, and offers an Open using Rosetta checkbox that was useful in the early days of the swapover when some M-series versions of an app were missing features or were buggy compared to the Intel version. You sometimes checked that box to use the more stable Intel variety, and then surely forgot about it. (For instance, Adobe updated its primary apps faster than third parties did their plug-ins. To use some Photoshop plug-ins, you had to force Photoshop to run in emulation.)

Hover over the item, and you can click Visit Website if Apple has a link to one, or click the More … button and choose Show App in Finder or Move to Trash. Not every app or component has a Move to Trash item, and I’m not sure why. I also suggest installing AppCleaner, a free app that will root out all files associated with an app when it’s deleted. (Turn on SmartDelete to monitor the Trash, or you can drag apps onto it.) This ensures you’re not leaving cruft behind when you get rid of the app proper.

This is all fine for rooting out installed apps, but Apple may not catch every system component, command-line utility, or other software that lives in crevices and emerges in particular conditions. For that, you should take a look at:

• Go64: The free app from St. Clair Software, the makers of our favorite app, Default Folder X, provides details in a list form.
• Rosetta Check ($7): Turn to Rosetta Check for even more information about each unsupported app, which may be useful if you have a lot of software to work through updating.
• HoudahSpot: If you use HoudahSpot, you can construct a search.

A few companies that have Intel-only apps or components have explained their migration path, with PaperCut being an excellent example. Others without any financial incentive—such as hardware makers, who sometimes barely care about compatibility for software required to support their products—may wait until after the 2027 transition to wake up and make changes. This has happened many times before!

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

Several years ago, Apple began hiding disk partitions and volumes on the startup drive. The first was a secret volume with a tiny operating system on it that would let you boot from it, after which you could restore from a Time Machine backup, run First Aid in Disk Utility, or reinstall Mac OS X or macOS. Over the years, Apple has multiplied those hidden locations and added more sophistication to what they offer.

These boot volumes are:

• recoveryOS: The current name and form of the special volume described above, which boots into the Recovery Assistant “app.” You can run Disk Utility (and First Aid), reinstall macOS, launch Safari to access Apple Support pages, modify startup security settings (rarely required these days), and access Terminal. With Terminal, you can reset your macOS password. If your Mac can’t start up properly, it will try to launch the Recovery process within recoveryOS, which performs automatic repairs that Apple doesn’t document. If successful, you can then restart into macOS.

• Fallback recoveryOS: If recoveryOS is damaged—and that can happen—you can press the power button twice, quickly, and then keep holding it the second time. This fallback recovery volume can’t change startup security, but it can help you diagnose what’s going on. This is the duct-tape belt that helps if your pants come unbuttoned (macOS won’t boot) and your suspenders break (regular recoveryOS fails).

• Repair Assistant: From a powered-down state, press the power button until you hear the startup chime, then press and hold Command-D. (On an Intel Mac, hold the D key at startup.) The Diagnostics app can run hardware tests that might help narrow down a problem before you bring in Apple Support, or they may ask you to boot into that mode and share the results of the tests they have you run. Repair Assistant can fail, too, if its volume is damaged. You may then have to perform a special “revive or restore” operation, which requires another Mac. Or you may need a full reinstall using a bootable macOS installer.

• macOS: macOS is a sort of hidden boot volume for the last several releases. You don’t boot from the system; instead, a read-only snapshot of the system is mounted, and then booted from. This is part of Apple making system resources immutable through cryptography and at startup.

Besides using recoveryOS for the above tasks, you might also need to use it to unlock your Mac after locking it in Find My and to reset your password using a FileVault Recovery Key. Here’s how.

Unlock your Mac

While it’s not a common scenario, it could happen to you: you accidentally leave your Mac somewhere, or it’s stolen. Thinking quickly, you launch Find My on another of your devices or go to iCloud.com/find and log in. You then tap or click a few buttons to lock your Mac. If the Mac is connected to the Internet, it restarts and locks immediately. (Despite promising to display the message you entered when you locked it, macOS does not do so.) If it’s not connected, it restarts the next time it has Internet access.

The account used to lock the Mac is the only one that can unlock it, and you must be in front of the Mac to perform that operation. Apple limits each Mac to having Find My enabled from a single account. Here are the steps:

1. When you see the macOS Recovery title, click the account profile below it. Enter the account’s password and click Continue.
2. If you entered it correctly, “Authentication succeeded” appears. Click Restart.
3. The Mac restarts and shows Activate Mac after it boots up. This time, all the active macOS accounts are shown. Click one, and then enter its password. Click Next.
4. You now can choose to either use your Apple Account or a macOS password to continue. If you opt for the Apple Account, enter the full address or phone number as shown. Then enter the account’s password. Otherwise, you can click to enter the Mac password, which Apple says is the last one used to unlock the Mac in a regular session before it was locked. If you’re the only user on the Mac, that’s easy to figure out. (In testing with Golden Gate public beta 2, I wasn’t able to get the Mac password option to work, and I’ve had it fail in Tahoe, too.) Sometimes neither works. Choose Restart from the Apple menu in that case and try again.
5. On a successful entry, the Mac restarts yet again after a one-minute countdown. Enter your password when prompted to start up into a regular session.
6. Apple Pay will have been disabled, and your iCloud sync will probably be paused as well. When prompted after the macOS session starts, enter your Apple Account password (or passwords if you have multiple accounts linked to your macOS account).

If you try this too often, as I did while testing, or for other security reasons only Apple knows, your Apple Account may be locked. At step 6, I was told I had to reset my Apple Account password from one of my other devices; all four linked to the account were shown. I made that change. In the Golden Gate second public beta, clicking Unlock Account did nothing before or after changing. I was able to click Cancel, complete step 4 again with the new Apple Account password, and proceed to step 5 and restart.¹

Years ago, when you locked your Mac, you had to set a passcode to unlock it. While that isn’t supported on M-series Macs or Intel Macs with the T2 Security Chip, the email Apple sends still shows an image of a screen where you would enter that code and says you can only unlock your Mac with that non-existent passcode.

Unlock via FileVault

If you try to log into your Mac and can’t recall the password or it isn’t accepted, you can use your FileVault Recovery Key to unlock the volume and reset your password. The Recovery Key is a long code that’s a last-ditch way to unlock your startup volume. It’s also a back-door way to help with a post-Find My lock operation if your password won’t work or you’ve forgotten it.

[I’ve described how to set up FileVault and how to deal with the Recovery Key in “FileVault on macOS Tahoe uses iCloud Keychain to store its Recovery Key” and “FileVault keys can’t be escrowed in iCloud anymore.”]

Here’s how to use your Recovery Key to unlock FileVault:

1. At the login prompt, click the ? icon to the right of Enter Password to bring up the Reset Password link. (This also appears if you enter your password incorrectly a few times.) Click Reset Password.
2. Your Mac restarts into Recovery Assistant using its Reset Password pathway. Enter your Recovery Key (see articles above). Click Next.
3. If you entered your Recovery Key correctly, you are prompted to enter a new password for the account you rebooted from, and confirm it. Do so.
4. When you restart, you can now enter the new password.

If you forgot or can’t enter a correct password for unlocking your Mac in step 1 in the previous section, you can click “Forgot all passwords?” This will launch the FileVault-based password reset, let you reset the password for that account, then proceed with unlocking.

For further reading

To learn a lot more about Find My locking and unlocking, consult my book Take Control of Find My and AirTags, which covers the whole ecosystem. For a lot of insight into iOS, iPadOS, and macOS security, including FileVault, check out Take Control of Securing Your Apple Devices.

Revisions of those two titles for the 27 series of operating systems are coming out soon. You can purchase either today and receive a free update to the new version when it’s out.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

I dispense what might be called valuable insight to my friends, as well as in this public forum. My friends know the danger: they might become the topic of a column, which is true for my buddy Jeff, who left a bag containing his passport behind at a hotel. Fortunately, he had an AirTag in his bag. That was, however, just the beginning of the journey. (Jeff gave me permission to share his story.)¹

To avoid suspense, I’ll tell you that Jeff doesn’t have his bag back, but will soon.

Grate news

Jeff was out of town on business for a few days—he’s one of those nearly extinct creatures called a “full-time technology reporter“—and was carrying his passport to Texas not because it’s another country (it hasn’t seceded yet), but because he lacks a Real ID-upgraded driver’s license. He had a small bag with a few items, including the passport and an AirTag, that he didn’t need to carry, so he used the hotel safe. There have been many articles written about how unsafe hotel safes are, but it feels as if you’re in a decent hotel, it’s still another bar for someone to get through to steal your stuff.

Leaving in a bit of a rush, Jeff didn’t retrieve the bag from the safe. When he realized it wasn’t with him, thousands of miles later, he was peeved. Shouldn’t the “left behind” feature in Find My have alerted him? Find My showed the bag’s location, however. For some reason, it appeared as if it were in the hotel parking lot. I catastrophized with him, assuming it was stolen. He called the hotel, which said it wasn’t in lost and found.

A staff member went out, looked in the parking lot, and said the rough location was a grate—perhaps the bag had been stolen and someone had found the AirTag and dropped it through the slats? Which would imply that a hotel employee or a thief had managed to get into Jeff’s room after he left, open the safe, leave the hotel, and rummage through the bag in the parking lot before absconding.

That wasn’t the case (or valise). The hotel called back the next day. The previous staffer didn’t know, for some reason, that valuable left-behind items were tagged and placed in a safe in the basement, presumably below or near the parking lot. His bag, containing his passport and other items, would be sent back to him.

Jeff’s experience reveals several aspects of the Find My tracking system that you can take advantage of in advance or use if you’ve lost something or left it behind.

Don’t leave me!

Every device and item you have can be set to alert you when you “leave it behind.” I believe this setting is enabled by default, though Apple’s documentation isn’t clear on this point. All of my devices and items have it enabled, and Jeff found it was turned on for all his gear. Here’s how to check:

1. In a native Find My app, select the device (like a Mac) or an item (an AirTag or other Find My network item) in the list of such things.
2. On an iPhone, iPad, or Apple Watch, the action sheet appears. On a Mac, click the info (i) icon next to the item’s name on the map. In the upcoming version 27 operating system releases on all platforms, tap or click the More (…) button that appears when you select the device from the list.
3. Tap or click Notify When Left Behind, which should already show On. (In the 27 releases, tap or click When Left Behind.)
4. If disabled, turn it on.

Here’s a crucial detail: examine the “Notify me, except at” list. You can manually add to this set of locations (tap or click New Location). However, it primarily grows when you’re notified by an item or device being left behind, and then you tap or click in the notification to ignore it at that location. You are presented with the option to just exclude that item or device from that location or all of your equipment.

It’s very easy to approve that exclude-all button. (Jeff did not; his list didn’t include the hotel.) This can be convenient when you’re at a hotel, a friend’s house, or another location for a few days or frequently, and sometimes leave Find My-tracked stuff there. But once you ignore the location, you won’t get notified in the future. You can modify the list by hand, too.

Jeff may instead have been tripped up by the safe acting as a Faraday cage—a metal mesh or box that shields electromagnetic signals from passing through. The AirTag and other Find My items use Bluetooth to broadcast a rotating identifier at regular intervals.² If the safe blocked that signal, Jeff’s iPhone lost contact with the AirTag the moment the bag went in—a few days before he left. With no fresh separation between the phone and the item at departure time, the alert may have lacked the necessary trigger. Jeff was on the verge of sharing the location with the hotel when they found it.

Apple says this takes longer than the few days Jeff was on his trip: “You can see its last known location for up to seven days in the Find My app.” After seven days, the device or item’s location will appear as “No location found” or “Offline.” Jeff could see the item’s location, which made the lack of notification seem like a bug.

Now for the grate part (not great part): once Jeff’s bag was removed from the safe in his former room, it would have been carried through the hotel and detected by every iPhone, iPad, or Mac nearby. When it reached the hotel’s lost-and-found safe, the rough location would likely still be relatively close before it entered that particular Faraday cage. At which point, when Jeff looked at Find My, he saw it at (or under) the parking lot.

Sack attack

The hotel works with a service that handles the return. Jeff paid both a whopping and reasonable $60 to have it sent two-day air back to him. Fair enough! Unfair enough, days after he paid, the bag is still at the hotel (as I write this). Jeff will, of course, follow its progress via Find My.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

I had a simple task that involved Apple Home. If you use Apple Home, you know what happened next. Tears, frustration, the arrival of batteries, paperclips pushed into hard-to-reach holes, many online searches, and—if you are lucky, as I was—success.

Siri, am I lazy?

My goal was straightforward: can I know if the garage door is open without going to look? Early in the pandemic, we occasionally forgot to close it. While there was a locked door between the garage and the house, it still felt like we were playing with fire, as someone could steal a bike or other lesser goodies from the garage.¹ The garage is on our basement floor (ground level on one half of the house), and the last thing I enjoy doing at night is walking downstairs before bed to check the door.²

I purchased an Eve Door & Window Contact Sensor to have this capability reported by Apple Home, joining a growing set of HomeKit devices, including our front-door deadbolt. Because of our old-style single-piece swing-up garage door, I had a heck of a time finding the right place and right adhesive to stick the sensor where it was close enough for the two components to register.

I spent enough time on the vagaries of physics and materials that I was probably more frustrated than I needed to be when I tried to make a workflow with the danged thing. An Automation wouldn’t work because I wanted an alert, not for the sensor to trigger other Home devices. A Shortcut should have worked, but after many hours of trying over weeks, I was unable to get anything reliable to happen. The Automation was quite simple: at 9 p.m., check the state of the sensor, and send me a message if the sensor shows Open rather than Closed. I left it in place and walked away for literally years.

After recently installing a back-driveway camera, I was determined to get this sensor online.³ First, I replaced the battery, which had died during my period of disinterest. The Eve sensor uses a weird, tiny battery: a 3.6V 1/2 AA (ER14250). After that arrived, using some better adhesive—thin-film 3M 468MP—I positioned the sensor pieces in a better location and more securely.

Now it should work! Except that after adding it, I saw Characteristic in red text on a pink background in Shortcuts. Some online research led me to reset the sensor by inserting a paperclip into a hole I hadn’t noticed. After re-pairing the sensor, I was in business! Or was I?! The sensor wasn’t responding, despite recent status updates.

Threading the sensor through the house needle

This led me to the next culprit: the garage is too far away (one floor and the other end of the house) from my Apple TV, which acts as a Matter controller, while the Eve sensor relies on Thread as its communication protocol. What’s a Matter controller?⁴ And what’s Thread?

Matter is an overarching standard, painstakingly developed even as low-power sensing devices and other equipment proliferated in silos. Matter enables Amazon Alexa, Apple Home, Google Home, and Samsung SmartThings devices to communicate across a network, regardless of the network transport medium (Ethernet, Thread, or Wi-Fi). This prevents you from needing ecosystem-specific hubs and lets manufacturers build to a common standard.

Thread fits into this mix as a low-power, wireless networking standard for sensors, allowing them to communicate their status without rapidly draining their batteries, as would happen with Wi-Fi.⁵ Apple initially supported Thread with a proprietary standard, HomeKit-over-Thread, and later added direct Matter support. The Eve sensor was just old enough that it was running on the older standard, but the Eve app allowed me to apply a firmware upgrade. I could then migrate the sensor to Matter, which seems to be more reliable.

Apple made things a little confusing here, too. The 1st-generation Apple TV 4K supports Matter, but lacks a Thread radio, so it can’t work with Thread-based devices. The 2nd generation added that radio, so you can do Matter over Thread. But then, with the 3rd generation, Apple bifurcated Thread hardware support: the 64 GB Wi-Fi only model lacks a Thread radio; you have to spend the now-whopping $249 for a 128 GB Wi-Fi + Ethernet version if you want to use Thread.

Failing an Apple TV 4K with Thread, you can use a Thread border router (TBR), which sometimes comes with sensor kits. This plugs into your network via Wi-Fi or Ethernet and bridges to the Thread network, allowing the Apple TV’s Matter controller to work with the Home app on your devices for automations, notifications, and so forth.

It’s that easy, folks. Sigh.

I do own a 3rd-generation Apple TV 4K with Wi-Fi + Ethernet, because I am a fancy man and a big spender, but I really wanted the reliability of plugging it into my Ethernet network. Yet, I couldn’t get the Eve sensor’s Thread radio to reach across my house to talk to the Apple TV. I bought a TBR, thinking it would solve the problem.

By the time the TBR was delivered, however, the garage door sensor magically connected via Thread to the Apple TV and has been rock solid. The TBR that arrived, on the other hand, I was unable to pair and get working, so back it goes for a refund.

Now my nightly Shortcut works! The only fly in that ointment is that the sensor status reports as Closed or Open in iOS and iPadOS, but as 0 (closed) or 1 (open) in the macOS Home app, in both macOS 26 and the beta of 27. I can live with running the Shortcut from my phone.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

My beloved sister-in-law-in-law (my wife’s brother’s spouse) texted me with an important problem. Her mother had managed to delete the App Store from her Home Screen. How to restore it? While this is a common problem, I realized that the process is completely unintuitive.

For her mother’s particular situation, the answer felt like a cheat code for a video game: unlock, swipe left (once or more), search, touch and hold, drag. Done.

It’s worth a full review of how modern Home Screen management even works in iOS (and iPadOS), with the App Library view off some people’s radar entirely. Apple has, fortunately, not changed this process so far in the iOS 27/iPadOS 27 betas.

Delete or hide an app

I don’t use the term baroque lightly. However, Apple’s flowchart for choices you can make when deleting an app and what happens next has added some curlicues and ornamentation that can confuse the best of us.

It works like this:

First, touch and hold an app. That’s the easy part.

Now we fork into various swirls and pathways. Choose either Remove App or Require Face ID.

Remove App: You can pick from two options (or tap Cancel):

• Remove from Home Screen: The app’s icon disappears from your Home Screen page. However, it remains in the App Library, which I’ll describe below. More importantly, any data stored on your device remains accessible to the app. It’s like hiding, but not hiding!

• Delete App: Deleting an app removes the app from your device and its data stored on the device. This shouldn’t affect iCloud-synced data if you use the app on other platforms or other identical devices.

Require Face ID: Enabling Require Face ID hides content within the app from Spotlight results. You can add Hide to Require Face ID and also hide the app itself from Spotlight searches. Here are the two Face ID variations:

• Require Face ID: You can’t launch the app without using Face ID, separate from any authentication that may occur within an app for access to its data. You also can’t use data from the app in other apps without Face ID.

• Hide and Require Face ID: One step further, the app icon isn’t actually hidden! It remains in “obscured” fashion on the Home Screen, and appears in Hidden Apps in App Library. A hidden app that produces notifications, handles calls, or sends critical alerts has those suppressed as well. (Despite the statement that “This app will be obscured on your Home Screen,” it was simply removed for me.)

So, let me get this straight. If you remove the app from the Home Screen or Require Face ID, you can still search for it in Spotlight. If you delete it, it’s gone (though Spotlight may show it as a tap-to-download option from the App Store in results). If you Hide and Require Face ID, you can’t search for it or its contents, but you can find it in a Hidden folder in App Library. Got it, got it.

Despite the above, I have to throw in a big HOWEVER.¹ If the app is one of a few made by Apple and preinstalled, you can only remove it from the Home Screen. For instance, touch and hold Settings, Camera, Safari, and a few others, and then choose Remove App: only Remove from Home Screen appears; you can’t delete it, and you can’t use Hide and Require Face ID. Other Apple apps, like Stocks or Weather, may be freely tossed. Perfectly consistent and clear.

Since you now have perfect knowledge of all of these states and interactions, let’s look next at App Library, your Home Screen away from Home Screen.

Apple refused to call it Junk Drawer

I have used a succession of apps that I call, with affection, my “junk-drawer” apps. If you don’t have a drawer in your kitchen that is full of miscellaneous crap that you nonetheless occasionally or regularly need, but which has no place in any other drawer or organizational system, congratulations: you’ve just outed yourself as an extraterrestrial and Earth’s First Contact Committee is on its way.

For example, I throw in every piece of text, PDF, photo of receipt, file, and other detritus that I need to keep handy and email or a folder isn’t accessible enough. Then I can search within the app—convenient since everything is now OCR’d by default, so I can find any word or phrase across all media in the app.²

App Library is the equivalent of this, but just for apps. Do you find Spotlight too effusive in its results? Want to have an organizational scheme for apps you don’t have to set up or maintain? Swipe left until you get to the App Library page. You can scroll through pseudo-folders, from which you can tap to launch apps with full-size icons or tap groups of tiny icons to open the pseudo-folder categorizing those apps. You can also use the search field at the top to search only for apps, as opposed to using Spotlight. At the very bottom of the library is where you find Hidden, the not-exactly hidden set of Hide and Require Face ID apps.

To reverse previous choices from an app, App Library, or via Spotlight if the app is searchable:

• Find the app, touch and hold it, then drag it leftwards onto another Home Page page.
• For a Require Face ID app that’s not hidden, touch and hold it, validate with Face ID, then choose Don’t Require Face ID.
• For a hidden app, tap the Hidden folder, validate with Face ID, then touch and hold the app, and choose Don’t Require Face ID. This removes it from the Hidden folder.

If you deleted an app, you can search for its name in Spotlight, and you may see it in a list with a cloud download icon; you can tap that to restore it, but not its data, which you might be able to recall via logging into an account or it syncing with iCloud. You can also tap Search App Store in Spotlight. Or, launch App Store, search for the app’s name, and tap the cloud download button.

You can’t go Home Screen again

Reader Peter wrote in with a related question I can answer briefly: “No.” I’m sad about that, though. His question? He has a weirdly undeletable app—he can delete it, but it always reappears immediately and persists across migrations and devices. He wondered whether, after he triggered Settings: General: Transfer or Reset Phone: Reset: Reset Home Screen Layout, he could restore his painstakingly set-up Home Screen layouts.

If you have a suggestion, write me, or post in the Six Colors Discord, available to members. Discord is also where you can send a question for the column directly by using /glenn.

We live in a modern, jet-set, hyper-fast world! When we want to buy something online, boom, zoom, we use our fingerprint or face to approve the transaction, so we can grab the next Segway outta here! We don’t have time to enter a credit card! And can we trust a webpage form? Pfeh!

All right, calm down, 1950s inner voice, it’s not that bad. Most of our transactions involving a payment card or other sensitive data can be safely handled over a secure web connection. Apple Pay in Safari is the highest standard, of course, because the payment process involves encrypted elements, and your card number isn’t disclosed to the merchant. The Wallet app in iOS and the Wallet features in iPadOS and macOS further let us automate the entry of numbers and identifiers on pages we trust.

That’s all for automated commerce. What about other scenarios where you need to provide information to someone, often a friend or a local business, in order to transfer money or conduct a transaction? How can you be sure no one else is snooping in?

Make a call

Voice is still one of the most secure means of providing data. The landline wired and cellular wireless networks may be fertile ground for government agencies, but if you need to read a credit-card number or provide a PIN, a call is often the safest way to do so. By voice, you can always have the other person verify details that you believe only they know, or you can verify details to them for the same.

Because we live in a cyberpunk dystopian future, I do have to add a proviso. AI-generated voices have been convincing for a couple of years now—long enough that you shouldn’t trust an incoming call from someone you think you know, and certainly not from a bank, credit-card company, or other financial institution. I mean, I wrote “How To Avoid AI Voice Impersonation and Similar Scams” in January 2024! I assume the state-of-the-art scam is even better.

(The biggest takeaway is analog, too. Set a family password that you demand from a family member who calls asking for money or to do some weird phone or computer set of instructions.¹)

Unless recorded, voice calls also lack persistence, making them impossible to recover later. A real-time Bob needs to be either between Alice and Carol or doing an AI impression of Alice or Carol.

Use secure messaging

I could make the argument that using secure messaging carries even less risk than a voice call if you’ve had an ongoing messaging conversation with someone, so you know it’s really them. Are unsecured text messages being intercepted willy-nilly?² No, but there is also something about sending plain text all over the cellular networks that gives me the willies, nillies aside.

Secure messaging systems include:

• iMessage: While iMessage has seen exploits, they’re government-grade ones. Its secure end-to-end infrastructure is creaky, but unbroken. There’s an extra detail I’ll mention below.
• RCS with encryption: Between Apple Messages on iOS 26.5 or later and an Android device with RCS encryption support, you have a similar level of end-to-end protection. Make sure you see RCS encryption in the text field, or it’s just plain text. You can also use RCS encryption between two capable Android devices—as if!
• Signal: The Signal app and ecosystem have the best end-to-end encryption, as it implements some of the most modern approaches to protecting older messages and current conversations available so far.

The extra note on iMessage is complicated. Briefly, if you use Messages in iCloud, an encryption key to retrieve those messages is included in an iCloud-based iPhone or iPad backup. With access to your Apple Account, someone could potentially retrieve your stored messages. However, if you enable iCloud’s Advanced Data Protection, the backup is encrypted and requires endpoint decryption using one of your devices, protecting the Messages in iCloud encryption key. This should be a worry only if someone manages to obtain your Apple Account, can activate a second factor, and the information you passed via Messages is so sensitive that someone would hunt to uncover it.

Avoid using SMS or MMS text messages (unencrypted plain text), unencrypted RCS (in-transit/at-rest encryption), or other messaging systems where you’re not sure how they handle data protection. WhatsApp can be used if you either have backups disabled or have enabled end-to-end encrypted backups.

Don’t use most collaborative tools

I know that I spend a lot of time in shared documents, whether Google Docs, Notes, Pages, or more esoteric apps or web apps. Most lack the highest level of protection. Shared Pages and Numbers files on iCloud Drive, as well as Google Docs, are encrypted in transit and at rest, and granting shared access is relatively easy (very easy in Google Docs). For iCloud Drive documents, this is true even with Advanced Data Protection enabled.

I’d be dubious about pasting my driver’s license or credit-card information into any of them that are shared with someone else. Ditto, don’t take a picture of your payment card or driver’s license and share it via a Shared Album in Photos, as it has the same issue.

There are two notable (heh) exceptions: if you and the other party or parties to a shared Notes entry or an iCloud Shared Photo Library all have Advanced Data Protection enabled, end-to-end encryption is used.

Consider the risk

As with all decisions around privacy, consider how at risk you and your data are, including voice as data. In most cases, ensuring a baseline level of encryption can be enough. Even when the app or server can “see” your unscrambled information, the transport between your device and the server and another person’s device is encrypted. Someone would have to break into the server to sniff data. If stored on the server, the baseline state would be encrypted at rest; however, the server operator would manage those encryption keys.

For peace of mind, if not strictly necessary, I’d encourage you to consider using end-to-end encryption when you can. It’s so easily available. For someone to crack your connection, they would need to obtain one of your devices and be able to unlock it. Otherwise, the path between you and someone else is effectively impregnable.

For further reading

I cover message security extensively in my book Take Control of FaceTime and Messages, which I recently updated to include the beta release of RCS encryption for Apple-to-Android communication.

For more on Wallet, I wrote an entire book on that seemingly simple app and set of features, Take Control of Apple Wallet. The book arose from the frustrations of finding where things in Wallet (and outside Wallet but related to it) lived.

On the security side of things, Take Control of Securing Your Apple Devices includes detailed advice on the ins and outs of physical security: how to ensure someone with access to your hardware can’t reach your data.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

Years ago, in the era between the introduction of the iPhone and the modern period of widespread cellular coverage, my wife and I were driving with our quite young children across the vast, unexplored expanse of north-central Pennsylvania, en route to a family wedding. We had plotted out the route and knew where we were going: Eagles Mere, a tiny, former luxury resort town once at the end of a railway line. The town used to attract well-known actors, as well as New York City denizens, who would escape the summer heat and polio outbreaks back in the city.

As we tootled along, chatting with the kids and keeping them occupied, we suddenly went off the grid. We were still on a state highway, not yet turned to a smaller road, and yet there was no coverage. We figuratively slapped ourselves in the head. Had we gotten AAA maps or printed out whatever the technology was of the day—did MapQuest even still exist? No. We relied on having continuous cellular service. Readers, we did not wind up in the forest for a week, discovered by rescuers clad in bark and branches, feeding the children non-toxic berries. But we did learn a lesson.

Always have a map that doesn’t require cellular access! I mean, duh, of course, but we had been lulled in our coastal urban elitism to expect service, service, everywhere!

Of course, it wasn’t long after that Google introduced a download option; Apple added one for its Maps app a full decade later.¹ Downloading a map lets you access nearly everything you need while off the cellular grid, in an area where you don’t have service, when you have just a trickle of data, or when data access is metered and high-cost.

The usual provisos apply: something could go wrong, you might not have access to your iPhone or iPad, the map might be missing details you need, and so on. If you want a belt to go with your suspenders, consider printing out a paper map! Yes, paper still exists.

Common offline features

In both Google and Apple’s mapping apps—say that five times fast—a Download button should appear whenever you search by a name, like a park, business, or city. Otherwise, you have to hunt a bit, as I’ll explain below. Downloadable maps may require from about 150 MB to over 1 GB of storage, depending on the area you select and the amount of detail Apple or Google downloads for that selection.

The settings for both apps are quite similar: tap your profile picture in either app, then tap Offline Maps; in Google Maps, tap the gear icon. Now you can change preferences:

• Downloads (Apple)/Download preferences (Google): Opt whether to download only over Wi-Fi or over both Wi-Fi and cellular.
• Automatic Updates (Apple)/Auto-update offline maps (Google): When enabled, maps are periodically refreshed.
• Optimize Storage (Apple): The app automatically purges maps you haven’t used “in a while.”
• Sync with Apple Watch (iPhone only): You can also push offline maps to your Apple Watch, which has a lot less storage, but, really, how much are you keeping on it, anyway?
• Only Use Offline Maps (Apple): This forces the use of offline maps even when you have an Internet connection, which is useful when you are in one of the bandwidth scenarios above: low throughput or expensive usage-based service. Google automatically switches to an offline map when there’s low throughput available, or you have no connection.

Download from Apple Maps

If you search for a city name and there’s an exact best result, a Download button appears in the search result. I’ve also found that if Maps isn’t certain the match is correct, you may have to tap the city link, and then a Download button will appear. Enter a business name, tap the link that corresponds to the firm you want, and you can then tap the more (…) icon and choose Download Map. This also works for street addresses.

In all of the above cases, Maps shows you a portrait selection by default on an iPhone and a landscape one on an iPad. Adjust the area shape, and pinch and expand to zoom in or out, then tap Download. The estimated map download size appears above the Cancel and Download buttons.

Manage your offline data by tapping your profile picture and tapping Offline Maps. You’ll see all the stored maps, can delete them, and control settings. Tap a map, and you can then tap Rename, change the included area, or tap Delete Map. In the main Offline Maps view, tap Download New Map (iOS/iPadOS 26) or Add Offline Map (iOS/iPadOS 27) to search for a location and then immediately have the area-selection view appear.

Download from Google Maps

Search for a city name and tap a result. You may have to swipe left in the button bar to see the “Download offline map” link; tap it. If you’re viewing a map, tap your profile picture, then tap “Offline maps.” Tap “Select your own map,” then zoom in or out on the current map area; tap Download when you have the selection you want.

From your profile picture, tap “Offline maps” to view the list of available maps. Tap a map and tap Delete or Update, or tap the Edit (pencil) icon to rename it. From the main view, you can also tap the More (…) button to the right of a map to update, rename, or delete. You can’t change the selected area, however.

Print a goldarned map out

Having a physical map may seem like something from the early 2000s, so long ago few living souls remember it, but it’s an extra backup against calamity. With a color inkjet printer, you can squeeze a fair amount of detail into a letter-sized or A4 page.

Printing directions via Apple Maps in macOS Tahoe worked surprisingly well. It was like the good old days, but better, offering multiple pages of maps and step-by-step directions. You just get a standard print dialog, with no details to tweak. Google Maps on maps.google.com has a print mode, but it’s lackluster, with no step-by-step directions. In Safari, the preview and printed output were incorrect.

Postscript: Where she’s going, there are no Offline Maps

Of course, right after I wrote this, my older went off on a hike and came back…complaining about the poor performance of Offline Maps in Apple Maps. She was in a not-terribly-remote area in the mountains, about 90 minutes away, with intermittent cellular access. She had downloaded the map before she left, thinking it was successful. But even with no cell access or with the Offline Maps forced-use option enabled, she couldn’t get the offline map to work. Fortunately, the trail was well-signed and full of people, and there was no real chance of getting lost.

Back in Seattle, examining Offline Maps, these out-of-area maps she downloaded showed up as 0 KB. We tried to download the map again, but Apple Maps wouldn’t let us use the trailhead as a landmark. We found a nearby place and tried to download. The progress circle showed that a download was first underway, then complete, yet the download was again 0 KB. This happened repeatedly. More bizarrely, the offline map couldn’t be deleted. I attempted to replicate on my iPhone, where everything worked without error, including using the trailhead as the place name—a Download button appeared as expected.

We didn’t test Google Maps for comparison, since her hike was over, but it’s another reason to download and check that your offline maps are up to date and valid before departing.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

I have a Mac Studio M2 Max with 32 GB of RAM and a 1 TB SSD in front of me. While not the most powerful personal computer you can purchase today, it is among the most computationally capable ever made—a vastly capable machine. So why do I have to wait for typing to catch up with me and see a rainbow spinner on the regular?

I’ll tell you why: iCloud Drive and Spotlight. Apple lacks any transparency about how iCloud Drive works or fails. The same is true of Spotlight. These big black boxes churn away, performing a million billion operations a day, and we don’t know exactly what they do. That’s not me being conspiratorial: I honestly don’t care what’s happening under the hood—until it breaks. Without diagnostic tools, even someone like me, ostensibly an expert, can be completely at a loss and waste many hours.

I wrote “Cloudy with a Chance of Insanity: Unsticking iCloud Drive” for TidBITS back in October 2023 about a multi-month odyssey with Apple technical support in trying to dislodge unsyncable files.¹ That problem has barely surfaced since—an 80K file will sometimes get stuck for a while—and I thought Apple might have really solved syncing, at least as exhibited on my Mac. I receive dramatically fewer emails about iCloud Drive than I used to, which is another data point.

But Mr. Edge Case here can always find a way to break something.² I’ve been working on a large manuscript for my upcoming book, Flong Time, No See, a revised and expanded collection of researched articles I’ve written about printing and type history over the last several years.³ I pasted in text that was typically copied from Web pages, and wound up with over 250 footnotes.

While putting together the files for this book, Apple released its Creator Studio system, and shipped Pages 15. After having no problems, I dutifully switched over. This was months ago, and as I continued to work on this reasonably large file—weighing it at about 60,000 words now—everything seemed fine.

A few weeks ago, however, I started to experience system slowdowns. Pages was taking up 12 GB of system memory! System load went through the roof! CPU consumption was outlandish! All signs pointed to corespotlightd, a long-time enemy of performance. That daemon handles background indexing for Spotlight, and the slightest thing wrong in a file or directory, or perhaps due to mild corruption in its underlying files, turns it into a rampaging beast that eats processor cycles like I consume potato chips.⁴

There’s a well-known procedure for killing this beast, though another is spawned from its remains: stop the index, delete the index files, restart, and re-enable indexing. From the Terminal, use these commands. Make a backup before proceeding. Take extreme care with rm -rf, as a misstep in entering or copying can wipe out files!

 sudo mdutil -a -i off
 rm -rf ~/Library/Metadata/CoreSpotlight

You can use Restart from the Apple Menu while holding down the Option key (to avoid being asked), or you can take a shortcut from Terminal, assuming you have ensured all files are saved:

 sudo reboot

After your Mac restarts, go back to the Terminal and re-enable indexing:

 sudo mdutil -a -i on

For many (perhaps most) people, this solves the problem. For me, it just delayed it. With some isolation using System Settings: Spotlight: Search Privacy, I added specific folders, such as mail archives, since that seemed like it might be part of the problem.

One piece of advice I found suggested that if I thought Pages was the problem, I should exclude the iCloud Drive path containing Pages files. Fine! I clicked the plus icon in Search Privacy, pressed Command-Shift-G to bring up the path dialog, entered ~/Library/Mobile Documents/com~apple~Pages/, and clicked Choose. This seemed to work for a while, then nothing availed.

Finally, after analyzing logs and caches, the culprit was clear. It was not that large a Pages file: every time I saved, Spotlight’s worker bee was performing excessive re-indexing that consumed gigabytes and one or more processor cores. Moving the file to a local directory (in my Documents folder) while editing eliminated the problem. It also freed up space, as the temporary Spotlight indexes and Time Machine snapshots had become absurdly large.

What could Apple have done to help here? This is where I would hope machine learning, coupled with some interactive code- and system-expertise bots, could help:

• Note that a system component is acting well outside known parameters.
• Identify CPU usage that is tied to Apple-owned processes.
• Provide a troubleshooting tool, even suggesting it in notifications.
• Create human-readable logs that don’t require system administrator knowledge to interpret.

In the case I describe above, an Apple-created daemon was rampaging out of control due to a single identifiable file!—cascading into other problems. It should be solvable by Apple. The fact that we have more power under the hood by orders of magnitude in the past, coupled with neural cores in the CPU packages, just makes this even more embarrassing. Solve Siri, Apple, yes, but real transparency and troubleshooting in macOS would also make a big difference.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

Apple’s built-in screen sharing support for Mac-to-Mac connections has always been a help for those of us with remote setups: headless Macs acting as servers, an office and home Mac, or the laziness of having Macs in different parts of your house you want to access without standing up.¹

Under the hood, Apple relies on VNC (Virtual Network Computing), a fairly ancient standard at this point in time, and you probably get the sense of its creaking joints if you use the Screen Sharing app regularly.² But it’s possible you didn’t know that, starting in Sonoma, Apple added a “super excellent” mode to Screen Sharing as an option when you connect two Macs with M-series chips. Called High Performance, it can deliver on its name.

Let’s shift into overdrive

When you connect to another Mac using Screen Sharing, you’re given a choice of which mode to use. Let’s walk through the connection steps:

1. Either launch the Screen Sharing app and double-click the Mac’s name in a list, or, in the Finder, Control-click/right-click the Mac’s name and choose Screen Sharing. (There are still more ways to start, too.)
2. From the Select Screen Sharing Type options, you can select Standard, which is VNC-based, or High Performance, which adds Apple’s secret sauce on top.
3. Click Continue.
4. Enter your credentials.
5. The screen appears, and you may need to enter your macOS account password on the remote Mac to unlock it.

In that pathway, if you choose High Performance, you’re presented with different options. You can also click the info (i) button to the right of an existing connection in the Connections window in Screen Sharing, and choose High Performance from the Screen Sharing Type pop-up menu to save that option for the next connection.

With a Standard connection, you get a pixel-for-pixel remote view of the other Mac’s display or displays. It’s just like you’re sitting in front of it. In fact, if you use the same account as the currently logged-in user, the remote Mac shows what you’re doing to anyone who looks at it. (You can log in as another user, and a session starts in the background that doesn’t appear on the remote display screen.)

High Performance takes a different approach. You can opt to create one or two virtual displays on the remote Mac, each with independent resolution, high-dynamic-range (HDR) support, and other features. It’s like being a remote user of the computer rather than sharing. (This mode doesn’t change the remote display resolution or other settings.)

With a High Performance connection between Apple silicon Macs, you gain these advantages:

• You can choose one or two virtual displays, regardless of the number of displays connected to the shared computer.
• The Dynamic Resolution option lets you resize a virtual display to the native resolution of your local screen, up to 4K (3840×2160 pixels) or, with HiDPI, up to 1920×1080. You can click the Dynamic button on the Screen Sharing toolbar or choose View: Dynamic Resolution during a live session.
• Stereo audio passes over the connection, as does improved video. The connection supports HDR (for richer low-light and shadow tones), 4:4:4 chroma subsampling (uncompressed color data for improved fidelity), and high frame rates of 30 or 60 frames per second (for more stable video streaming, such as when watching a video or using video-editing software).

The downside of High Performance is that it imposes severe requirements for it to work well. You need 75 Mbps per 4K display and low network latency, which requires fast Wi-Fi with a gigabit-or-faster mesh or wired backbone if there are multiple network routers or base stations. However, that requirement also means that when you’re using High Performance, it feels very much like sitting in front of the other display rather than viewing it remotely.

If you want the depth of HDR Video, you have to enable it on the remote Mac via System Settings: Displays. The option for HDR Video appears in a Preset pop-up menu, but, of course, only if the display supports the right HDR signal. HDR can be enabled or disabled from the View menu and Screen Sharing toolbar, if it’s available.

Because the remote display is blacked out when using High Performance (even when connecting as the currently logged-in user), this can be seen as a privacy advantage if you have concerns about anyone else viewing the remote Mac’s screen. However, High Performance mode’s utility really lies in treating Screen Sharing like a high-speed display tunnel instead of a jerky remote view.

For further reading

If you’re looking for more detailed information about High Performance mode or any aspect of Mac-based file and screen sharing, you might consult my book, Take Control of Apple Screen and File Sharing.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]