Use Touch ID instead of typing your password for sudo — via Siddhant Khare (GitHub gist)

Commandmedium riskNeeds adminmacOS 14 Sonoma and later

If you use Terminal a lot, typing your password for every sudo gets old. Since macOS Sonoma, Apple ships a template file that lets sudo accept Touch ID, and it survives system updates (older hacks edited a file that updates overwrote).

Takes effect right away

The easy way

  1. Run the command. If you don't have an /etc/pam.d/sudo_local file yet, it creates one from Apple's sudo_local.template with the Touch ID line (pam_tid.so) switched on. If the file already exists, it stops and tells you, so nothing is overwritten.
  2. Open a new Terminal window and run sudo ls to test. You should get a Touch ID prompt.
  3. If you prefer to edit by hand: sudo cp /etc/pam.d/sudo_local.template /etc/pam.d/sudo_local, then open it with sudo nano /etc/pam.d/sudo_local and remove the # before the pam_tid.so line.

Command

Run in Terminal (Applications › Utilities). It uses sudo, so macOS asks for your password.

[ -e /etc/pam.d/sudo_local ] && echo 'sudo_local already exists: edit it by hand instead' || sed -e 's/^#auth/auth/' /etc/pam.d/sudo_local.template | sudo tee /etc/pam.d/sudo_local

Undo

sudo sed -i '' 's/^auth\(.*pam_tid\.so\)/#auth\1/' /etc/pam.d/sudo_local
Needs a Mac or keyboard with Touch ID. The undo only comments out the pam_tid.so line again and leaves anything else in the file alone. If this tweak created the file and you never added anything else to it, you can delete it instead with sudo rm /etc/pam.d/sudo_local. Don't edit /etc/pam.d/sudo itself.

Sources

Source reviewed
2026-11-02
Link checked
2026-11-02
Tested hands-on
Not by Oddbyte.Me

Oddbyte.Me hasn't tried this on every macOS version, so keep the undo handy.

touch idsudoterminalpampasswordsudo_local

More in Security & Privacy

Turn on FileVault so a stolen Mac can't be read — via Apple Support

Hidden settingmedium riskAdmin

On Apple silicon and T2 Macs the disk is always encrypted, but without FileVault it isn't tied to your password. Turning FileVault on means nobody can get at your files without your login password or recovery key. On older Intel Macs without a T2 chip it's the only disk encryption.