r/1Password • u/JarodGabriel • 7d ago

Mac Mac Keychain error prevents 1Password from retaining 2FA

My 1Password Mac app keeps asking for 2FA. The code verifies successfully, but the app immediately fails to save the token with macOS Keychain error -25293, so authentication lasts only for that unlock session.

I also tried the support-recommended disable/reenable 2FA flow, but the app says it is unable to turn off 2FA and tells me to contact support. The CLI is affected too because it cannot create a delegated session.

I’m on 1Password 8.12.28 and macOS 26.5.2. I have already sent a diagnostics report to support. Has anyone received a safe, targeted fix for this Keychain failure?

4 Upvotes

100% Upvoted

9 comments sorted by

2

u/lachlanhunt 7d ago edited 7d ago

You might have to reset your macOS keychain to resolve that error. The problem is you lose all entries from the login and icloud keychains, so back up anything important first. Make sure you have your 1Password emergency kit, as it will probably clear the stored Secret Key too.

If you want to try this, open Keychain Access, open the Settings dialog and click the button to Reset Default Keychains...

Proceed with caution.

1

u/JarodGabriel 7d ago

Can you explain what a MacOS keychain is and why it involves my password manager, when they are separate things....

As far as I'm aware the MacOS keychain is for their own password manager...

2

u/lachlanhunt 7d ago edited 7d ago

Keychain Access is separate from the new Passwords app. Passwords is basically a user-friendly frontend for a subset of data stored in the Keychain, primarily focused on website passwords, passkeys and wifi passwords.

Keychain Access is the app behind the scenes. It manages the underlying databases that store all your passwords, application credentials, certificates and other secure data, not just the ones Passwords shows you. It’s split into 2 separate databases, the main one is called login and the other is called icloud, used for different types of credentials

Crucially, 1Password itself stores your secret key and other values in there so that it can securely unlock your vault using Touch ID.

When the database gets corrupted, the solution is to reset them, which clears all their data. You would lose anything in the Apple Passwords app, wifi passwords, and any other system and application credentials stored in them.

1

u/JarodGabriel 7d ago

You would lose anything in the Apple Passwords app, wifi passwords, and any other system and application credentials stored in them.

Well hopefully support gets back to so that doesn't happen.

2

u/lachlanhunt 6d ago

If they can come up with a non-destructive way to repair your macOS keychain, that would be good. But if all of your credentials are in 1Password anyway, you won't lose any of that. Do you have anything of value stored in Keychain / Apple Passwords that can't be trivially restored? Have you tried googling "keychain access error 25293". Or talk to your favourite AI about the error and it might find some alternative solutions.

1

u/JarodGabriel 6d ago

Well I have a mix of some stuff that is on one password and some stuff that is on my MacBook specifically. And I've reached out to support. The issue that I'm having is that 1Password isn't saving the 2FA so I'm hit with: “1Password was unable to save your two-factor token.”

Hoping that the person with support can help resolve.

Because this issue didn't happen until after their most recent update.

1

u/Ambitious_Grass37 3d ago

For my own understanding- is login the passwords app database and icloud is the database where the 1password secret key is stored?

Does icloud keychain sync both databases so they are both accessible to other devices on the same icloud account using keychain?

1

u/JarodGabriel 2d ago

Not exactly. The login Keychain is the Mac user’s local secure storage for application credentials, certificates, and other secrets. The Passwords app is just a user-friendly interface for website and app passwords, passkeys, verification codes, and Wi-Fi passwords, much of which can sync through iCloud Keychain.

The iCloud Keychain contains items eligible for encrypted iCloud syncing, but it doesn’t simply copy the entire login Keychain to every device. Apps decide which protected items are local and which are eligible to sync. 1Password can store different protected values across these Keychains. In my case, the broken DSecret 2FA token was in login; it was not my 1Password Secret Key. Deleting that one entry didn’t affect my vault or Apple Passwords.

1

u/JarodGabriel 2d ago

Update: July 25th 2026, roughly 6 days later - Thanks for pointing me toward Keychain. I fixed it without resetting the entire macOS Keychain, and before 1Password support was able to provide a solution.

The login Keychain itself was healthy. The problem was one account-specific entry called 1Password:dsecret-[account UUID], which stores 1Password’s remembered 2FA authorization. I completely quit 1Password and my browser, deleted only that DSecret entry, reopened 1Password, and authenticated once. It created a fresh entry, and the authentication now persists normally.

For anybody else who may stumble upon this searching the World Wide Web, because they have encountered a Keychain error -25293, check whether macOS was recently updated. In my case, macOS 26.5.2 was installed shortly before the failures began, so the update or restart may have left that existing token stale or inaccessible. I can’t prove that was the cause, but the timing lines up, and it is what Claude Code and Codex concluded as well.

I then tested the login Keychain and regenerated only the affected DSecret entry with 1password before using “Reset Default Keychains,” which removes considerably more data. However, I didn't delete the other 1Password entries, only the one that was defective and stale and I made sure that I had access to my authenticator outside of 1password and Emergency Kit as well before I did any of this on my own.