Use Touch ID for sudo on Mac

Every sudo command asks for your account password — which is strange on a Mac that unlocks everything else with a fingerprint. One small config change teaches sudo to accept Touch ID instead, and on macOS Sonoma and Sequoia there's an Apple-sanctioned file for it that survives system updates.

The modern way (Sonoma and Sequoia)

macOS ships a template at /etc/pam.d/sudo_local.template for exactly this customization. Files named sudo_local are read by sudo but — unlike the main config — are not overwritten by macOS updates.

1. Copy the template into place:

   sudo cp /etc/pam.d/sudo_local.template /etc/pam.d/sudo_local

2. Open it: sudo nano /etc/pam.d/sudo_local
3. Find the line #auth   sufficient   pam_tid.so and delete the leading # so it reads:

   auth       sufficient     pam_tid.so

4. Save (Ctrl+O, Return) and exit (Ctrl+X).

Test it in a fresh state: sudo -k forgets your cached credentials, then sudo ls should pop the Touch ID dialog instead of a password prompt. The password still works as a fallback — pam_tid.so is sufficient, not required, so a failed fingerprint (or a Mac in a closed-lid dock) falls through to the usual prompt. On a closed MacBook with an external keyboard, expect the password prompt; an Apple Watch can stand in if you use one.

Undo: remove the file — sudo rm /etc/pam.d/sudo_local — or re-add the # to that line. The template stays put for next time, and deleting sudo_local returns sudo to stock behavior exactly.

The old way (Ventura and earlier) and its catch

Before the template existed, the recipe was editing /etc/pam.d/sudo itself and inserting the same auth sufficient pam_tid.so line at the top of the auth entries. It works — but macOS replaces that file during every OS update, silently removing your line. If you're on Ventura, that's the trade: redo the edit after updates, or type passwords. (On Sonoma and later, don't edit the main file at all; the sudo_local mechanism exists precisely to end this cycle.)

If Touch ID doesn't appear in iTerm2

Terminal.app picks the change up immediately. iTerm2 sometimes doesn't, because its session-restoration feature detaches shells from the security context Touch ID needs:

1. Open iTerm2 → Settings → Advanced.
2. Search for "Allow sessions to survive logging out and back in" and set it to No.
3. Restart iTerm2 and try sudo -k; sudo ls again.

The same underlying limitation applies inside tmux sessions, where the fingerprint dialog can't reach the right process; the community fix there is the pam-reattach module (available via Homebrew), which is worth knowing exists if you live in tmux.

Is this less secure?

No — arguably the opposite. Touch ID authenticates through the Secure Enclave, nothing about sudo's privileges changes, and you type your admin password less often, which means fewer chances for it to end up in the wrong window, a screen recording, or a shoulder-surfer's memory. The password path remains available and required whenever biometrics can't run.

Boundaries to expect once it's working. Approval still respects sudo's grace period — after one successful authentication, further sudo commands in that Terminal window skip the prompt for a few minutes, fingerprint or not. And over SSH there is no Touch ID: remote sessions have no path to the sensor, so they always fall back to the password — correct behavior rather than a bug. The same applies inside tmux without the reattach module mentioned above. None of this changes what sudo may do — it only changes how you prove you're you, which is why the tweak is safe to recommend broadly.

While you're in nano

This edit is a perfect two-minute introduction to editing system files safely — backup, edit, test, with an undo in hand. Our nano guide covers the editor moves used here.