# Enable Touch ID for sudo on macOS

How to enable Touch ID for sudo in Terminal on macOS. Use /etc/pam.d/sudo_local so it survives OS updates, verify with sudo -k, and fix tmux when fingerprint auth fails.

- Published: 2026-08-04
- Updated: 2026-08-05
- Author: Vikas Kapadiya
- Category: Developer Tools
- Reading time: 6 min
- Canonical URL: https://kapadiya.net/blog/macos-touch-id-sudo/
- Tags: macOS, Touch ID, sudo, PAM, sudo_local, Terminal, fingerprint, Sonoma, Sequoia, tmux, iTerm2, pam_tid, Mole, mo touchid

If you live in Terminal (or iTerm, Ghostty, WezTerm…), `sudo` is a constant tax. You know the password. You still type it. Or you paste it. Or you fat-finger it and type it again.

Touch ID already unlocks the machine and approves App Store installs. It can authenticate `sudo` too — use your fingerprint instead of the password, with password still as fallback — and the whole setup takes about a minute.

Omar Shahine ([@OmarShahine](https://x.com/OmarShahine)) laid out the modern path clearly: use Apple’s drop-in file, not the base `sudo` PAM config older guides still edit.

[View the referenced post on X](https://x.com/i/web/status/2083750651482554421)

This post is that idea in my own words: a one-command shortcut if you already use Mole, then the manual `sudo_local` path so you know what actually changed, plus what to do when Touch ID for sudo is not working (especially inside tmux).

## Requirements

- A recent macOS release with `/etc/pam.d/sudo_local.template`
- A Mac with Touch ID
- An admin account

No reboot. The password path does not go away.

## Quick way: Mole (`mo touchid`)

Nick Taylor ([@nickytonline](https://x.com/nickytonline)) pointed out a shortcut on Omar’s thread: if you use [Mole](https://github.com/tw93/Mole) (the `mo` CLI), Touch ID for `sudo` is one command.

[View the referenced post on X](https://x.com/i/web/status/2083787965902319876)

Install Mole (Homebrew is the straightforward path):

```bash
brew install mole
```

Or with the project’s installer:

```bash
curl -fsSL https://raw.githubusercontent.com/tw93/mole/main/install.sh | bash
```

Then:

```bash
mo touchid
```

That is it. Mole configures Touch ID for `sudo` for you (still expect a password/Touch ID prompt when it needs admin). Nick covers the same shortcut in his [One Tip a Week](https://one-tip-a-week.beehiiv.com/p/one-tip-a-week-free-up-95gb-on-your-mac) write-up.

Always verify the result yourself:

```bash
sudo -k; sudo true && echo ok
```

Touch the sensor. You should see `ok`.

Mole is optional. If you prefer zero extra tooling — or you want to see the exact PAM drop-in — use the manual steps below. Same end state: `/etc/pam.d/sudo_local` with `pam_tid.so`.

## Why not edit `/etc/pam.d/sudo`?

Older write-ups tell you to open `/etc/pam.d/sudo` and add a `pam_tid.so` line. That works — until the next macOS update rewrites the file and your change is gone.

On current macOS releases, `sudo` includes a local drop-in:

```bash
cat /etc/pam.d/sudo
```

You want a line like this near the top of the auth stack:

```text
auth       include        sudo_local
```

That include is the whole point. Your custom rules live in `/etc/pam.d/sudo_local`. Apple can refresh the base `sudo` file; your local file is meant to stay.

If `include sudo_local` is missing, you are on an older PAM layout and should not follow this file path blindly.

## Manual way: enable Touch ID with the Apple template

Skip this if `mo touchid` already did the job and your verify step printed `ok`. Useful when you want the durable setup without installing Mole, or you need to debug what is on disk.

Apple ships a template with the right line commented out:

```bash
cat /etc/pam.d/sudo_local.template
```

Typical contents:

```text
# sudo_local: local config file which survives system update and is included for sudo
# uncomment following line to enable Touch ID for sudo
#auth       sufficient     pam_tid.so
```

If `/etc/pam.d/sudo_local` does not exist yet, that is normal. Create it by copying the template and uncommenting the auth line:

```bash
sudo sed 's/^#auth/auth/' /etc/pam.d/sudo_local.template | sudo tee /etc/pam.d/sudo_local
```

Confirm what landed:

```bash
cat /etc/pam.d/sudo_local
```

You want a single active auth rule (comments above it are fine):

```text
auth       sufficient     pam_tid.so
```

`sufficient` is the important control word. A successful Touch ID match succeeds auth and stops that part of the stack. A failed or cancelled prompt does **not** lock you out — PAM continues to the normal password check.

## Prove it works

Force a fresh prompt (clear any cached credentials), then run a no-op as root:

```bash
sudo -k; sudo true && echo ok
```

Touch the sensor. You should see `ok`.

Skip `sudo -k` and you may not get a prompt at all — the previous `sudo` credentials can still be valid.

If Touch ID still does not appear, open a fresh Terminal tab or window and test again. Cached credentials and a stuck session are the usual false negatives.

## Touch ID for sudo not working?

Work through this before rewriting files at random:

1. **Wrong file.** If you only edited `/etc/pam.d/sudo`, an OS update may have wiped it. Prefer `sudo_local` (above).
2. **Missing include.** `cat /etc/pam.d/sudo` must show `auth include sudo_local`.
3. **Commented line.** `sudo_local` must have an uncommented `auth sufficient pam_tid.so`.
4. **Credential cache.** Always retest with `sudo -k` first.
5. **Multiplexer.** Inside tmux or screen, you almost always need `pam-reattach` (next section). Plain Terminal often works without it.
6. **Remote shell.** SSH into another host never uses your Mac’s Touch ID for that remote `sudo`.

## tmux and screen: pam-reattach

Inside tmux or screen, Touch ID for `sudo` often does nothing even when `sudo_local` looks correct — a common “Touch ID sudo not working” report. The session is detached from the bootstrap namespace Touch ID needs.

Install the reattach helper:

```bash
brew install pam-reattach
```

Then put **reattach above** Touch ID in `/etc/pam.d/sudo_local`. Order is not decorative — PAM walks the file top to bottom.

**Apple Silicon (Homebrew default):**

```text
auth       optional       /opt/homebrew/lib/pam/pam_reattach.so
auth       sufficient     pam_tid.so
```

**Intel Macs** (Homebrew under `/usr/local`):

```text
auth       optional       /usr/local/lib/pam/pam_reattach.so
auth       sufficient     pam_tid.so
```

If those two lines are reversed, the file can look “right” and still never present Touch ID from a multiplexed shell.

Edit carefully — you need an existing admin session (or a password that still works) to fix a broken PAM file. Make one change, retest with `sudo -k; sudo true`, then move on.

## Agents cannot finish this for you

Coding agents can read `/etc/pam.d` and draft the exact command, but they usually run without a real TTY. `sudo` has nowhere to prompt them, so the write has to come from your terminal (or your IDE’s “run in my shell” path).

Hand an agent a tight instruction if you want the setup reviewed first: use `sudo_local` (not `sudo`), check existing files, print the command for you to run, and include pam-reattach line order if you use tmux. You still paste and execute the write yourself.

## Quick checklist: enable Touch ID for sudo

1. **Fast path:** install [Mole](https://github.com/tw93/Mole) and run `mo touchid`, **or** do the manual `sudo_local` steps below.
2. Confirm `auth include sudo_local` in `/etc/pam.d/sudo` and that `/etc/pam.d/sudo_local.template` exists.
3. Create `/etc/pam.d/sudo_local` from the template with `auth sufficient pam_tid.so` uncommented (Mole does this for you).
4. Test with `sudo -k; sudo true && echo ok` and touch the sensor.
5. If you use tmux/screen: install `pam-reattach` and list it **above** `pam_tid.so`.
6. Keep typing your password when the sensor is covered, wet, or unavailable — fallback stays intact.
7. Expect this to work only for local `sudo` on the Mac itself, not for SSH sessions into another machine.

## Takeaway

If you already run Mole, the shortest path is `mo touchid`. If you want the durable setup with no extra tool, skip the one-line edit of `/etc/pam.d/sudo` that older guides still show. Prefer Apple’s drop-in at `/etc/pam.d/sudo_local`, one uncommented `pam_tid.so` line, a hard test with `sudo -k`, and `pam-reattach` if your shell lives inside tmux.

Fast path:

```bash
brew install mole
mo touchid
sudo -k; sudo true && echo ok
```

Manual one-liner:

```bash
sudo sed 's/^#auth/auth/' /etc/pam.d/sudo_local.template | sudo tee /etc/pam.d/sudo_local
```

Then prove it:

```bash
sudo -k; sudo true && echo ok
```

---

**References:** Omar Shahine ([@OmarShahine](https://x.com/OmarShahine)) — [original post](https://x.com/OmarShahine/status/2083750651482554421). Nick Taylor ([@nickytonline](https://x.com/nickytonline)) — [Mole / `mo touchid` reply](https://x.com/nickytonline/status/2083787965902319876) and [One Tip a Week](https://one-tip-a-week.beehiiv.com/p/one-tip-a-week-free-up-95gb-on-your-mac). [Mole](https://github.com/tw93/Mole) by [tw93](https://github.com/tw93).