Fingerprint unlock for the Macs that have no Touch ID

Why your desktop Mac has no fingerprint reader

Touch ID is fused to the Secure Enclave inside the Mac, so Apple ships it in exactly two places: the keyboard of a MacBook, and the Magic Keyboard with Touch ID, which costs US$149 to US$199 and only works with Apple Silicon Macs. There is no standalone Touch ID sensor, and no third party can make one.

If you use a Mac mini, a Mac Studio, an iMac, or a MacBook in clamshell mode with an external display, that leaves you typing your password for the lock screen, for sudo, for System Settings, for the App Store and for every admin dialog. If you prefer a mechanical keyboard, you cannot buy your way out of it at all.

What immurok does on a Mac

• Screen unlock. Wake the display, touch the key, you are in. Works on a Mac mini, Mac Studio and iMac, and on a MacBook with the lid closed.
• sudo and system authorization. A PAM module, pam_immurok.so, sits in front of sudo and the system's authorization prompts. The touch is the credential; no password is stored or typed.
• App Store and the Passwords app. A touch signs you into the App Store and unlocks Apple's Passwords app, so you stop typing your Apple ID password.
• 1Password, Bitwarden, LastPass, Proton Pass. When the unlock prompt appears, a touch fills in a dedicated vault password that lives on the key, stored separately from your login password.
• SSH and Git signing. The key holds an ECDSA P-256 key. git push and ssh ask for a touch instead of a passphrase, and the private key never leaves the hardware.
• TOTP codes. Keep two-factor seeds on the key rather than in an app on the Mac.
• Two Macs, one key. Bind it to a desk Mac and a MacBook. One dedicated finger switches between them; the target Mac reconnects on its own.

How it works

immurok pairs over Bluetooth LE and shows up in macOS as a keyboard, which is what keeps the connection alive across sleep. The actual traffic goes over an encrypted GATT channel that the menu bar app owns. The app is a small Swift program, open source under Apache 2.0, that runs as a login item. macOS 13.0 or later, one universal build for Apple Silicon and Intel.

There is no single API on macOS that a fingerprint can plug into, so the app meets each surface with the mechanism that surface uses: PAM for sudo and authorization prompts, credential injection for the App Store and Passwords, and a documented bridge for the lock screen. The design and its trade-offs are written up in One touch, three paths.

Setting it up takes three steps

1. Pair the key in System Settings → Bluetooth, as you would a wireless keyboard.
2. Open the immurok app and pair again there. This is the encrypted pairing; confirm it by pressing the button on the underside of the key.
3. Enrol a fingerprint: touch the sensor about a dozen times, lifting and tilting slightly each time.

Then switch on the integrations you want in the app. The user manual has the full walkthrough.

What it is not

immurok is not Touch ID and does not pretend to be. It has its own sensor and its own security model, and macOS does not treat it as a biometric. That means it cannot confirm Apple Pay purchases on the Mac, and apps that call Apple's own biometric prompt still expect Touch ID or your password. What immurok covers is the everyday password friction: unlock, sudo, admin dialogs, App Store, password managers, SSH. Side-by-side with Touch ID.

Common questions