curl -sL git.io/sudo-touch-id | sh

Now sudo is great, just like Safari — with your fingerprint in Terminal.

^{Don't worry, you can also reverse it}

_Result:

_{Just type git.io/sudotouchid to go here.}

• Fast & reliable
• Written in Bash — no dependencies
• pam_reattach support for tmux/screen compatibility (GUI session reattachment)
• Supports modern and legacy systems: For macOS 13 and below, see LEGACY_MACOS.md

brew install artginzburg/tap/sudo-touchid

Check out the formula if you're interested

Copy and run this command:

sudo-touchid

It adds TouchID to sudo configuration, or migrates an existing legacy configuration if you're upgrading from macOS 13 or below.

# Usage:
sudo-touchid [options]
             [-v,  --version]   # Output installed version
             [-d,  --disable]   # Remove TouchID from sudo config
             [--with-reattach]  # Include pam_reattach.so for tmux/screen support
             [--migrate]        # Migrate from legacy configuration
             [--verbose]        # Show detailed output
             [-q,  --quiet]     # Show minimal output (errors only)
             [-y,  --yes]       # Skip confirmation prompts (non-interactive mode)

if not installed, can be used via curl ^{bundled with macOS}

sh <( curl -sL git.io/sudo-touch-id )

Accepts the same arguments, like -d or -v.

• Productivity: Automates TouchID setup
• Lightweight: Small Bash script, no builds or Xcode required
• Reliable: Persistent configuration across system updates

For macOS 14+:

• Creates /etc/pam.d/sudo_local with TouchID configuration
• Never modifies system-managed /etc/pam.d/sudo file

All versions:

• Has a --disable (-d) option that removes all TouchID configurations.
• Optional --with-reattach for GUI session reattachment support
• Creates backup files during migration
• Automatically detects and migrates legacy configurations

Just save sudo-touchid.sh as /usr/local/bin/sudo-touchid with execute permissions

See LEGACY_MACOS.md for additional considerations on older systems

• tmux/screen support: pam_reattach module (built-in via --with-reattach)
• Apple Watch support: pam_watchid module
• Disable password prompt: Change %admin ALL=(ALL) ALL to %admin ALL=(ALL) NOPASSWD: ALL in /etc/sudoers