Bypass Mac Firmware Password

Oct 19, 2009 - 149 Comments

bypass firmware password

Need to get around the boot level Mac firmware password? You can bypass a firmware password by doing a little bit of a hardware hack. There’s many reasons you’d want to get around firmware protection, but here’s why we got the instructions from an anonymous submitter:

“This is a tutorial mainly for the people at my school who wish to modify their macbooks, leased by the school. These computers are protected by the firmware password. This prevents you from booting up into Single User Mode, Verbose Mode, Safe Mode, Target Disk mode, and boot off of an external hard drive or network. There is a very simple way to remove these restrictions.”

I don’t know what school they’re at but it’s pretty cool to have a MacBook of your own provided by a school. While I can’t condone this activity I must say as a curious and tech savvy student I would have done the exact same thing… with that in mind I have reproduced instructions as they were provided to us below:

How to Get Around a Mac Firmware Password

This should work on both EFI (Intel) and OFI (PPC) based Macs. This is a hardware based hack, proceed with caution! We are not responsible for anything that may go wrong in the process.

Essentially you are removing the systems RAM and reinstalling it, here are the steps for a MacBook. This works the same on other Macs, but removing the RAM is obviously different, so you’d need to understand how to do that. Here are instructions for MacBooks:

1) Shut down your computer

2) Remove the battery

3) Remove the three philips head screws that are on the L-bracket

4) Remove the L-bracket

5) Slide one of the levers (it doesnt matter which one) to the left. This will release the RAM

6) Gently wiggle the RAM card out and put it aside, you will put it back later(do NOT touch the gold bars on the front; you could break it)

7) Replace the L-bracket and put the battery back in

8 ) Boot up the computer while holding COMMAND+OPTION+P+R (this resets the parameter ram)

9) Wait for the startup chime to sound 3 times

10) Release the keys and shutdown the machine once you reach the login screen

11) Remove Battery and L-Bracket, replace the RAM module and slide the lever back while pushing it in until it does not wiggle anymore

12) Replace The battery and L-Bracket

13) Now if you boot up the machine you should bypass the Mac firmware password.

You can now use the machine as usual, boot from an external drive, or whatever else.

Remember, this is bypassing the boot-level firmware password. If for some reason you forgot the Mac firmware password, read what to do about that here.

Of course most Macs don’t use Firmware passwords at all and instead have the software based password protection enabled only in the form of a user login and password, with Filevault encryption. If this is the case, you can use methods to reset a forgotten Mac password to get around the user login completely (instructions for OS X Lion are slightly different).

.

Related articles:

Posted by: David Mendez in Mac OS, Security, Tips & Tricks, Troubleshooting

149 Comments

» Comments RSS Feed

  1. James says:

    Does not work for me iMac A1418, took out one stick. Tried reboot to do PRAM reset and refuses to recognise the reset, just boots to screen with HDD missing (cos it was, I put a blank SSD in and USB to install). Boot selector screen and Command-R for recovery boot to Firmware lock.

    PITA

  2. Mnm says:

    David Mendez
    Man you rock !!
    Thanks . It works for me.
    A1286 mid2009. It works every time when you remove or change the place of the RAM.

  3. clinton smith says:

    Works on the MacBook pro A1278 2010 13″ model. I’m still running on just the one stick of ram, I’m almost afraid to put it back in. I think I’m going into the system preferences and just totally turn off the firmware password before I attempt to reinstall that last stick of ram. Funny thing, I took this to a refurbished apple dealer down the road before I fixed it. He ordered a third party software, kept it 2 weeks, and handed it back to me saying there’s nothing that can be done, it may as well be scrap. I get home and Google it, and it brought me here. Twenty min later, I’m writing this with a working MacBook pro. No files lost. Thank you for the instructions on how to do this.

  4. Thilak says:

    Fireware locked

    Can I get to know unlock

  5. Ivan says:

    Does it work on a regular mac? I have got this problem with a mac, the ones that have the ram downside. Will it work? how do I need to do the steps?

  6. andrew says:

    Thank you so much for this trick. I used it on a customer’s 2008 macbook pro with perfect results. The apple store insisted they wouldn’t do it without a proof of ownership (lost years ago) and told him he was out of luck. This trick worked and it worked the first time. Cheers!

    Andrew

    • Sree says:

      Hy Andrew,

      Could please help with this, i had the same problem and apple is not gonna show me a way .

  7. Albert says:

    Does this erase data in the process because I can’t remeber my firmware password but I want to keep me data

  8. Bill H says:

    I have a macbook pro5,5 powered by OS X 10.11 El Capitan. In order to reset firmware password I simply removed the battery and the two bank array of ram memory, 4gb each bank. Installed battery and memory and after pausing to press the mbp power button just to be sure (not teally necrssary) all electricity was drained.
    Booted El Capitan without pressing any button and the first thing that popped up was the firmware padlock awaiting a new password. System continued normally. Later I rebooted with Cmd “R” and went into disk utility and changed the firmware password via the recovery menu. All worked and I rebooted normally and was back to work in less that 20 minutes.

  9. DrAmsterdam says:

    I had the same thing (firmware-lock and Icloud-lock) and I use a lot of linux distro’s, so I had the feeling of a procedure that would probably work. We’ll it did!

    Important! Only if u don’t mind losing the files on your ssd or hd!

    1. Download a fedora workstation live-iso https://getfedora.org/
    2. Burn the .iso to a usb-stick. With Etcher https://etcher.io/ it will probably always burn successful, and available for win10, mac and linux.
    3. Download a ubuntu live-iso https://www.ubuntu.com/
    4. Burn it also to a usb-stick with Etcher.
    5. Fedora uses also efi, like macOS. So if ubuntu will not show up as a, .Windows install-disc when pressing the alt-key at start-up. Then first boot in fedora live. If u can boot straight to ubuntu you can go to step 7, but it can’t harm to follow step 6 also.
    6. Use the Disks utility in Fedora Live and delete all the partitions on the ssd/hd. Reboot.
    7. Boot into ubuntu. And actual install it on the whole ssd/hd. Because we still need to replace the apple-efi-recovery with grub2-bootloader. In the install-proces you will get a warning like: “When proceeding you will delete efi. It can be difficult to install another OS later on the machine” We’ll just press ok, and accept the grub2-install of ubuntu. Reboot.
    8. Hold the command-R keys at start-up. Make sure u can connect to wifi. Internet-recovery will start.
    9. Open disk-utility and just format the ssd/hd back to 1 Apple journaled GUID-partition
    10. Select fresh OSX install. Done! A fresh MacBook Air that u can register with your own Apple-ID.

    I only tested it on Macbook Airs shipped original with Lion but I can’t think of a reason why it will not work on newer ones. Older ones (pre-internet-recovery) U probably can use a OSX install-usb at step 8.

    Please add comments, when u run into some kind of trouble! Good luck!

    • shk says:

      Burn fedora workstation & ubuntu in one flash drive ??

    • shk says:

      do you have any idea for “forgot Firmware Password” ??

    • Patil says:

      Do you know if this works on 2017 MacBook Pro 13 with Touch Bar model?
      I bought this from someone and at that time there was no firmware password set I guess since I installed OS from Recovery mode. but then when I erased MacBook it asked me to set a passcode which I did but I forgot the passcode I had set and now when I start it in recovery mode it is asking me for Firmware password.

      Please let me know if these steps works to override firmware password?

      Thanks in Advance.

    • Jon says:

      Doesn’t work for icloud-locked macbook pro running 10.11.4.
      Any attempt to get into boot menu, recovery menu, etc, is all met with firmware lock screen, so it’s seemingly not possible to boot from USB.
      Able to boot into OSX itself still, but I’m unable to login as I can’t recall my account password, and I had a Recovery Key associated which I apparently didn’t store.

      Irksome to say the least.

  10. Geni says:

    Hi,
    I followed the instructions to reset the firmware password on my 2011 imac. My huband set the firmware password the night before he walked out 9 months ago. I have no experience at all working on computers. I followed each step exactly & now I am happily using the Mac again. Thank you!

  11. Suq Madiq says:

    Zapping the PRAM is not possible with a firmware locked MacBook Pro. If you try to zap the pram, you get the firmware password screen.

    So, if following this procedure works, zapping the PRAM is not necessary.

  12. Marc says:

    AWESOME !!! This worked!! Have an older MacBook from a school with a bios password & this got rid of it … THANK YOU !!!

  13. galuska says:

    i have a MacBook air 2013 model how do I get pass the icloud and firmware password.

  14. afaaf says:

    my mac air model 1369 stuck at padlock firmware password anybody can help iam from lebanon i donot know how to do we it is there a method to explain for me

  15. Aggravated says:

    I tried this and now the laptop won’t even turn on…MagSafe lights flicker amber and nothing happens when pressing the power button. I also have tried removing the battery and using just the ac adapter, and also holding the power button for 10 sec and disconnecting the power adapter trick…still nothing…the laptop won’t turn on

  16. Janet says:

    I just bought this 2011 late Macbook Pro. I first got the ? on a blinking folder. Then did the option and and then the padlock with a space for firmware password appeared. I have tried everything. I tried this twice, but still comes up as locked no matter what I do.

    Any other ideas? I called Apple and I was told that I must take to an authorized Apple repair or to their geek bar. Then they have to verify that I own. I even tried to format the drive (I do not want anyone elses junk). They said that they must correspond with apple and communicate with the machine via the serial number?
    Long story short, the apple dealer is over 100 miles away, over the mountains from here and I think that this is ridiculous.

    Thanks. But nothing works, I have done every command (I think) and even tried to boot up to Snow leopard.

    • perues says:

      Firmware passwords are intended to prevent theft and unauthorized access. You can bypass the firmware password with RAM removal as mentioned here, or by taking it to an Apple Authorized center with proof of purchase. You can think it’s annoying, but if it was your computer that was stolen, and you had set a firmware password on your Mac, you would be glad other people couldn’t gain access to your personal data, right? So bypassing it is not easy by design, that is the point.

      • Phillip says:

        Apple people friendly? Repair friendly? Since when not anymore not ever! Now money friendly Apple all about that, all day ever day!!! And FYI Microsoft is a software company, its just recently gotten into hardware so Microsoft is nowhere near Apple. Not even close!! Apple is definitely not right to repair they rather be the ewaste champios of the world…

    • tom says:

      i had a similar problem omn my 2010 Mac Pro after thinking it would be fun to try the El Cap beta: when the install prevented my using the machine at all, and stopped de-installation, I was stuck – first with the padlock (stupidly had set the firmware password and filed it too securely) and then the ?-mark – in the end, I bypassed the P/VRAM problem by taking al the eight RAM modules out all, replacing with two old ram modules that had not had the ElCap treatment and was able to reset the p/Vram in the usual way – then I was able to reboot into Mavericks from a hard drive set up as boot drive. Then reinstalled the 20Gb RAM and the other three hard drives – all working normally.
      Two lessons: write the Firmware password down and keep it somewhere sensible – and two, don’t try ElCap yet !

    • julie thrasher says:

      this is not quite true – i purchased a MBP 2014, secondhand. i have firmware lock problem as tried to migrate my other mac onto new one. So fter traisping round every dealership/mac place, i went to apple in london centre. apparently having a proof of purchase IS NOT ENOUGH!!! my receipt was not good enough – it ‘has to be an apple reeipt’ – well how can it be when it’s second hand – private purchase? too bad says apple. Get original owner to come in blah blah blah. well not only did original owner live in IRELAND (long way from London) but he is now DECEASED!! so i have no way of ever ever using the item I paid for and you get silly people always assuming youre a thief. well WTF Apple have turned into theives themselves – the man at te genius bar told me that he/apple woudn’t even accept an authorised apple reseller’s receipt. Thats just SH1T

  17. Michael says:

    Thank you. So easy and worked right away. Had not been able to get in the Mac for a year till now. :)

  18. Gt says:

    I have a MacBook Air early 2014, model A1465. Is there any possible way to unlock the firmware password? It’s 2015 someone should have already found a way.

    • virgahyatt says:

      You can replace the motherboard. That’s about it without a Proof of Purchase. With the POP just take it to the local Apple Retail Store. If you bought it direct from Apple they should be able to pull up the receipt too. So just your Photo ID.

  19. WellTrainedVC says:

    Thank you sir! I am fixing a Mid-2009 MacBook Pro 15″ – 2.53 Ghz (the way that Apple identifies each model is insane for the record).

    This tutorial/guide worked perfectly once I was able to clarify a couple of things. One of which is to remove only one of the two sticks of RAM. The way it is written is not clear on that point. I also was having no success with pulling the battery prior to pulling the RAM. I KNOW this is highly dangerous and can mean frying a stick of RAM or possibly both, but it was my only choice left to me after trying every other combination.

    I knew it was going to be successful the moment I heard the start-up chimes!!! I am ecstatic that this laptop can at least finally display, through the thunder port via HDMI, something that looks familiar instead of just the blank white screen!

    Now if I can only get the OS to reinstall without all these lengthy procedures!

    Thank you again!

    • Janet says:

      I also removed one stick, but my computer does not go anywhere else except to a page with a padlock and an area for a password, which I do not know.

      Apple is getting as bad as Microsoft. Why is this such a mystery? Apple use to be people friendly and so easy to repair, upgrade, format. Not anymore :(

  20. Snooper69 says:

    Sorry, this did not work for me. I have tried 3 times accordinbg to the list, but when the three chimes is sounded and let of the keys, it just continues to chime… when connecting it together again the Firmware password dialogue box reappears???

  21. Damiani says:

    iUnlockEFI.com can unlock it fast!

  22. mcmac says:

    To AlexNik and all,

    Hello.

    What is TSPS by the way ?
    Thank you.

    mcmac

  23. StephenJ says:

    I had a 2009 MacBook Pro with this problem. After trying a numb of the techniques mentioned above, without going to the more complex TSPS solution mentioned, I finally came on a combination that worked. I basically removed the two memory chips and then only returned one of them into the other one’s memory slot. This mean’t that I took out half of the memory of the computer. This was obviously enough of a change to the hardware configuration for the computer not to lock up. Consequently I could boot up and get the computer working. My plan is to swap another stick of ram to replace the one I had to take out. Interestingly enough, if I put both memory cards back in the computer still reverts to being locked. When I get around to putting a different memory card in to replace the one I had to take out I will post back here to let you know if it worked. Cheers.

  24. AlexNik says:

    Learn what to do if you no longer remember the firmware password that you’ve set or if you see a password dialog when you try to select a startup volume on a MacBook Air (Late 2010) and later, MacBook Pro (Early 2011) and later, iMac (Mid 2011) and later, or Mac mini (Mid 2011) computer.

    Only Apple retail stores or Apple Authorized Service Providers can unlock these computers protected by a firmware password.

    If you cannot remember the firmware password for your Mac, schedule a service appointment with either an Apple Retail Store or an Apple Authorized Service Provider. If you plan to visit an Apple Retail store, please make a reservation at the Genius Bar using http://www.apple.com/retail/geniusbar/ (available in some countries only).

    For the MacBook Air (Late 2010) and later, MacBook Pro (Early 2011) and later, iMac (Mid 2011) and later, and Mac mini (Mid 2011):

    Use the new Firmware Password Reset scheme:

    Start up the computer to the password entry screen by pressing and holding the Option key.
    Press the key sequence Shift + Control + Command + Option + S at this screen. A one-time use “Hash” code will appear. The code is case-sensitive, so provide TSPS with the Hash exactly as it appears on the customer’s screen.
    Shut down the customer’s computer.
    Contact TSPS via chat. Select Yes for the pre-chat question regarding firmware reset and provide the Hash to the advisor assisting you.
    TSPS will provide a signed binary file to be copied to a USB storage device (such as a flash formatted FAT or a USB hard drive with Mac OS Extended with GUID partition table).
    Insert the drive into the computer while it is off.
    Start up the computer while pressing and holding the Option key. Continue holding the Option key until the boot picker in EFI appears and confirm the password has been removed.
    Note: If the computer does not start up without the password prompt after following these steps and while you are holding down the Option key, either the Hash was provided incorrectly to TSPS or the file did not read off the drive successfully. The file may have been read correctly but confirmed it does not belong in the computer. Work with TSPS to troubleshoot these issues if necessary.
    This process is completely non-destructive to data or settings on the target computer.

    Note: If a customer has multiple computers with this issue, TSPS can handle up to 500 in one file. To escalate multiple computers, follow the steps above with the following additional step:

    Provide all the Hash keys in a new-line delimited text file (not RTF, but pure plain text) with no new line at the end. These files can be produced in TextEdit on Mac OS X, or files with multiple entries using vim on the command line.
    For example:
    V400300C1231MED144431A4F414420DDE5F1
    C455300Z555ABJ1118713148F413390ACE341
    C891200J18334D1099A3B6DD004E3F1A0122
    (No new line after the last entry.)

    After you receive the signed binary file from TSPS, use this procedure to reset the EFI firmware password:

    Format a Flash drive GUID partition scheme and Mac OS Extended format. Name it Firmware.
    Drag the binary file named “SCBO” to your Desktop.
    Open Terminal.
    Execute this command in Terminal:
    cp ~/Desktop/SCBO /Volumes/Firmware/.SCBO
    You should get a new line, no errors.
    Execute this command in Terminal:
    cp ~/Desktop/SCBO /Volumes/Firmware/._SCBO
    You should get a new line, no errors.
    Eject the Flash drive.
    Turn off the customer’s computer.
    Insert the Flash drive into the customer’s computer.
    Turn on the customer’s computer while pressing and holding the Option key.
    You should see the lock symbol for a moment, and then the computer should restart to the Startup Manager.
    If you still see a four-digit passcode lock after these steps at startup, reset the NVRAM by holding down Command-Option-P-R while restarting the computer.
    The EFI password is now removed.

  25. Samir says:

    No, nothing at all….

    I really don’t know what to do to solve this problem.

    can someone help me?!?!?!

    Samir

  26. Marcos says:

    Hello Samir, got anything?

    Thanks

  27. Samir says:

    By the way,

    I got it with a clean install of OSX Lion so I didn’t had to Install OSX again. But now as it is locked I tried to boot from an external drive, I also get an Firmware password that have to be used. So this means I have the Pinlock and the Firmware password that are blocking me from using the Macbook air (2012)

    Samir

  28. Samir says:

    Dear Nacer and others,

    I also have the same problem as described above. I bought a Macbook Air 2012 from a auction. I tried it and everything seems to be well. But after using it one day I tried to log in to iCloud and the Macbook Air shutted down and started up with the message: ‘Enter you system……….Mac”

    I really hope someone can help me as I can’t get in contact with the previous owner anymore. I have been searching for a week on the internet for a solution but couldn’t find an answer. Could you pleasseeee tell me how to solve this problem.

    In case (it would be easier or)I would need another Macbook air to use for solving this problem I could borrow the one of a friend (2011).

    PLEASE help me as I really need to use the Macbook soon and it already cost me a lot.

    Thanks a lot,

    Salam ou allaykum

    Samir

  29. Marcos says:

    anyone know what to do in case of macbooks where memory is soldered on the motherboard?

  30. Rob says:

    I have a Macbook Pro 15inch Mid-2012 macbook pro. I purchased from the auction a while back, but after fixing the LCD now and turning it on for the 1st time, I just saw a screen where it tells;

    “Enter your system lock PIN code to unlock this Mac.”

    I look in box but cannot locate a pin.
    Does anyone know how to fix it?

    My closest Apple store is 3 hours away and I am located in Abu Dhabi

    Model – Apple MacBook Pro (15-inch, mid 2012)

    All help is greatly appreciated

    Thanks

    • nacerabdrabou says:

      hey rob, all you need is just :
      1-remove a stick of ram
      2-remove battery
      3-stick the ram back in
      4-battery back in
      5-boot back up by: turned on your Mac computer then: holding cmd+alt+p+r for three times, let boot up.
      oups firmware password deleted :D
      here we go salem alikoum greeting from Algerian muslim ;)

      • Marcos says:

        in case of macbooks where memory is soldered on the motherboard?

      • bobbaboui says:

        Removing the ram on a 2012 MacbookPro will not unlock the FW. That technique will only work on 2010 and older models.

        To reset the firmware password on newer Macs, you must now follow these steps:

        1. Boot with Option key held to display the boot menu’s firmware password prompt.

        2. Press Control-Option-Command-Shift-S to reveal a 33-digit hash (mixed letters and numbers) that contains an identifier for your specific motherboard and the Atmel chip used for your system. In this hash, the first 17 digits are an identifier for the system’s motherboard, and the last 16 digits are a hash for the password.

        3. Submit the hash to Apple, where someone will put it through a special utility to create a keyfile that is specific for your machine.

        4. Place the file on a special USB boot drive and hold Option to load the boot menu and select this drive.

        5. The system will read the file and properly reset the firmware password stored in the Atmel chip.

        If you have older Macs that are vulnerable to easy FW unlock, I still recommend turning on FW lock as not everyone knows how to unlock it, add Filevault encryption too. I would also replace the drive with a fast SSD to make the r/w access to your encrypted data faster.

        If you dont have FW lock, it would only take me a minute or two to create an admin on your machine, compared to… 5 minutes if FW locked cause sometimes you need to remove screws on some models :)

      • javier lopez says:

        mY mac doesn’t have removable ram

  31. Sweat says:

    Great writeup I have tried alot of other fixes and none of them mentioned taking the battery out. It worked like a charm. Thanks again and great , great, great…

  32. Chris says:

    Seems to have worked on a Black 2007 MacBook or at least I can get to the Options screen now to select a startup disk. I think the HD crapped out and the firmware password is unknown on this teachers MacBook, before my time and not documented anywhere. Now if only I can get it to boot off disk or external drive to backup her files. She may have to learn another lesson! They never learn!

  33. Vino says:

    I spent more than 24 hours whith issue. I did remove the logic bord battery, hard disk and almost deassemble the whole iMac but unfortunately nothing happened.

    Finally removed all the ram and power on the iMac then hold the power to off then put the ram back and powered on now every think clear :)
    Thank God

  34. Big_DEvil says:

    It is not working at all..
    I have Macbook pro, this process is not working.
    cmd+p+r after removing the Ram. re install the Ram after the beb sound. it is not working.

  35. jdub says:

    worked like a charm on my mac mini!!!!

    thanks!!!!!

    • Leland Hendrix says:

      Could you please post the year/model of your Mini? That would help folks determine if it might work on theirs.

  36. Nathan says:

    All of you who are complaining that this is a security flaw on Macs are naive, and by making an accusation that Apple has somehow failed by allowing this is simply foolish.

    It is very easy to get around the BIOS (firmware) passwords on PC’s, too.

    Such “holes” have a purpose. For instance, an angry employee could set up such a password on a computer and disable various devices on it, making in effect making it an expensive pile of junk. Sure, you could pull the hard drive, but the rest of the computer would still be worthless as a machine. By being able to bypass the firmware password, one can prevent such a thing from ruining the computer.

    The number one rule of computer security is to not allow physical access to your computer, because almost anything can be done to it then. Why else do you think businesses have locks on the doors to their server rooms?

  37. Biocobi says:

    Sorry folks but there is no way to by pass lock screen (EFI) if you have got a new mac (air, book pro, or what ever) since early 2011. The main reazon is that every singel password is saved in to the bios (i know, i know…) well the little chip that serves as a bios (still it is actually a bios) that you have to remove and then get a new flashed one.

  38. Kay says:

    Coldhead or Dave could you please describe step by step how you did that? I have macbook unibody and this firmware password and don’t know what should I do. thnx

  39. iMac mid 2011 says:

    I’ve try many time with cmd option p r on the new imac mid 2011 unsuccessfully. Any other way around?

    • Coldhead says:

      The new imacs/MBP’s are virtually impossible to get past the firmware-password point. But i have found out a way around this but it does require a ‘PC’ . First i saved everything i wanted off my mac externally. The reason i have involved a windows computer btw is that, the imac/MBP’s hdd use SATA cable connection. so i pulled it out of my macbook pro and put it in my PC. My macbook hdd is a seagate 320gb and what i did was, i dowbloaded UBCD and used that to wipe the macbook hdd with my PC. because i did not have the OSX anymore for my mac(because i had just wiped it) i just redownloaded it from thepiratebay.se. now i have a firmware password-free computer ^_^ and also no restrictions. Life Is Good.

      • Dave says:

        Hey Coldhead, could you please elaborate how you or what you did. And does this work on 2011 Imac’s? thnx

        • Leland Hendrix says:

          I agree…that doesn’t make a lot of sense to me. Doing something to the HDD doesn’t change the firmware…

      • Alex says:

        I just tried doing exactly what you did. It doesn’t work!!

        I heard the passwords are saved in the bios, so erasing the hard drive has no effects whatsoever.

      • John Sawyer says:

        The firmware password isn’t stored on the hard drive–it’s stored in a small memory chip on the logic board.

        • Matt Grieve says:

          So this begs the question…where is the BIOS battery located on the motherboard? In a PC world you can easily reset a BIOS password by removing the battery from the system board and allowing the firmware/BIOS to lose it’s charge and settings. Trying to get past this firmware PW issue as well on an A1405 model. No RAM, no removable battery. At this point I’ve disconnected the battery and removed the SSD chip. I don’t see another battery on the board unless it’s hidden underneath something.

    • virgahyatt says:

      Sorry on modern macs there is not a way around the Firmware password. Either remember the password or take it to an Apple retail store / Apple Authorized Service Provider with a Proof of Purchase. As long as you have the POP they can bypass the lock.

  40. Troy says:

    absolutely does not work on a unibody aluminum macbook – in fact the descriptions above don;t make any sense – if you pull the ram then the macbook beeps forever regularly regardless of any keys you press (by the way that alt command P R cobination is only for PPC Macs – if you think it worked on an Intel then you’re mistaken – it was some other action like just pulling the ram or battery – that command is for the open firmware version only on a ppc ) – and how would the Mac boot into a login screen before putting the ram back in???
    come on guys , know your stuff before you advise !!!!

    • Leland Hendrix says:

      “absolutely does not work on a unibody aluminum macbook – in fact the descriptions above don;t make any sense – if you pull the ram then the macbook beeps forever regularly regardless of any keys you press (by the way that alt command P R cobination is only for PPC Macs”

      I’m afraid you’re wrong.

      COMMAND+ALT+P+R actually DOES work on intel-based, EFI machines. My Unibody MacBook Pro, 27″ iMac, Unibody Mac Mini, and MacBook Air, ALL USE this boot command. It resets PRAM–also known as PARAMETER RAM SETTINGS.

      It is the COMMAND+ALT+N+V that works only on PPC, and that is known as resetting NVRAM, or Non-Volatile Ram Setrings, for older machines’ logic boards.

      When you boot an Intel/EFI Mac holding cmd alt p r, you get a chime, indicating that the contents have been reset. Repeating the process three times, clears even more parameters.

      However, clearing the PRAM does not specifically mean that you have cleared a firmware password. Also, the RAM on the MacBook Air is non-removable.

      This, however, does NOT

      • virgahyatt says:

        I think you misunderstood. The instructions say to leave out the RAM while performing the PRAM reset. On an intel machine the PRAM reset will not work without RAM present because it doesn’t pass POST. You just get continuous triple beeps letting you know the RAM is missing.

        • John Sawyer says:

          The instructions don’t say to leave out the RAM–they say take out just one of the two RAM boards, then power up, and before the screen lights up, hold down Command-Option-P-R until you hear the Mac chime three times.

          • KoreneS says:

            all it does after pulling out only one card is have a gray question mark that continually flashes. It never goes to a login screen. I have a mac book pro A1278

      • Janet says:

        I agree. I removed the ram and there was a continuous beep over and over. Then I left one out and also tried but it did nothing but boot up to the firmware password request page again.

        • John Sawyer says:

          You may not have held down Command-Option-P-R quickly enough–you need to hold down all these keys right after powerup, before the screen lights up, and keep them held down until the Mac chimes three times.

    • Leland Hendrix says:

      Also, when they describe the login screen, I believe they are referring to the firmware password login and not the actual Mac OS X login screen. But you’re right about leaving out the RAM, the machine isn’t going ANHWHERE without RAM installed.

    • Fabian says:

      Troy, you only remove one stick of memory. With no RAM it will beep. Don´t take both sticks out, just one. Re-boot holding PRAM Reset. You should see the Apple Loading Bar. Then just re-install the OS X. Works just fine.

  41. Valer says:

    Is it possible to unlock the firmware password Macbook Pro(Late 2011)?

  42. Scoot K says:

    With the Thunderbolt models of Macs, this bypass feature is now gone. Sorry!

    • John Sawyer says:

      Some people report that the procedure doesn’t work with later-model Macs, but most people report that it does, so this may be a difference between some Mac models, possibly iMacs particularly.

  43. mac.since.2010 says:

    Does not work with MacBook Pro A1278 Unibody(2010). I have tried at least 7 times and still not able. Followed instructions to a T. Please somebodyHELP!!!!

    • John Sawyer says:

      Not sure why it wouldn’t work on that Macbook, since I just did it last night on the same model, and it worked fine.

  44. Parker says:

    Thank you so much!!

  45. […] CD or even in single user mode. Someone with bad intentions could still bypass it, but it would require quite a bit of alone time with your hardware. So, for best results, you’ll probably want to have both layers of protection: encrypt your […]

  46. Ariel Arias says:

    i was make the methods , imac work thanks a lot

  47. Greg says:

    I love you

  48. Dave Garten says:

    I’m pushin’ 60 and still tryin’ I could use a bit more information. I bought a headless Xserve (early 2008) with RAID and a blank 300GB SAS drive hoping to get Lion up and running. When I pop in an SL DVD, it gives me nada. I tried a Leopard Server disk and it presents me with eight steady system activity lights. I’m thinkin’ the EFI Firmware password is set and I can’t get this ballon to float (DVD offline). I tried pulling RAM and restarting with Command Option+P+R. I got all 16 lights on the front panel off then on several times, let go to restart, and then nada.
    Is there some magic combo of “set the startup parameters (startup options using front panel button-ology), pull the RAM, hold down a bunch o’ keys, pull the button cell, win – win -win!? If you can help, I’d appreciate any hints ou can offer. dgarten at nova dot org. :-\

    • bobbaboui says:

      Xserves have hardware locks that lock the case and keeps the drives from being removed. It also disables the USB and Firewire ports as well as the ODD. All you need is to turn that lock w/ a hex screw… LOL replying to a 2011 post. I hope you’re able get help back then and made use of that xServe, its an awesome machine.

  49. olly says:

    HELP! I am on an EMac, with the padlock issue and firmware password request. I have not set up a firmware password, so is there a default one I need? Thanks to anyone who can help.

  50. Christian says:

    I really want to say thank you for this thread
    I was desperate and didnt know what to do
    I did what you and my macbook comes alive again
    THANKS

  51. shuiji says:

    Macbook *white Late 2009 (INTEL)

    Done as written above….

    It works….

    thanks man!!!

  52. Luc says:

    This will work for PPC, because firmware lock does not block CMND+OPTION+P+R, however on intel this doesn’t work, checking on the apple website there is a chart that outlines what is blocked on intel and what is blocked on ppc, and unfortunately, it blocks every useful thing.

  53. Trevwa says:

    Thanks a lot to the poster for putting up this thread. I have solved a problem for a customer’s Mac BookPro. it was having the problem of booting to nothing but a grey folder with an question mark. [i run a hobby pc repair business]
    Im new at macs but figured out how to bring up the boot menu. However it has (and still does) a password on it.

    I drained the battry [the battry cannot be taken out] removed the ram and booted up without it. Then I put one stick back in and then turned it on and put in my OS X Snow leopard Disc. Then holding down control the boot menu came up. I booted from the disk and it all got sorted.

    We had tried everything to fix this and thank god its over. I had given up several times. Thanks for the winning piece of reaserch that got me through it.

    [I found all the torrents for the OS X useless and had to pay for a legit Disc. Im not sure on the .dmg files out there but they require a mac to burn. I couldnt get the burning programs like power ISO to do it on a pc. ]

  54. hilmela says:

    thanks dude… it work on me..

  55. Gordon G says:

    When you say “Pull the Hard Disk”, does this erase the firmware password. Or are you suggesting just buying another hard drive? Thanks, Gordon

    • Cody says:

      Well all you have to do is just remove your L-Bracket and place the hard drive back in. The L-Bracket is what the firmware password is on so you can reset it

      • John Sawyer says:

        Tel me you’re joking. The firmware password isn’t stored on the metal L-bracket that just covers the RAM boards and hard drive.

  56. laceymacker says:

    Can i just tell you how smart this “helpless” computer illiterate woman feeelsssss thanks to your advice on ram = out then pram ????? i am going to the hardware store now to fix a sink….. buwahahahahaahaha ty thomas
    wait….once i get it to the whole purple screen with english at top for language, do i got to utility repair?
    ( which is what i did….then hit repair “mac” and then it took a while but i went BACK to restart in my “Mac” hardrive mode…now the white screen and wheels are a spinnin….should i have boot from network or the hitatchia drive??? please ….considering a year ago, i couldnt email….so no tossing tomatos!!! lol thanks for your help…just wanna get to log in screen

  57. thomas says:

    works on both intel and ppc by the way!

  58. thomas says:

    this works when carried out exactly as stated. the last steps of putting back the RAM module are not even necessary:
    the firmware-password is stored based on a combination of hardware. at the mac-repair-lab i work in, altering any kind of hardware, then resetting PRAM (3 times the chime=important) works any time! removing RAM is the easiest way:
    remove one module, boot back up holding cmd-alt-p-r for three chimes, let boot up:firmware password deleted.

    • flitspuit says:

      Can you help with another step by step guide and maybe some pictures to go along with the guide

      • TB says:

        The precise process varies greatly between each Mac, but if a user is not comfortable with that sort of thing in general no amount of photos or pictures will do the job. This is the only way to bypass a firmware password outside of entering the password itself. Perhaps Apple has another solution themselves for Macs that are in their support or genius bar.

      • John Sawyer says:

        The website http://www.ifixit.com has step-by-step instructions, with photos, for removing and reinstalling RAM in all Mac models you’re likely to deal with, as well as complete take-apart steps for all other parts.

    • flitspuit says:

      Maybe a link with pictures

    • Knowing says:

      Removing the Ram does not reset the PRAM on macs 2010 and newer.
      Firmware password will prevent startup functions like resetting the PRAM too.

    • Nate Thompson says:

      I’m here 7 years later and can’t get the three chimes

      • Man says:

        LOL………. just 7 years???
        same here :D :D

        i’ve macbook pro late 2015. i’ve tried everythig disconnect battery, replace HDD, try to boot from external HDD or Flash Drive. All those reset trick Cmd+s, Cmd+R and bla bla bla…. more below didn’t worked anythig at all cuz it’s all blocked. check the link or read below there is no way no key shortcut works.
        Hats off to Apple

        GOOD LUCK TO ALL

        https://support.apple.com/en-us/HT1352

        Features of Open Firmware Password Protection on PowerPC and Intel-based Mac computers Power PC Intel
        Blocks the ability to use the “C” key to start up from an optical disc. √ √
        Blocks the ability to use the “D” key to start up from the Diagnostic volume of the Install DVD. √
        Blocks the ability to use the “N” key to start up from a NetBoot server. √ √
        Blocks the ability to use the “T” key to start up in Target Disk Mode (on computers that offer this feature). √ √
        Blocks the ability to start up in Verbose mode by pressing the Command-V key combination during startup. √ √
        Block the ability to start up a system in Single-user mode by pressing the Command-S key combination during startup. √ √
        Blocks a reset of Parameter RAM (PRAM) by pressing the Command-Option-P-R key combination during startup. √ √
        Requires the password to enter commands after starting up in Open Firmware, which is done by pressing the Command-Option-O-F key combination during startup. √
        Blocks the ability to start up in Safe Boot mode by pressing the Shift key during startup. √ √
        Requires the password to use the Startup Manager, accessed by pressing the Option key during startup (see below). √ √

  59. joe says:

    Just pull the Hard Disk and bypass all the bs.
    usb to sata and everything that is not encrypted is yours to see.

  60. […] disk, CD, or in single user mode. Someone with bad intentions could still bypass it, but it would quite a bit of alone time with your hardware. So, for best results, you’ll probably want to encrypt your files with FileVault and set up a […]

  61. […] disk, CD, or in single user mode. Someone with bad intentions could still bypass it, but it would quite a bit of alone time with your hardware. So, for best results, you’ll probably want to encrypt your files with FileVault and set up a […]

  62. scott says:

    forgot the relevant link:

    http://support.apple.com/kb/ht1352

  63. scott says:

    I believe this only works with PPC Macs only; Intel macs use EFI not OF so this would not work on a macbook or macbook pro. I have successfully used this trick on several old flowerpot iMacs in my lab. I assure the would-be tech that this does work on PPC machines.

    • tt says:

      dude I just did it on a macbook 2010 not pro and worked great I am so happy about not loosing 400 dollars on this mac I could kiss the author.

      • tt says:

        and it is an intel duel core 2.4
        now I just need to know how to disable the ram in a macbook air to do the same.

        • John Sawyer says:

          A Macbook Air, which has non-removable RAM, might require you to connect an external optical drive, and start up from an OS X installer DVD or a USB flash drive, and run its copy of the Firmware Password Utility to turn off the password option.

    • John Sawyer says:

      This method does work on Intel-based/EFI-based Macs to remove the firmware password. I’ve successfully done it. Apple simply designed the Intel Macs to allow their EFI to be reset in the same manner as the PowerPC Macs.

  64. Casey says:

    Just tried this on both a macbook and a macbook pro and this doesn’t work.

    • tt says:

      dude I just did it on a macbook 2010 not pro and worked great I am so happy about not loosing 400 dollars on this mac I could kiss the author.

    • John Sawyer says:

      You probably didn’t follow the full procedure as outlined in this article.

  65. jayson says:

    if command option p r is blocked from taking ram card out.then how can i get passed the firmwarepassword ..
    please help

  66. S says:

    @urpwnd: what startling security flaws? …

  67. kacpi says:

    hahah, COMMAND+OPTION+P+R is blocked from OpenFirmwarePassword

    • Jeev01 says:

      you’re smart fren.

    • John Sawyer says:

      Not if you follow the full procedure described in this article, which instructs you to first remove one of the RAM boards. That’s the key–when the Mac sees that the RAM configuration has changed (it also works if the Mac contains just one RAM board, and you add one for a total of two, or if you replace both RAM boards with two of a different size), then when you power up and hold down Command-Option-P-R (before the screen lights up) and let the Mac chime three times, it will reset the firmware password.

  68. urpwnd says:

    actually, macs have some pretty startling security flaws. and while i love my macs more than a man should probably love a computer, i don’t think they the second coming of jesus. for right now, macs have security through obscurity more than anything else. once they become more and more popular, they will end up a more likely target.

    but, as the article proves, with physical access to a machine, the sky is the limit.

    • pdunks313 says:

      It’s funny, right. Pople always think about macs as bieng stronger than pcs, but fewer people know how to hack them. In reality, it’s easier. And yes, I do know net user.

      • jaxx says:

        What is..?

        • josh says:

          the only reason macs are considered more secure, is because only a 1/5th “probably overestimation” owns them. So when compared to the number of viruses or bugs/hacks a pc is vulnerable to, its a lot less….. If 75% of the computer using population owned a mac and 25% was PC gungho, then as is in real life today, macs would be targeted as weak os and faulty, and PC would be the ultra secure, agent 007 inside and waiting for a threat. and yes macs are still pathetic in termes of security:) But one more point, if you were a big level hacker, would you rather hack a company that had 1000s of pcs at once, or a house here and there that has a few macs?

          • jesse says:

            a mac has a bash shell. it’s a BSD. You can lock it down much tighter than windows. You don’t know enough to talk about this, and the above method does not work on most mac’s made in the last 5 years.

            Sorry!

          • James says:

            Jesse, about not knowing enough to talk about this? You sir are incorrect in assuming you are an expert. This absolutely works on a bash shell, and if you are familiar with sudo commands, you would see how much more vulnerable Mac is than Windows. You don’t need a hacker disc such as Hiren’s to break into a Mac. This applies to all Intel based Macs.

      • Knowing says:

        With filevault, they cannot view your files after accessing the drive.
        They can erase or reinstall.
        However macs 2010 and newer will not allow you to reset the firmware password by removing ram etc.

  69. DistortedLoop says:

    Depressing to read that tip. We think of our Macs as so secure (Unix, firmware password, etc), only to learn how easy they are to get at if someone has physical access. Granted, any machine is vulnerable with physical access, but more and more, it’s looking like FileVault or similar is a must if you value your data’s privacy.

    • nobody says:

      i challenge you to name one file on your computer that ANYONE would be interested in stealing. your data is safe.

      • Yeah well says:

        Ah it’s not always about the data. For example, I used to have an iMac, with the findmymac-thing active. The thing got stolen, and probably with above mentioned method erased and sold through to someone who doesn’t have a clue the mac is stolen. I will never see it in the findmymac thing since it’s prbably been erased and reinstalled…

  70. bassface says:

    I think you may be over complicating the procedure, I believe all you need to do is remove the ram and then put it back in to get around the firmware password but I could be wrong. Nice trick either way!

    • Frank says:

      No it really works, I’ve been trying to do this for the last two weeks and it really works, just you need it to specify that there are two RAM cards you have to take just one off, for the procedure to work, my macbook pro 2010 is ready to work again, thanks man.

      • gene says:

        This worked on my 2009 macbook pro 13″. I had 2 sticks, removed them both and Mac wouldn’t start without them, put them both back in and same issue. Removed 1 stick and it let me reset! Perfect, thank you!

    • John Sawyer says:

      Just removing a RAM board and reinstalling it, prior to starting up the Macbook again, does nothing. You need to start up the Macbook while one of the RAM boards has been removed. This is how Apple designed this process to work–the Macbook needs to see that the RAM configuration has changed in order to carry out the firmware password removal.

      • jennifer says:

        2017 Imac pro, was my mothers that passed away. Installed high sierra next morning turned on for it to be stuck on apple loading bar tried to reset in recovery mode only keyboard command that works is option. It takes me to filmware password. I enter password and it freezes for a second then the password disappears and computer does nothing, can you help me please? its a a1419 model pro 570

        • otn says:

          Contact Apple for assistance with removing an iMac Pro firmware password, you will need proof of purchase, proof of ownership, any documents that demonstrate the computer is now yours etc. Good luck. It might even be under warranty still.

    • Steve Wenger says:

      I was basically told by Apple support that my 2007 Imac was a brick, obsolete and they could not fix it. I was ready to give up when I found this article. I pulled one RAM chip out followed directions and now I reloading OSX onto my Imac! This was a life saver for my Imac!

Leave a Reply

 

Shop on Amazon.com and help support OSXDaily!

Subscribe to OSXDaily

Subscribe to RSS Subscribe to Twitter Feed Follow on Facebook Subscribe to eMail Updates

Tips & Tricks

News

iPhone / iPad

Mac

Troubleshooting

Shop on Amazon to help support this site