diff --git a/README.md b/README.md
index 2849575..bec3a5c 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,9 @@ CoreOS VM GUI for OS X
 
 It supports only a standalone CoreOS VM, cluster one (Vagrant based) is at [CoreOS Cluster GUI for OS X](https://github.com/rimusz/coreos-osx-gui-cluster).
 
-**New:** from v1.0.0 it is now based on [coreos-xhyve](https://github.com/coreos/coreos-xhyve), that allows to have no dependencies on VirtualBox and Vagrant anymore and runs VM with just a single binary of [xhyve](https://github.com/mist64/xhyve).
+**NEW:** from v1.0.0 it is now based on [coreos-xhyve](https://github.com/coreos/coreos-xhyve), that allows to have no dependencies on VirtualBox and Vagrant anymore and runs VM with just a single binary of [xhyve](https://github.com/mist64/xhyve).
+
+**NEW:** Mac user password is not stored to the file system anymore (used to run sudo), `OS X Keychain` is now used to store it !!!
 
 ![CoreOS-OSX-GUI](coreos-osx-gui.png "CoreOS-OSX-GUI")
 
diff --git a/src/CoreOS GUI.xcodeproj/project.pbxproj b/src/CoreOS GUI.xcodeproj/project.pbxproj
index 845583a..09d95e2 100644
--- a/src/CoreOS GUI.xcodeproj/project.pbxproj	
+++ b/src/CoreOS GUI.xcodeproj/project.pbxproj	
@@ -15,6 +15,8 @@
 		01741B63190DB80500BB1F91 /* first-init.command in Resources */ = {isa = PBXBuildFile; fileRef = 01741B62190DB80500BB1F91 /* first-init.command */; };
 		01741B65190DB81400BB1F91 /* up.command in Resources */ = {isa = PBXBuildFile; fileRef = 01741B64190DB81400BB1F91 /* up.command */; };
 		01741B67190DB82100BB1F91 /* update_osx_clients_files.command in Resources */ = {isa = PBXBuildFile; fileRef = 01741B66190DB82100BB1F91 /* update_osx_clients_files.command */; };
+		019410621BE0D8B200723E19 /* go_webserver in Resources */ = {isa = PBXBuildFile; fileRef = 019410611BE0D8B200723E19 /* go_webserver */; };
+		019410641BE0E5F200723E19 /* kill_VM.command in Resources */ = {isa = PBXBuildFile; fileRef = 019410631BE0E5F200723E19 /* kill_VM.command */; };
 		019662121B04C562005FA955 /* bin in Resources */ = {isa = PBXBuildFile; fileRef = 019662111B04C562005FA955 /* bin */; };
 		019662141B04C598005FA955 /* settings in Resources */ = {isa = PBXBuildFile; fileRef = 019662131B04C598005FA955 /* settings */; };
 		019662181B04C6EA005FA955 /* files in Resources */ = {isa = PBXBuildFile; fileRef = 019662171B04C6EA005FA955 /* files */; };
@@ -52,6 +54,8 @@
 		01741B62190DB80500BB1F91 /* first-init.command */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = "first-init.command"; sourceTree = SOURCE_ROOT; };
 		01741B64190DB81400BB1F91 /* up.command */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = up.command; sourceTree = SOURCE_ROOT; };
 		01741B66190DB82100BB1F91 /* update_osx_clients_files.command */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = update_osx_clients_files.command; sourceTree = SOURCE_ROOT; };
+		019410611BE0D8B200723E19 /* go_webserver */ = {isa = PBXFileReference; lastKnownFileType = folder; path = go_webserver; sourceTree = "<group>"; };
+		019410631BE0E5F200723E19 /* kill_VM.command */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.sh; path = kill_VM.command; sourceTree = "<group>"; };
 		019662111B04C562005FA955 /* bin */ = {isa = PBXFileReference; lastKnownFileType = folder; path = bin; sourceTree = SOURCE_ROOT; };
 		019662131B04C598005FA955 /* settings */ = {isa = PBXFileReference; lastKnownFileType = folder; path = settings; sourceTree = SOURCE_ROOT; };
 		019662171B04C6EA005FA955 /* files */ = {isa = PBXFileReference; lastKnownFileType = folder; path = files; sourceTree = SOURCE_ROOT; };
@@ -178,20 +182,22 @@
 		01E285B918A6E23C00BC630D /* Scripts */ = {
 			isa = PBXGroup;
 			children = (
+				019410611BE0D8B200723E19 /* go_webserver */,
 				01663CBF1B667E13008D5D9F /* docker2aci */,
 				134AB3341BD7D11400D55BC4 /* registry */,
 				01D1B9881B60F2AD0059B73E /* xhyve */,
 				019662111B04C562005FA955 /* bin */,
 				01D1B9861B60D9A70059B73E /* start_VM.command */,
+				01741B64190DB81400BB1F91 /* up.command */,
 				0106B3491B65277F001709E0 /* functions.sh */,
 				01B675D51B602FC2004349CC /* check_vm_status.command */,
 				01CFC2DB1A2AA48300F251C2 /* change_release_channel.command */,
 				01CFC2DC1A2AA48300F251C2 /* destroy.command */,
-				01741B64190DB81400BB1F91 /* up.command */,
 				0145318318FF209D007F9C95 /* ssh.command */,
 				0111FADA1A7FA2A10021F258 /* os_shell.command */,
 				01C7F8F31B63B3B600CF2E26 /* console.command */,
 				01993A4E1B63DD730096E2E1 /* halt.command */,
+				019410631BE0E5F200723E19 /* kill_VM.command */,
 				01CFC2DD1A2AA48300F251C2 /* reload.command */,
 				01AD94BE1A278C94009A400B /* fetch_latest_iso.command */,
 				01741B66190DB82100BB1F91 /* update_osx_clients_files.command */,
@@ -295,10 +301,12 @@
 				0106B34A1B65277F001709E0 /* functions.sh in Resources */,
 				01741B57190DB7B800BB1F91 /* coreos-osx-install.command in Resources */,
 				131C2B7F1BD686CB002FF9BE /* fleet in Resources */,
+				019410641BE0E5F200723E19 /* kill_VM.command in Resources */,
 				01CFC2DE1A2AA48300F251C2 /* change_release_channel.command in Resources */,
 				01E2854E18A6C4E300BC630D /* Credits.rtf in Resources */,
 				01E2855418A6C4E300BC630D /* MainMenu.xib in Resources */,
 				01741B67190DB82100BB1F91 /* update_osx_clients_files.command in Resources */,
+				019410621BE0D8B200723E19 /* go_webserver in Resources */,
 				01663CC01B667E13008D5D9F /* docker2aci in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
diff --git a/src/CoreOS GUI/AppDelegate.m b/src/CoreOS GUI/AppDelegate.m
index 30624a7..204827c 100644
--- a/src/CoreOS GUI/AppDelegate.m	
+++ b/src/CoreOS GUI/AppDelegate.m	
@@ -164,6 +164,12 @@ - (IBAction)Stop:(id)sender {
                 [[NSUserNotificationCenter defaultUserNotificationCenter] deliverNotification:notification];
                 break;
             }
+            else
+            {
+                NSString *scriptName = [[NSString alloc] init];
+                NSString *arguments = [[NSString alloc] init];
+                [self runScript:scriptName = @"kill_VM" arguments:arguments = @""];
+            }
         }
     }
 }
@@ -516,6 +522,12 @@ - (IBAction)quit:(id)sender {
                 [[NSUserNotificationCenter defaultUserNotificationCenter] deliverNotification:notification];
                 break;
             }
+            else
+            {
+                NSString *scriptName = [[NSString alloc] init];
+                NSString *arguments = [[NSString alloc] init];
+                [self runScript:scriptName = @"kill_VM" arguments:arguments = @""];
+            }
         }
     }
     
diff --git a/src/CoreOS GUI/CoreOS GUI-Info.plist b/src/CoreOS GUI/CoreOS GUI-Info.plist
index 0bbbbc7..408a5c0 100644
--- a/src/CoreOS GUI/CoreOS GUI-Info.plist	
+++ b/src/CoreOS GUI/CoreOS GUI-Info.plist	
@@ -19,9 +19,9 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>1.0.2</string>
+	<string>1.0.3</string>
 	<key>CFBundleVersion</key>
-	<string>407</string>
+	<string>411</string>
 	<key>LSApplicationCategoryType</key>
 	<string>public.app-category.utilities</string>
 	<key>LSMinimumSystemVersion</key>
diff --git a/src/CoreOS GUI/main.m b/src/CoreOS GUI/main.m
index f0112cd..a869a94 100644
--- a/src/CoreOS GUI/main.m	
+++ b/src/CoreOS GUI/main.m	
@@ -12,3 +12,4 @@ int main(int argc, const char * argv[])
 {
     return NSApplicationMain(argc, argv);
 }
+
diff --git a/src/bin/coreos-osx-web b/src/bin/coreos-osx-web
new file mode 100755
index 0000000..052bb78
Binary files /dev/null and b/src/bin/coreos-osx-web differ
diff --git a/src/bin/get_mac b/src/bin/get_mac
index 76372db..3d635bb 100755
--- a/src/bin/get_mac
+++ b/src/bin/get_mac
@@ -4,6 +4,7 @@
 res_folder=$(cat ~/coreos-osx/.env/resouces_path)
 
 UUID=$(cat ~/coreos-osx/custom.conf | grep UUID= | head -1 | cut -f2 -d"=")
-my_password=$(cat ~/coreos-osx/.env/password | base64 --decode )
+#
+my_password=$(security find-generic-password -wa coreos-osx-app)
 
 echo -e "$my_password\n" | sudo -S "${res_folder}"/bin/uuid2mac $UUID | tr -d '\n\' > ~/coreos-osx/.env/mac_address
diff --git a/src/bin/webserver b/src/bin/webserver
index 8ed696d..61dc793 100755
--- a/src/bin/webserver
+++ b/src/bin/webserver
@@ -1,12 +1,14 @@
 #!/bin/bash
 # webserver for coreos-xhyve to serve cloud-init file
 
+res_folder=$(cat ~/coreos-osx/.env/resouces_path)
+
 start() {
-    nohup python -m SimpleHTTPServer 18000 >/dev/null 2>&1 &
+    nohup "${res_folder}"/bin/coreos-osx-web >/dev/null 2>&1 &
 }
 
 stop() {
-    kill $(ps aux | grep "[p]ython -m SimpleHTTPServer 18000" | awk {'print $2'}) >/dev/null 2>&1 &
+    kill $(ps aux | grep "[c]oreos-osx-web" | awk {'print $2'}) >/dev/null 2>&1 &
 }
 
 usage() {
diff --git a/src/change_release_channel.command b/src/change_release_channel.command
index 84e9e39..47cc447 100755
--- a/src/change_release_channel.command
+++ b/src/change_release_channel.command
@@ -17,4 +17,5 @@ echo "The 'custom.conf' file was updated to $channel channel !!!"
 echo "You need to run from menu 'Setup->Destroy VM' to get VM destroyed"
 echo "and new VM will be created on the next 'Up'..."
 echo "If there is no $channel channel image, it will be downloaded automaticly..."
+echo " "
 pause 'Press [Enter] key to continue...'
diff --git a/src/destroy.command b/src/destroy.command
index 61faf83..06fc1d2 100755
--- a/src/destroy.command
+++ b/src/destroy.command
@@ -34,10 +34,11 @@ do
             echo "CoreOS VM is running, it will be stopped !!!"
 
             # Stop VM
-            ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o LogLevel=quiet -o ConnectTimeout=5 core@$vm_ip sudo halt
+            ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o LogLevel=quiet -o ConnectTimeout=3 core@$vm_ip sudo halt
 
             # just in case run
-            clean_up_after_vm >/dev/null 2>&1
+            #clean_up_after_vm >/dev/null 2>&1
+            kill_xhyve >/dev/null 2>&1
 
             # wait till VM is stopped
             echo " "
@@ -50,6 +51,9 @@ do
         # delete root image
         rm -f ~/coreos-osx/root.img
 
+        # delete password in keychain
+        security 2>&1 >/dev/null delete-generic-password -a coreos-osx-app 2>&1 >/dev/null
+
         echo "-"
         echo "Done, please start VM with 'Up' and the VM will be recreated ..."
         echo " "
@@ -68,7 +72,3 @@ do
         continue
     fi
 done
-
-
-
-
diff --git a/src/first-init.command b/src/first-init.command
index 0a64bc0..ef5d872 100755
--- a/src/first-init.command
+++ b/src/first-init.command
@@ -33,7 +33,7 @@ echo "$file found, updating custom.conf..."
 echo "SSHKEY='$(cat $HOME/.ssh/id_rsa.pub)'" >> ~/coreos-osx/custom.conf
 #
 
-# save user password to file
+# save user password to Keychain
 save_password
 #
 
@@ -114,9 +114,11 @@ echo "Enjoy CoreOS VM on your Mac !!!"
 echo " "
 echo "Run from menu 'OS Shell' to open a terninal window with rkt, docker, fleetctl and etcdctl pre-set !!!"
 echo " "
+echo 'You can close this window/tab with CMD + W'
+echo " "
+
+sleep 9000
 
-echo 'This window will close itself in 50 sec ...'
 
-sleep 50
 
 
diff --git a/src/functions.sh b/src/functions.sh
index 63dea6c..e60a567 100755
--- a/src/functions.sh
+++ b/src/functions.sh
@@ -97,7 +97,7 @@ cd ~/coreos-osx/cloud-init
 "${res_folder}"/bin/webserver start
 
 # Get password
-my_password=$(cat ~/coreos-osx/.env/password | base64 --decode )
+my_password=$(security find-generic-password -wa coreos-osx-app)
 echo -e "$my_password\n" | sudo -S ls > /dev/null 2>&1
 
 # Start VM
@@ -120,7 +120,7 @@ sed -i "" "s/#ROOT_HDD=/ROOT_HDD=/" ~/coreos-osx/custom.conf
 
 echo " "
 echo "ROOT disk got created and formated... "
-echo " "
+echo "---"
 
 # Stop webserver
 "${res_folder}"/bin/webserver stop
@@ -213,15 +213,16 @@ fi
 
 
 function save_password {
-# save user password to file
+# save user's password to Keychain
 echo "  "
-echo "Your Mac user's password will be saved to '~/coreos-osx/.env/password' file "
-echo "and later one will be used for 'sudo' command to start VM !!!"
-echo "This is not the password for the VM access via ssh or console !!!"
+echo "Your Mac user's password will be saved in to 'Keychain' "
+echo "and later one used for 'sudo' command to start VM !!!"
+echo " "
+echo "This is not the password to access VM via ssh or console !!!"
+echo " "
 echo "Please type your Mac user's password followed by [ENTER]:"
 read -s password
-echo -n ${password} | base64 > ~/coreos-osx/.env/password
-chmod 600 ~/coreos-osx/.env/password
+security add-generic-password -a coreos-osx-app -s coreos-osx-app -w $password -U
 echo " "
 }
 
@@ -233,10 +234,10 @@ sleep 3
 res_folder=$(cat ~/coreos-osx/.env/resouces_path)
 
 # Get password
-my_password=$(cat ~/coreos-osx/.env/password | base64 --decode )
+my_password=$(security find-generic-password -wa coreos-osx-app)
 
 # Stop webserver
-kill $(ps aux | grep "[p]ython -m SimpleHTTPServer 18000" | awk {'print $2'})
+kill $(ps aux | grep "[c]oreos-osx-web" | awk {'print $2'})
 
 # Stop docker registry
 kill $(ps aux | grep "[r]egistry config.yml" | awk {'print $2'})
@@ -244,7 +245,7 @@ kill $(ps aux | grep "[r]egistry config.yml" | awk {'print $2'})
 # kill all coreos-osx/bin/xhyve instances
 # ps aux | grep "[c]oreos-osx/bin/xhyve" | awk '{print $2}' | sudo -S xargs kill | echo -e "$my_password\n"
 echo -e "$my_password\n" | sudo -S pkill -f [c]oreos-osx/bin/xhyve
-
+#
 echo -e "$my_password\n" | sudo -S pkill -f "${res_folder}"/bin/uuid2mac
 
 # kill all other scripts
@@ -252,9 +253,24 @@ pkill -f [C]oreOS GUI.app/Contents/Resources/start_VM.command
 pkill -f [C]oreOS GUI.app/Contents/Resources/bin/get_ip
 pkill -f [C]oreOS GUI.app/Contents/Resources/bin/get_mac
 pkill -f [C]oreOS GUI.app/Contents/Resources/bin/mac2ip
-pkill -f [C]oreOS GUI/Contents/Resources/fetch_latest_iso.command
-pkill -f [C]oreOS GUI/Contents/Resources/update_k8s.command
-pkill -f [C]oreOS GUI/Contents/Resources/update_osx_clients_files.command
-pkill -f [C]oreOS GUI/Contents/Resources/change_release_channel.command
+pkill -f [C]oreOS GUI.app/Contents/Resources/fetch_latest_iso.command
+pkill -f [C]oreOS GUI.app/Contents/Resources/update_k8s.command
+pkill -f [C]oreOS GUI.app/Contents/Resources/update_osx_clients_files.command
+pkill -f [C]oreOS GUI.app/Contents/Resources/change_release_channel.command
+
+}
+
+
+function kill_xhyve {
+sleep 3
+
+# get App's Resources folder
+res_folder=$(cat ~/coreos-osx/.env/resouces_path)
+
+# Get password
+my_password=$(security find-generic-password -wa coreos-osx-app)
+
+# kill all coreos-osx/bin/xhyve instances
+echo -e "$my_password\n" | sudo -S pkill -f [c]oreos-osx/bin/xhyve
 
 }
diff --git a/src/go_webserver/compile.sh b/src/go_webserver/compile.sh
new file mode 100755
index 0000000..5d4c15e
--- /dev/null
+++ b/src/go_webserver/compile.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+
+# compile coreos-osx-web from source
+
+go build coreos-osx-web.go
+mv -f coreos-osx-web ../bin
diff --git a/src/go_webserver/coreos-osx-web.go b/src/go_webserver/coreos-osx-web.go
new file mode 100644
index 0000000..10a0cd6
--- /dev/null
+++ b/src/go_webserver/coreos-osx-web.go
@@ -0,0 +1,17 @@
+package main
+
+import (
+    "fmt"
+    "log"
+    "net/http"
+)
+
+func main() {
+    fmt.Println("Serving files in the current directory on port 18000")
+    http.Handle("/", http.FileServer(http.Dir(".")))
+    err := http.ListenAndServe(":18000", nil)
+    if err != nil {
+        log.Fatal("ListenAndServe: ", err)
+    }
+}
+
diff --git a/src/kill_VM.command b/src/kill_VM.command
new file mode 100755
index 0000000..18de70d
--- /dev/null
+++ b/src/kill_VM.command
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+#  kill_VM.command
+
+DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
+source "${DIR}"/functions.sh
+
+clean_up_after_vm
+
diff --git a/src/reload.command b/src/reload.command
index ec0d84d..260eea7 100755
--- a/src/reload.command
+++ b/src/reload.command
@@ -13,6 +13,9 @@ vm_ip=$(<~/coreos-osx/.env/ip_address)
 
 # Stop VM
 ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=5 core@$vm_ip sudo halt
+# just in case run
+kill_xhyve
+
 # wait till VM is stopped
 echo " "
 echo "Waiting for VM to shutdown..."
diff --git a/src/start_VM.command b/src/start_VM.command
index 3661ff5..efbe26a 100755
--- a/src/start_VM.command
+++ b/src/start_VM.command
@@ -10,8 +10,10 @@ res_folder=$(cat ~/coreos-osx/.env/resouces_path)
 
 # Get UUID
 UUID=$(cat ~/coreos-osx/custom.conf | grep UUID= | head -1 | cut -f2 -d"=")
+
 # Get password
-my_password=$(cat ~/coreos-osx/.env/password | base64 --decode )
+my_password=$(security find-generic-password -wa coreos-osx-app)
+
 # Get mac address and save it
 echo -e "$my_password\n" | sudo -S "${res_folder}"/bin/uuid2mac $UUID > ~/coreos-osx/.env/mac_address
 
@@ -21,6 +23,7 @@ echo -e "$my_password\n" | sudo -S "${res_folder}"/bin/uuid2mac $UUID > ~/coreos
 # Start webserver
 cd ~/coreos-osx/cloud-init
 "${res_folder}"/bin/webserver start
+"${res_folder}"/bin/webserver start
 
 # Start docker registry
 cd ~/coreos-osx/registry
diff --git a/src/up.command b/src/up.command
index eadd0a7..43f4652 100755
--- a/src/up.command
+++ b/src/up.command
@@ -3,6 +3,9 @@
 # up.command
 #
 
+# tidy up after old version
+rm -f ~/coreos-osx/.env/password 2>&1 >/dev/null
+
 #
 DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
 source "${DIR}"/functions.sh
@@ -19,16 +22,13 @@ cp -f "${res_folder}"/registry/config.yml ~/coreos-osx/registry
 cp -f "${res_folder}"/bin/registry ~/coreos-osx/bin
 chmod 755 ~/coreos-osx/bin/registry
 
-# Stop docker registry just in case it was left running
-kill $(ps aux | grep "[r]egistry config.yml" | awk {'print $2'}) >/dev/null 2>&1 &
-
-# Stop webserver just in case it was left running
-"${res_folder}"/bin/webserver stop
-
-# check for password file
-if [ ! -f ~/coreos-osx/.env/password ]
+# check for password in Keychain
+my_password=$(security 2>&1 >/dev/null find-generic-password -wa coreos-osx-app)
+if [ "$my_password" = "security: SecKeychainSearchCopyNext: The specified item could not be found in the keychain." ]
 then
-    echo "File with saved password is not found: "
+    echo " "
+    echo "Saved password in 'Keychain' is not found: "
+    # save user password to Keychain
     save_password
 fi
 
@@ -48,12 +48,14 @@ fi
 rm -f ~/coreos-osx/.env/.console
 echo " "
 echo "Starting VM ..."
+echo " "
 "${res_folder}"/bin/dtach -n ~/coreos-osx/.env/.console -z "${res_folder}"/start_VM.command
 #
 
 # wait till VM is booted up
 echo "You can connect to VM console from menu 'Attach to VM's console' "
 echo "When you done with console just close it's window/tab with CMD+W "
+echo " "
 echo "Waiting for VM to boot up..."
 spin='-\|/'
 i=0