Keychain won't reveal forgotten password; how to fix?
I used

security dump-keychain -d login.keychain


which showed me passwords in plaintext.  But where I expected a password for Skype was what looked like a UUID.

I deleted Skype from the keychain, got a reset password link from Skype, launched it and logged in with the new password.

dumped the keychain again.  There are TWO Skype entries.  The first has over 800 characters where the password should be, with a UUID in the middle.  Lots of octal escapes, none of which are the ASCII values of the new password.

The second has a hexadecimal string of about eighty digits, then in quotes, about 60 characters, most of which are octal escapes.

Speculation: the hexadecimal is a decryption or encryption key, the quoted string when converted to bytes and decrypted is the password, and that is a format keychain can't handle and/or Skype is encrypting to prevent people from looking up a password in keychain.