How to Encrypt a Folder on Mac: 4 Methods Compared

Steps use macOS 14 and later names. Menu wording can differ slightly between versions.

Encrypting, locking and hiding are different things

Four ways to encrypt a folder

Detail pages: Disk Utility, Cryptomator, VeraCrypt. For a whole external drive, Apple documents a Finder option: Control-click the drive and choose Encrypt. See encrypt an external drive.

Method 1: encrypted disk image (built in)

1. Open Disk Utility

   Press ⌘Space, type Disk Utility and press Return.

2. Choose the folder

   Choose File > New Image > Image from Folder… and select the folder.

3. Encrypt

   In the Encryption menu choose 256-bit AES encryption, enter a password twice and save.

4. Check it

   Open the new .dmg and enter the password. Then delete the plain folder. Read the Time Machine warning in the full guide.

Apple's platform security guide says disk images use 128-bit or 256-bit AES. Choose 256-bit if your menu lists both. Apple lists mostly read-only formats for Image from Folder, so treat the result as a snapshot. If you keep adding files, make a blank image with a read/write format instead. Apple names the sparse bundle, which grows with its data. More: encrypted disk images on Mac.

Test that the image really is locked

1. Eject the image in Finder, then double-click the .dmg. macOS must ask for the password.
2. Type a wrong password once. The image must stay closed.
3. Open it with the right password and open one file from each sub-folder.
4. Search Finder for a file name you remember. A result outside the image means a plain copy still exists.
5. Only then move the plain folder to the Trash and empty the Trash.

Method 2: Cryptomator

Cryptomator is open source software. You create a vault inside any folder, choose a password and unlock it to get a virtual drive. Files you put there are encrypted, names included. Download it only from its own site, cryptomator.org, and check the checksum if one is listed. The free SHA-256 checker does that in your browser. Its site says it uses AES with a 256-bit key. For iCloud Drive or another cloud, read how to encrypt files before cloud sync.

Method 3: VeraCrypt

VeraCrypt describes itself as free, open source disk encryption for Windows, macOS and Linux. Its site says you can create a virtual encrypted disk inside a file. Its release notes mention macFUSE compatibility work on Apple silicon, so read the install notes on veracrypt.io first.

What about FileVault?

FileVault encrypts your whole startup disk. Apple says Macs with Apple silicon or a T2 chip encrypt data automatically, and turning FileVault on means your login password is needed to unlock it. It protects a lost or stolen Mac. It does not hide or lock one folder from someone who is logged in. To turn it on: System Settings > Privacy & Security > FileVault. More on FileVault vs a folder vault. Apple's platform security guide adds that with FileVault off the key is protected only by the Mac's hardware. With FileVault on, it also depends on your password. Read what FileVault is, how to turn it on or off and how to keep the recovery key. For the wider picture, see disk encryption on Mac.

What each method leaves behind

• Disk Utility image: a .dmg or sparse bundle file with a name and a size. Anyone who sees it knows you encrypted something, and roughly how much.
• Cryptomator: a vault folder. Cryptomator says file names are encrypted along with the contents.
• VeraCrypt: a container file. Hidden volumes exist, and VeraCrypt documents them on its site. Read that before you rely on one.
• The plain original: it stays on disk until you delete it, and the Trash keeps it until you empty the Trash.
• Backups: Apple says Time Machine makes hourly local snapshots on APFS disks, kept for up to 24 hours or until the space is needed. Anyone who gets an unencrypted backup disk can read it. See how to encrypt a Time Machine backup.
• Saved passwords: Apple says a backup disk password stored in your keychain unlocks that disk on its own on the same Mac. If an image opens with no prompt, a saved password is the likely reason.

Who this protects you from, and who it does not

An encrypted image or vault protects a copy of the files. It helps when a drive is lost, when a cloud service holds the file, or when someone uses your account while the image is closed. It does not help while the image is open. An open image reads like any other folder, and malware on your Mac can read what you have unlocked. See someone who knows your password.

Mistakes that lose data

• Deleting the plain folder before you open the image and check the files.
• Editing a read-only image and expecting the changes to save.
• Downloading Cryptomator or VeraCrypt from a search ad. Use the official site. See how to check that a download is safe.
• Leaving the image open when you close the lid. Eject it first.

Where Hidden Folder fits