How to Encrypt an External Drive on Mac (USB Drive, SSD or Card)

Steps use macOS 14 and later names. Menu wording can differ slightly between versions.

This page covers one place your data lives: a drive you plug in. For the full map of disks, backups and copies, read Mac disk encryption. Your internal disk is a different job, covered in what is FileVault on a Mac.

Pick a method

Method 1: Finder

1. Back up the drive

   Copy anything you cannot replace to another disk. Apple says this method changes the disk format before it encrypts.

2. Open Finder

   Connect the drive. Click the Finder icon in the Dock to open a Finder window.

3. Control-click the drive

   In the sidebar, Control-click the drive. In the shortcut menu, choose the Encrypt command that carries the drive's name.

4. Set the password

   Create a password for the disk. If the box asks for a password hint, add one. Click Encrypt Disk.

5. Wait

   Apple says the time depends on how much data is on the drive, and that you can keep using your Mac while it runs.

6. Test it

   Eject the drive, unplug it and plug it in again. Apple says an encrypted external device asks for its password when you connect it.

To remove the encryption later, Control-click the drive in the sidebar and choose Decrypt.

Method 2: Disk Utility (erases the drive)

1. Copy off any files you want to keep. Apple says you must erase the device first.
2. Open Disk Utility and choose View > Show All Devices.
3. Select the drive in the sidebar and click Erase in the toolbar.
4. Enter a name. Set Scheme to GUID Partition Map.
5. In the Format menu, choose an encrypted format, then enter and verify a password and click Choose.
6. Click Erase, then click Done.

Apple lists two encrypted formats. APFS (Encrypted) uses the APFS format and encrypts the volume. APFS (Case-sensitive, Encrypted) does the same and is also case-sensitive to file and folder names. To change the password later, select the volume in the sidebar and choose File > Change Password.

Check compatibility before you start

• Older Macs. Apple says Macs on earlier macOS versions without APFS support cannot read the drive. Apple says macOS 10.13 or later supports APFS for data volumes.
• Windows. Apple lists MS-DOS (FAT) and ExFAT as the formats for Windows volumes. The encrypted formats it lists are APFS ones, and Apple does not describe Windows support for them. Test before you rely on it.
• A drive for Mac and Windows. One option is a Cryptomator vault in a folder on the drive. Cryptomator's docs say its desktop app installs on Windows, macOS and Linux. Test the vault on the other computer first.
• Old encrypted Mac OS Extended drives. Apple says macOS 28 and later will support Mac OS Extended only for volumes that are not encrypted. Convert to APFS, decrypt or reformat before you upgrade.

The formats Disk Utility lists for a new volume show the trade-off:

The password is the only way in

Apple says to record the password and keep it in a safe place, because without it you cannot access the data on the encrypted disk. Use a password manager or paper, not a note on the same drive. Apple's pages describe no way to reset a forgotten drive password.

What drive encryption does not do

• After you enter the password, the drive is open. Anyone at the Mac can read it until you eject it.
• FileVault does not cover the drive. It protects the startup disk. See what is FileVault on a Mac.
• Copies you made before encrypting stay where they are. Check old folders, downloads and backups.
• Apple's security guide says removable storage does not use the Secure Enclave. It is encrypted the same way as on an Intel-based Mac without a T2 chip.
• Time Machine disks are a special case. See how to encrypt a Time Machine backup.