How to Encrypt a Time Machine Backup on Mac

Steps use macOS 14 and later names. Menu wording can differ slightly between versions.

Why the backup disk needs its own encryption

Apple recommends encrypting your backup disk to keep your backups secure. It also says that if you back up to an external disk without disk encryption, anyone who gets the disk can read its backed-up data. FileVault protects the startup disk, not a separate backup disk. See what is FileVault on a Mac.

Before you choose a disk

• Windows disks do not work as they are. Apple says Time Machine cannot back up to a disk formatted for Windows. You can reformat it to a Mac format, which erases its data.
• Keep the disk for backups. Apple says Time Machine does not back up files that you store on the backup disk, and they reduce the space available for backups.
• Start in the evening. Apple suggests setting up Time Machine in the evening, so the first backup can run overnight.

Turn on encryption when you add a disk

1. Open Time Machine settings

   Choose the Apple menu > System Settings, click General in the sidebar, then click Time Machine.

2. Add the disk

   Click Add Backup Disk or the Add button. Choose the disk or backup location, then click Set Up Disk.

3. Choose encryption

   If a window of backup options appears, choose whether to encrypt the backups. You can also set a maximum space for backups there.

4. Create the backup password

   Type a password for the backup disk. Choose a hint that helps you remember it. Apple says you may need to enter the password when you connect the disk, disconnect it or restart your Mac.

5. Erase only if you can

   If the Mac asks to erase the disk, agree only when nothing on it is needed. Apple warns that erasing permanently removes all files on the disk.

6. Finish and test

   Click Done. Later, disconnect and reconnect the disk and confirm that it asks for the backup password.

Switch an existing backup disk to encrypted

1. Click the Finder icon in the Dock.
2. Control-click your backup disk, then click Encrypt.
3. Type a password in the Encryption password and Verify password fields, then type a password hint.
4. Click Encrypt Disk.

The backup password

• You need it to restore. Apple says you must provide the backup password to restore files from encrypted backups.
• Keep it private. Apple says no one but you should have access to it.
• It is its own password. Apple's pages describe it as a password you create when you turn on encryption for the disk.
• No recovery route is documented. Apple's pages on the backup password do not describe one. Treat a forgotten password as a lost backup. Keep it in a password manager or on paper.
• The keychain trade-off. Apple says you can store the backup password in your keychain so the disk unlocks automatically when it connects to the same computer. That is convenient, and it also means the disk opens without a prompt on that Mac.

Limits and things to check

• Old unencrypted copies. Encrypting from now on does not clean older backup disks. Check every disk you used. A folder you encrypted later may still sit in an older backup as plain files. See how to password protect a folder on Mac.
• Network disks. Apple says not to back up sensitive data to a network disk if you do not trust the administrators who control it. Use a disk under your control.
• AirPort base stations. Apple says you cannot use an encrypted external device with an AirPort base station for Time Machine backups.
• Older formats. Apple says macOS 28 and later will support Mac OS Extended only for volumes that are not encrypted, and that the Convert and Decrypt options do not apply to encrypted Time Machine disks. Read Apple's notice before you upgrade.

Other drives follow the same rule: how to encrypt an external drive on Mac. The wider picture is in Mac disk encryption.