Encrypted Disk Image on Mac: Formats, Passwords and Everyday Use

Steps use macOS 14 and later names. Menu wording can differ slightly between versions.

The basic steps for wrapping a folder are in how to password protect a folder on Mac and how to encrypt a folder on Mac. This guide covers the choices those pages skip.

Pick the image format

Create an encrypted image

1. Open Disk Utility

   Press ⌘Space, type Disk Utility and press Return.

2. Choose the kind of image

   Choose File > New Image > Blank Image for a vault you will fill over time. Choose Image from Folder to wrap a folder that already exists.

3. Name it and place it

   Enter a file name, optional tags and a save location. For a blank image, also enter the Name that appears on the desktop and in the Finder sidebar once the image is mounted, and a Size.

4. Choose the formats

   For a Mac with an SSD running macOS 10.13 or later, Apple says to choose APFS or APFS (Case-sensitive) as the Format. Then choose an Image Format from the table above.

5. Choose the encryption

   Pick an option in the Encryption pop-up menu and enter the password twice. Apple warns: "If you forget this password, you won't be able to open the disk image and view any of the files."

6. Save, fill and eject

   Click Save, then Done. Open the mounted image in Finder, copy your files in, then eject it.

7. Test it

   Double-click the image file. Enter the password. Check that your files are there. Eject it again.

Apple's page does not list the individual encryption choices. The Terminal manual for hdiutil (run man hdiutil) lists AES-128 and AES-256 and says what the default is, so choose the option on purpose and write down which one you picked.

Convert, resize and change the password

Convert an image to make it read-only, switch formats or change its encryption. Open Disk Utility, choose Images > Convert, select the image and click Choose. Pick an Image Format. To change the encryption, use the Encryption pop-up menu. Enter a new name in Save As and click Save. Apple's example: if you made a read/write image but want to stop changes, convert it to a read-only format. Delete the old file only after you have tested the new one.

To resize, first eject the image. Apple says to choose Images > Resize, pick the image file, enter the new size and click Resize. Apple adds that not all image formats support writing and resizing.

The Apple Disk Utility pages used for this guide do not describe a menu item for changing an image's password. The hdiutil manual lists a chpass command for it, which prompts for the passwords:

hdiutil chpass ~/Documents/Vault.sparsebundle

Open it, eject it, and the keychain question

• Opening. Double-click the image and enter the password. It appears as a drive.
• Ejecting is the lock. While the image is mounted, anyone at your Mac can read it. Eject it when you finish, and lock the screen when you leave.
• Remembering the password. If the password box offers to remember it in your keychain, leave that off when you want the image to ask each time.

Limits

• Image from Device has limits. Apple says you cannot create images of individual APFS volumes, or of APFS containers on Macs with Apple silicon or a T2 chip. Use Blank Image or Image from Folder.
• No recovery. A forgotten password means the data is gone.
• The file is visible. A file called Private.dmg tells anyone that something is stored there.
• Old backups. A plain copy made before you encrypted may sit in an old backup. See how to encrypt a Time Machine backup.
• Syncing. Putting an image in a cloud folder is a choice with trade-offs. See how to encrypt files before cloud sync.
• No Disk Utility? See password protect a folder on Mac without Disk Utility.