Password Protect a Folder on Mac Without Disk Utility

Steps use macOS 14 and later names. Menu wording can differ slightly between versions.

Which route fits

Finder's Encrypt command applies to drives in the sidebar, not to a single folder. It is covered in how to encrypt an external drive on Mac.

Route 1: Terminal

Terminal can build the same kind of encrypted disk image that Disk Utility makes. The options come from the manual page, so read man hdiutil first. The manual lists AES-128 and AES-256 as choices and states the default, so name the one you want. The command prompts you for a password.

1. Open Terminal

   Press ⌘Space, type Terminal and press Return.

2. Create an empty encrypted image

   Run the command below. -type SPARSEBUNDLE makes an image that grows with its contents, and -fs APFS sets the file system. Change 2g to the size you want the image to reach. Enter a password when prompted.

   hdiutil create -encryption AES-256 -size 2g -type SPARSEBUNDLE -fs APFS -volname Private ~/Documents/Private.sparsebundle

3. Open it

   Run hdiutil attach with the path to the new .sparsebundle file. Enter the password. A drive named Private appears in Finder.

   hdiutil attach ~/Documents/Private.sparsebundle

4. Add your files

   Drag your folders into the Private drive in Finder.

5. Eject to lock

   Eject the drive in Finder, or run hdiutil detach /Volumes/Private.

   hdiutil detach /Volumes/Private

6. Test it

   Attach it again and confirm that it asks for the password.

Limits are the same as for any encrypted image. See encrypted disk images on Mac.

Route 2: Cryptomator

Cryptomator is open source software. Its site says it encrypts both files and file names. Download it only from cryptomator.org. Its docs say to open the macOS .dmg, accept the license and drag Cryptomator into Applications. If macOS blocks the install, change your Gatekeeper settings.

1. In Cryptomator, choose Create New Vault… and enter a name.
2. Pick the folder where the encrypted data will be stored.
3. Set a password. The docs ask for at least 8 characters and recommend a longer passphrase. They warn that no one else can reset it.
4. Optionally create a recovery key. The docs say it gives full access to the vault, so store it as safely as the password, ideally on paper.
5. Unlock the vault. A virtual drive appears. Put your files there, then click Lock. The docs say that after you lock, the virtual drive disappears or renders empty.

• Test the password right away. Cryptomator's own advice is to lock and unlock the vault just after you set the password. Keyboard layouts and dead keys can change what you type.
• Be careful with "Remember password". The docs say to store the password in the system keychain only on trusted devices, because it is a risk if the device is compromised.
• Do not treat it as a backup. The docs say Cryptomator is not a backup solution.

On a Mac, the docs say Cryptomator uses a WebDAV volume by default and recommends macFUSE on Intel Macs or FUSE-T on Apple silicon Macs for a smoother experience. More: Cryptomator compared.

Route 3: notes and documents

• Notes. Open a note, click the More button next to the search field and choose Lock Note. Apple says Quick Notes, shared notes, notes with tags and notes with video, audio, PDF or document attachments cannot be locked. If you forget a custom password and cannot use Touch ID, Apple cannot help you regain access.
• Pages, Numbers, Keynote. Open the document and choose File > Set Password. Apple says adding a password encrypts the file, a file can have only one password, and there is no way to recover the password if you forget it.
• A PDF. Use Preview. Steps are in password protect a PDF on Mac.

What none of these do

• They do not hide a folder. See hide files on Mac for why hiding is not locking.
• They do not remove plain copies. Delete the originals and check your backups.
• A password-protected zip file is not on this list. The Apple pages used here do not document one, so this guide does not rate it.
• FileVault is a different layer. See FileVault vs a folder vault.