Someone Knows Your Mac Password. Can You Still Keep Files Private?

The situation

A partner, a parent or a friend knows how to sign in to your Mac. You do not mind them using it, but some files are yours alone.

This page is about keeping your own files private on a Mac you share by choice. Your login password opens everything in your account, so the answer is a second secret that the other person does not have.

What actually protects you

1. Change your login password

   In System Settings > Users & Groups, click the Info button next to your name and choose Change. Enter the old password, the new one twice and a hint. Apple says your login password is not your Apple Account password. Use one nobody can guess.

2. Write a hint that gives nothing away

   Apple says the hint appears after three wrong passwords, or when someone clicks the question mark in the login window. Check what yours says.

3. Use a separate secret for sensitive files

   An encrypted disk image has its own password. See how to password protect a folder and encrypted disk images on Mac. Apple warns that if you forget that password you cannot open the image.

4. Do not let the login password open everything

   Apple says you can lock notes with your login password or with a custom password. Choose the custom one. Apple adds that if you forget it and cannot use Touch ID, you cannot view the locked notes.

5. Do not reuse or save passwords

   The vault or image password should differ from your login. Apple says a backup disk password stored in your keychain unlocks that disk on its own on the same Mac. A saved image password may work the same way for anyone signed in as you, so do not save it.

6. Lock the screen when you leave

   Press ⌃⌘Q, the shortcut Apple lists for locking your screen.

What the built-in methods do not cover

• Anything not separately encrypted. Someone with your login can read Documents, Desktop, Mail and Photos like you do.
• Hiding. A hidden file stays readable to anyone who knows where to look. It is not a lock.
• An open image or note. A mounted image reads like any folder. Eject it when you leave.
• Touch ID. It speeds up your login. It does not help if the person already knows the password, and Apple says your password is required after a restart.
• Backups. Apple says anyone who gets an unencrypted Time Machine disk can read it.

How to test it

1. Eject the disk image, then open it again. It must ask for the password each time. If it does not, a saved password exists.
2. Lock a note, close Notes and reopen it. The note must stay hidden until you authenticate.
3. Look in Documents, Desktop and Downloads for plain copies of the files you protected.
4. At the login window, click the question mark. The hint must not reveal the password.

A five-item checklist

• The login password is not the vault or image password.
• Sensitive files are not stored in Documents or Desktop.
• Locked notes use a custom password.
• You lock the vault when you step away.
• You keep your recovery phrase on paper.

Where a vault fits

Hidden Folder does not use your Mac login password. You open it with a pattern that only you draw. It has no Touch ID option by design, and a pattern needs at least 6 dots and one turn. FileVault and Touch ID are different layers. Keep the 9-word recovery sentence on paper, away from the Mac and away from the person who knows your password. See what to do if you forget a vault password.