How to encrypt files on Mac
If you need to protect sensitive documents, photos, backups, or business data, learning how to encrypt files on Mac is one of the most effective steps you can take. macOS includes built-in tools for file encryption, and a few advanced options can help you secure individual files, folders, or entire drives.
Encryption turns readable data into coded data that only someone with the right password, key, or account access can unlock.
That makes it a practical defense against lost laptops, unauthorized access, and exposure of personal information.
What file encryption does on macOS
Encryption protects data at rest, meaning the files remain unreadable when stored on your Mac, external drive, or cloud-synced location.
In practice, macOS uses strong encryption standards such as AES with FileVault, APFS encrypted volumes, and password-protected disk images.
This matters because a standard login password does not automatically protect every file if the drive is removed or the system is accessed another way.
Encryption adds a second barrier that makes the file contents inaccessible without the correct credentials.
- Protects confidentiality: Keeps documents, archives, and backups private.
- Limits exposure after theft: Helps secure data if a Mac or external disk is lost.
- Supports compliance: Useful for handling sensitive business or client information.
- Works with layered security: Complements passwords, biometrics, and access control.
Best ways to encrypt files on Mac
There is no single best method for every situation.
The right choice depends on whether you want to protect one file, a folder, an external drive, or your entire startup disk.
1. Use a password-protected disk image in Disk Utility
A disk image is one of the most reliable ways to encrypt a collection of files on macOS.
You create a .dmg or .sparsebundle container, lock it with a password, and store files inside it.
- Open Disk Utility from Applications > Utilities.
- Choose File > New Image > Blank Image.
- Set a name, size, and location.
- Choose Encryption and select 128-bit AES or 256-bit AES.
- Create a strong password and save the image.
Use 256-bit AES if the files are highly sensitive and you are willing to accept slightly slower access.
For most users, this method is excellent for contracts, financial records, project folders, or archive storage.
2. Encrypt an external drive with APFS or Mac OS Extended
If your goal is to protect an external SSD, USB drive, or backup disk, formatting it as an encrypted volume is often simpler than encrypting files one by one.
On modern Macs, APFS encrypted volumes are the preferred option for SSDs and flash storage.
To encrypt an external drive, you can erase and reformat it as APFS (Encrypted) or Mac OS Extended (Journaled, Encrypted) depending on compatibility needs.
This method is ideal for carrying work files between locations or storing Time Machine backups on a portable disk.
Keep in mind that formatting erases existing data, so back up anything important before you begin.
If the drive already contains data, you may need to copy files off, reformat it, and then restore them.
3. Use Finder’s built-in encryption for removable media
Finder can encrypt some removable drives directly.
When you right-click a mounted external volume in Finder, macOS may offer an option to encrypt it.
This is one of the simplest ways to secure portable storage without digging into Disk Utility.
This approach is convenient, but it is best suited to external drives rather than individual files.
It relies on the volume being mounted with the correct password each time you use it.
4. Create encrypted archives with Terminal
For users comfortable with the command line, Terminal can help create encrypted compressed archives.
This is useful when you want to package a folder into a single protected file for sharing or storage.
A common workflow uses zip with password protection, although older ZIP encryption is weaker than modern AES-based methods.
If you need stronger protection, a password-protected disk image is usually better.
Still, password-protected archives can be practical for quick transfers where convenience matters.
Because command-line encryption tools vary in strength and compatibility, verify that the method you choose matches your security requirements before using it for important data.
How to encrypt a single file on Mac
macOS does not always provide a simple right-click “encrypt this file” option for every file type, so the most dependable approach is to place that file into an encrypted container.
That container can be a password-protected disk image, encrypted archive, or encrypted folder volume.
For a single confidential document, the easiest method is usually:
- Create a small encrypted disk image.
- Place the file inside it.
- Eject the image when finished.
This gives you file-level privacy without changing how the original file behaves once opened.
It also keeps the document easy to move between systems that support macOS disk images.
How to encrypt a folder on Mac
Folders are often more efficient to encrypt than individual files because they allow you to bundle related content in one secured container.
That is especially useful for work projects, tax records, scanned IDs, or client deliverables.
The most practical options are:
- Encrypted disk image: Best for regular access and easy mounting.
- Encrypted external volume: Best for storing a large folder set on a drive.
- Encrypted archive: Best for infrequent access or sharing.
If the folder changes frequently, use a sparse disk image so you can add or remove files without recreating the container each time.
If the folder is static, a fixed-size encrypted image may be enough.
Should you use FileVault?
FileVault encrypts the entire startup disk on your Mac, not just selected files.
It is a strong baseline security feature and should be enabled on most personal and work machines.
However, FileVault does not replace file-level encryption when you need to protect a specific folder, archive, or shared file.
Enable FileVault if you want broad protection for everything on the Mac.
Use a disk image or encrypted volume when you want to isolate a subset of files, share an encrypted package, or move sensitive content to portable storage.
How to choose the right encryption method
The best choice depends on your workflow, device type, and data sensitivity.
If you understand the tradeoffs, you can avoid both overcomplicating simple tasks and under-protecting valuable information.
- For one confidential document: Use an encrypted disk image.
- For an entire external drive: Use APFS encrypted formatting.
- For a project folder: Use a sparse encrypted image.
- For your Mac’s internal storage: Enable FileVault.
- For quick sharing: Use a password-protected archive if compatibility is important.
Security tips when encrypting files on Mac
Encryption is only as strong as the password and operational habits behind it.
A weak password, poor backup strategy, or careless sharing can undermine the protection.
- Use a long, unique password or passphrase.
- Store recovery information securely.
- Do not reuse passwords across devices or services.
- Keep macOS updated to maintain security patches.
- Back up encrypted data in a separate secure location.
- Verify that sensitive files are removed from unencrypted copies after migration.
If you are working with business records, legal documents, or regulated data, consider layering encryption with permission controls, restricted sharing, and secure cloud storage settings.
That approach reduces the chance of accidental exposure as files move between apps and devices.
Common mistakes to avoid
Many users assume encryption automatically solves every privacy problem, but a few common mistakes can reduce its value.
Avoid these issues to keep your files genuinely protected.
- Using a short or guessable password.
- Leaving unencrypted copies in Downloads, Desktop, or cloud sync folders.
- Forgetting to eject encrypted volumes after use.
- Formatting an external drive without backing up data first.
- Relying on outdated archive encryption for highly sensitive material.
When in doubt, favor methods built into macOS that use modern encryption standards and fit naturally into your workflow.
When to use a third-party encryption app
Apple’s built-in tools are enough for most users, but specialized third-party apps can help if you need advanced sharing, enterprise controls, or cross-platform compatibility.
Some apps support secure vaults, automatic syncing, or collaboration features designed for teams.
If you choose a third-party tool, review its encryption standard, key management model, and audit reputation.
Strong security depends not just on the app’s interface, but on how it stores keys, handles backups, and protects against unauthorized access.