Best App to Password Protect Folders on Mac in 2026: 6 Options Compared
· 11 min read
Finder has no password option for folders, so every method puts the folder inside something encrypted. The free, built-in way is an encrypted disk image from Disk Utility, and for a folder you rarely open it’s hard to beat. For a folder that lives in iCloud Drive, Dropbox or similar, Cryptomator is free on the Mac and encrypts file names as well as contents. To lock a folder where it sits from Finder’s right-click menu, and have it lock itself again when you walk away, Hushbox does that for $9 once. VeraCrypt is the free choice for encrypted volumes and whole drives across Mac, Windows and Linux, and Encrypto and Keka suit files you’re about to send.
The sections below cover what each is good at, where it falls short, and what it costs. Prices are as listed on each developer’s own site or App Store page at the time of writing (October 2026). Hushbox is made by Everyday Mac Tools, the people who write these guides; we’ve given it the same treatment as the others, limits included.
What to look for
What you do every day. A method that’s strong but tedious gets abandoned. Count the steps to open a file and to lock it again, and ask whether it locks again if you forget.
Where the files end up. Some tools move your files into a container or vault somewhere else; others leave them in place. That decides whether your folders, aliases and habits still work.
What’s left unencrypted around it. Copying a folder into an encrypted container leaves the original behind until you delete it. Expanding an archive leaves ordinary copies on disk. Time Machine keeps whatever it backed up before you encrypted anything. Private files and Time Machine covers that part.
Whether you’re locked in. If the app disappears, can you still open your files?
Names. Most methods hide what’s inside but not the name of the container itself. Choose a name that says nothing.
Passwords. None of these has a reset. Put the password in a password manager the moment you set it.
None of them replaces FileVault, which protects the whole disk while the Mac is off. A locked folder protects its contents while you’re logged in. FileVault or a locked folder explains why you want both.
1. Disk Utility: an encrypted disk image, built in
Open Disk Utility, choose File, New Image, Image from Folder, pick the folder, and choose an option from the Encryption pop-up menu (128-bit or 256-bit AES). You get a disk image that opens only with the password. Double-click it, enter the password, and it mounts like a drive; eject it and it’s locked again. Apple’s Disk Utility guide has the steps, and encrypting a folder with Disk Utility goes through formats and sizes.
Good at: costing nothing, needing no install, and opening on any Mac without extra software. For an archive you open twice a year, such as old tax returns, a read-only encrypted image is the simplest strong answer.
Falls short: the housekeeping is yours. The original folder stays where it was until you delete it, and while the image is mounted, anyone at your Mac can browse it. An image made from a folder is sized to what the folder held, so for a folder you’ll keep adding to, make a blank image in the sparse bundle format instead. If you tick the option to remember the password in your keychain, it opens for anyone logged in as you.
Price: free, built into macOS.
2. Cryptomator: free, made for cloud folders
Cryptomator creates a vault, a password-protected folder inside your cloud storage. Unlock it and you get a virtual drive; anything you save there is encrypted before your cloud service syncs it. It encrypts both file contents and file names with AES and a 256-bit key, and it’s open source.
Good at: keeping files private from your cloud provider while they still sync: it sees neither the contents nor the file names. It’s free to use on Windows, macOS, Linux, iOS and Android, so a vault you make on the Mac can be opened elsewhere.
Falls short: you work through the vault’s virtual drive rather than the folder where the files were, so it’s a new place to keep things rather than a lock on an existing folder. The free mobile apps are read-only; full access costs extra per platform. On the Mac it needs macOS 11 or later.
Price: free on desktop. Full access on iOS or Android is a one-time purchase per platform, €29.99 at list price (pricing). Dark Mode on desktop comes with an optional supporter certificate.
3. Hushbox: lock a folder where it sits
Hushbox is made by Everyday Mac Tools. Right-click a file or folder in Finder and choose Lock with Hushbox. It becomes a locked item in the same folder, with a lock icon; Taxes 2025.pdf shows as Taxes 2025. To open it, double-click and use Touch ID or your Hushbox password. A folder opens in its own Finder window, a file opens in its app.
Good at: asking almost nothing of you day to day. There’s no vault to visit and nothing to mount and eject: your files stay where you keep them. It locks again by itself when the screen locks, when the Mac sleeps, or after 5, 15, 30 or 60 minutes idle, and if an app has unsaved work it asks first rather than force-closing it. While an item is locked, what’s inside stays out of Spotlight, Finder Recents and Quick Look previews; unlocked, it opens in a private encrypted space Spotlight never indexes. The original is deleted only after the locked copy has been checked byte for byte. Under the lock is an AES-256 encrypted disk image, the same kind Disk Utility makes, so if Hushbox ever goes away you rename the item to end in .sparsebundle, double-click it, enter the password, and macOS opens it. No account, no cloud.
Falls short: the name of a locked item still shows in Finder: it hides contents, not names, and other apps’ Open Recent menus may remember file names. Copies made before you locked something (Time Machine backups, iCloud’s Recently Deleted) aren’t changed. Each locked item uses about 33 MB of extra space, so lock a folder of small files rather than each file. It won’t lock items marked Locked in Finder, system folders, apps or whole drives. It’s Mac only, it doesn’t share or send files, and there’s no password recovery.
Pick something else if: you need to open the files on Windows or a phone (Cryptomator or VeraCrypt), you’re sending files to someone (Encrypto or Keka), or the folder is an archive you rarely open (Disk Utility, free).
Price: $9 once for 2 Macs, free updates. Free for 24 hours with every feature, and unlocking stays free even if you never buy, so your files are never held hostage. 7-day refund. macOS 13 or later, Apple silicon and Intel.
4. VeraCrypt: free encrypted volumes and drives
VeraCrypt is free, open source disk encryption for Windows, Mac and Linux. It “creates a virtual encrypted disk within a file and mounts it as a real disk,” and it can also encrypt an entire partition or a storage device such as a USB flash drive. It offers hidden volumes for plausible deniability, in case someone forces you to reveal a password.
Good at: containers and whole external drives that have to open on Windows and Linux as well as the Mac, and hidden volumes, which nothing else here offers.
Falls short: it’s the most setup of anything here. The Mac download comes in two builds, one for macFUSE and one for FUSE-T, which are separate projects; the site recommends the FUSE-T build on Apple silicon. Day to day you mount and dismount volumes from VeraCrypt itself rather than locking folders in Finder. It needs macOS 12 Monterey or later.
Price: free.
5. Encrypto: free, for files on their way somewhere
Encrypto, from MacPaw, takes any file or folder and adds AES-256 encryption. You can embed a password hint that only the recipient would understand, then send the result by email, Messages, AirDrop or Dropbox, or save it to your own disk. It runs on Mac and Windows.
Good at: sending something sensitive with the least fuss, for free. The password hint saves sending the password itself.
Falls short: it’s built around sending rather than a folder you open every week. MacPaw’s page lists the latest Mac version as 1.4.3, from August 2024.
Price: free. macOS 10.13 or later.
6. Keka: a password-protected archive
Keka is an archiver that creates 14 formats, including 7z and ZIP, and can set a password as it compresses. For 7z files it uses AES-256. For ZIP it uses the legacy Zip 2.0 encryption, which Keka itself labels as legacy.
Good at: packing a folder into one encrypted file to send or store, and it’s free from its site.
Falls short: an archive is not a lock you live with. To use the files you expand them, which leaves ordinary copies on your disk until you delete them. Choose 7z rather than ZIP when the contents matter; password protecting a zip file explains the weakness.
Price: free to download from its site, or $6.49 on the Mac App Store, where the purchase supports development. Mac OS X 10.10 or later.
Comparison at a glance
| Option | Price | Best for | How it works | Platforms |
|---|---|---|---|---|
| Disk Utility | Free, built in | Archives you rarely open | Encrypted disk image you mount and eject | Mac |
| Cryptomator | Free on desktop; mobile €29.99 per platform | Folders in a cloud drive | Vault unlocked as a virtual drive | Mac, Windows, Linux, iOS, Android |
| Hushbox | $9 once, 2 Macs | Folders you open most days | Locks in place from Finder; relocks itself | Mac (macOS 13+) |
| VeraCrypt | Free | Volumes and whole drives across systems | Encrypted container mounted as a disk | Mac, Windows, Linux |
| Encrypto | Free | Sending a file or folder | Encrypted file with a password hint | Mac, Windows |
| Keka | Free, or $6.49 on the App Store | Sending an archive | Password-protected 7z (AES-256) | Mac |
Which one to pick
A folder you open rarely. Disk Utility. Free, strong, and nothing to maintain once it’s made. Three ways to password protect a folder compares it with the other routes in more depth.
A folder that lives in iCloud Drive or Dropbox. Cryptomator, especially if you also need the files on a phone or another computer.
A folder you open most days, on your Mac. Hushbox, if locking from Finder and relocking on sleep or idle are worth $9 to you. If not, a sparse bundle from Disk Utility works, as long as you remember to eject it.
A container or external drive that has to open on Windows too. VeraCrypt.
Something you’re about to send. Encrypto for a file to a person, or a 7z from Keka for a bundle of files. Send the password by a different route.
Questions
Can I password protect a folder on a Mac without an app? Yes. Disk Utility makes an encrypted disk image from a folder: File, New Image, Image from Folder, then pick an encryption option and a password. Delete the unencrypted original yourself afterwards, and eject the image when you’re done with it.
Which of these is the most secure? The strong options all use AES encryption, and at that point the password is the weak link, along with any unencrypted copies left around the encrypted one. The exception is a ZIP archive’s legacy encryption; use 7z instead. Whichever you choose, give the container a name that says nothing about what’s inside.
Does a locked folder replace FileVault? No. FileVault encrypts the whole disk while the Mac is off. A locked folder keeps its contents private while you’re logged in and someone else is at your Mac, or while a file sits in a cloud folder. Use both.
What happens if I forget the password? With every method here, the files stay locked. Disk Utility images, Cryptomator vaults, VeraCrypt volumes and Hushbox items have no reset, and Hushbox has no back door. Store the password in a password manager as soon as you set it.