Encrypt a folder on a Mac with Disk Utility, step by step
· 7 min read
To encrypt a folder on a Mac, open Disk Utility, choose File, New Image, Image from Folder, pick the folder, set Encryption to 256-bit AES and Image Format to read/write, then save. You get a password-protected disk image holding a copy of the folder. The original folder is still sitting where it was, unencrypted, until you deal with it yourself.
That last point is where most people go wrong, so it gets its own section below.
How to encrypt a folder on a Mac with Disk Utility
Disk Utility is in Applications, Utilities, or type its name into Spotlight.
- Choose File, New Image, Image from Folder.
- Select the folder you want to protect and click Choose.
- In the save window, name the image and pick where it goes. The name stays visible to anyone who opens that folder, so “Taxes 2025” says more than “Archive” does.
- Set Encryption to 256-bit AES encryption. A password sheet appears straight away: type the password twice and click Choose. The key button beside the field opens Password Assistant if you want help making one.
- Set Image Format to read/write if you will add or change files later. Choose compressed only for an archive you will never edit again.
- Click Save, wait for the progress bar, then click Done.
macOS’s own warning about encrypted images is literal: if you forget this password you will not be able to access the files, and forgotten passwords cannot be retrieved. Save the password in a password manager before you do anything else. If it is already too late for that, forgot the password to an encrypted disk image covers what can still be tried.
The same job in Terminal is one line. hdiutil prompts for the password twice and does not echo it:
hdiutil create -srcfolder ~/Documents/Taxes -encryption AES-256 -format UDRW ~/Documents/Taxes.dmg
UDRW is the read/write format. Leave out -format UDRW and you get a compressed, read-only image instead, which is hdiutil’s default when it copies from a folder.
128-bit or 256-bit AES
Both options are AES, and nobody opens either by trying keys. The realistic attack is guessing the password, so its length matters far more than the key size.
On macOS Sequoia, Disk Utility labels 256-bit as the recommended choice. Older versions did the reverse: they recommended 128-bit and described 256-bit as “more secure, but slower.” On a recent Mac you are unlikely to notice the speed difference with documents. Pick 256-bit and put your effort into the password: four or five unrelated words beat a short string of symbols, because an image can be copied and attacked offline at leisure.
Which image format to pick
Image from Folder offers five formats. Three matter here.
- read/write lets you add, edit and delete files later. The catch: the image is sized to the folder’s contents plus a little padding, so there is not much free room inside.
- compressed is smaller and read-only. Good for a finished archive, such as last year’s paperwork.
- read-only is uncompressed, read-only and quick to open.
DVD/CD master and hybrid image are for discs; ignore them.
For a private folder you will keep adding to, start from File, New Image, Blank Image instead. Give it a name, a Size comfortably larger than you need, Format APFS, Encryption 256-bit AES, and Image Format sparse bundle disk image. When it mounts, drag your files in.
Sparse bundle or sparse image? Both grow as you fill them, up to the size you set, so a 20 GB sparse bundle holding 2 GB of files uses roughly 2 GB of disk. A sparse image is one large file. A sparse bundle is a package of 8 MB pieces that Finder shows as a single item. The bundle is kinder to backups: change one document and Time Machine copies the few pieces that changed, not the whole image. Neither shrinks by itself when you delete files. After ejecting, hdiutil compact ~/Documents/Private.sparsebundle removes the unused pieces.
Picked the wrong format? Disk Utility’s Images, Convert writes a new copy in another format, with its own Encryption and Image Format choices. Images, Resize changes the maximum size.
Opening it, using it and locking it again
Double-click the image. macOS asks you to enter the password to access it, then mounts it as a disk in the Finder sidebar under Locations. Open, edit and save files as normal; everything you save goes straight into the encrypted image.
The password prompt has a Remember password in my keychain checkbox. Think before you tick it. Anyone who gets into your user account can then open the image with a double-click and no password, which removes most of the point on a Mac you share or leave unlocked.
To lock it again, eject it: click the eject button beside it in the sidebar, or select it and press Command-E. Logging out or restarting ejects it too. Sleep does not. An image left mounted is only as protected as your login screen, so make sure the Mac asks for a password as soon as it wakes.
While it is mounted, the contents are an ordinary disk to every app on the Mac. Encryption protects the image while it is closed, not while it is open.
The original folder is still there
Image from Folder copies. It does not move, delete or encrypt the folder you picked. The moment you click Save, your private files exist twice: once encrypted, once in plain sight.
Finish the job:
- Eject the image, open it again with the password, and open a few files to confirm they are intact. Test the password before you depend on it.
- Move the original folder to the Trash and empty the Trash.
- Account for the other copies. Time Machine keeps the original folder for as far back as its history goes, and local snapshots on the internal drive can hold it for a while longer; Time Machine local snapshots explains how those work. If the folder lived in iCloud Drive, including a synced Desktop or Documents folder, it waits in iCloud Drive’s Recently Deleted for 30 days unless you remove it there.
Deleted files on an SSD are not reliably overwritten, and there is no built-in command that guarantees it. The dependable answer is FileVault: with it on, whatever fragments remain are encrypted along with the rest of the drive. FileVault: what it protects you from and what it does not covers the boundary.
When the routine is more than you want
The disk image method works, costs nothing and uses only Apple’s tools. It also has moving parts: remember to eject, delete the original, notice when you left it mounted.
Hushbox does the same job in place. Right-click a folder in Finder, choose Lock with Hushbox, and the folder becomes an AES-256 encrypted disk image of the kind Disk Utility makes, in the same spot, with the original deleted only after the locked copy has been checked byte for byte. It locks again by itself when the screen locks, when the Mac sleeps, or after an idle time you choose. The honest limits: the item’s name still shows in Finder, older copies in backups are not changed, and it is not a replacement for FileVault.
Questions
Can I encrypt a folder on a Mac without making a disk image? Not with anything built in. Finder’s Encrypt command works on whole drives, not folders, and there is no per-folder encryption setting. A disk image, an encrypted archive, or an app that manages images for you are the options.
Will an encrypted disk image open on Windows? Treat it as Mac-only. If the files need to reach someone on Windows, send them another way, such as a password-protected PDF or an encrypted zip made with care.
How do I change the password on an encrypted disk image?
Eject it, then run hdiutil chpass followed by the image’s path in Terminal. It asks for the old password and the new one. Copies of the image in older backups still open with the old password.