everyday mac tools

Encrypt a USB stick or external drive on a Mac

· 7 min read

To encrypt an external drive on a Mac, Control-click it in the Finder sidebar, choose Encrypt, set a password and a hint, and click Encrypt Disk. That works when the drive is formatted APFS or Mac OS Extended with a GUID Partition Map. If the Encrypt option is missing, erase the drive in Disk Utility as APFS (Encrypted) instead, which wipes it, so copy your files off first.

Either way, the drive asks for the password every time it is plugged in, and from then on it is a Mac-only drive. That trade-off is covered at the end.

Check the drive’s format first

Most USB sticks and many portable drives ship formatted as ExFAT or MS-DOS (FAT) so they work on Windows too. macOS cannot encrypt either of those in place.

  1. Open Disk Utility (Applications, Utilities, or search for it in Spotlight).
  2. Choose View, Show All Devices, so you can see the physical drive as well as the volume on it.
  3. Select the volume. The line under its name shows the format: APFS, Mac OS Extended, ExFAT or MS-DOS (FAT).
  4. Select the drive above it. The details show the Partition Map, which should read GUID Partition Map. Sticks formatted for Windows usually show Master Boot Record.

APFS or Mac OS Extended with a GUID Partition Map: use Finder’s Encrypt. Anything else: erase it as described further down.

How to encrypt an external drive on a Mac from Finder

  1. Connect the drive. It appears in the Finder sidebar under Locations.
  2. Control-click (or right-click) its name and choose Encrypt, followed by the drive’s name.
  3. Fill in Encryption password and Verify password.
  4. Fill in Password hint. Finder marks it as required and will not accept a hint that matches the password. Anyone holding the drive can read the hint, so make it mean something only to you.
  5. Click Encrypt Disk.

Encryption runs in the background, and on a large, full drive it can take a long time. Leave the drive connected until it finishes. In Terminal, diskutil apfs list shows each APFS volume with a line labelled FileVault. That is simply the name macOS uses for APFS encryption, external drives included; an encrypted drive reads Yes there.

Finder’s encryption sheet carries a warning worth taking seriously: only data saved after encryption is protected, and data saved before encryption may still be accessible with recovery tools. If the drive already holds sensitive files, the cleaner route is to copy them off, erase the drive encrypted, and copy them back.

Or erase it as APFS (Encrypted) in Disk Utility

This is the route for a stick formatted for Windows, a drive whose Encrypt option is missing, or any drive that has held sensitive files before. It deletes everything on the drive.

  1. Copy off anything you want to keep.
  2. In Disk Utility, choose View, Show All Devices.
  3. Select the drive itself, the top entry for that device, not the volume indented under it. Only then does Disk Utility offer the Scheme option.
  4. Click Erase.
  5. Type a name. Set Format to APFS (Encrypted) and Scheme to GUID Partition Map.
  6. Enter the password when asked, twice, then click Erase.

Copy your files back once it finishes. Choose APFS (Case-sensitive, Encrypted) only if you know you need case sensitivity; almost nobody does for a data drive.

Unlocking, ejecting and the keychain question

When you plug the drive in, macOS asks for its password before the drive appears. It also offers to remember the password in your keychain. On your own Mac that is a fair convenience: a lost stick is still locked to anyone else. The cost is that anyone using your Mac while you are logged in gets straight in, because the drive unlocks without asking.

The drive stays unlocked until you eject it, and until then it is as readable as any unencrypted drive to whoever is at the Mac. Click the eject button beside it in the sidebar, or select it and press Command-E. Pulling it out without ejecting risks damaging files.

To remove encryption later, Control-click the drive and choose Decrypt. Finder asks for the password first.

Time Machine backup disks

A Time Machine disk holds a copy of everything on your Mac, which makes it the most sensitive drive you own. Encrypt it at setup.

On macOS Ventura and later: System Settings, General, Time Machine, Add Backup Disk. Choose the disk, click Set Up Disk, turn on Encrypt Backup, and enter a password, the same password again, and a hint. Time Machine requires the hint too. On Monterey and earlier, the same choice is an “Encrypt backups” checkbox in System Preferences, Time Machine, after Select Backup Disk.

Two things catch people out:

  • Encrypting an existing backup disk erases it. On current macOS, if the disk already holds unencrypted backups, Time Machine says the volume must be erased to enable encryption. Your backup history goes with it, which is why the decision belongs at setup.
  • The password matters later, not now. Your Mac keeps it so backups run without prompting. You need it when restoring to a new or erased Mac, and, as Time Machine’s own setup puts it, you cannot restore your data without it. Store it in a password manager.

What Time Machine keeps of your private files, and for how long, is its own topic: private files and Time Machine.

The Windows trade-off

An encrypted APFS drive is a Mac drive. Windows cannot read APFS without extra software, and encrypted APFS is harder still. Older Macs are limited too: APFS needs macOS High Sierra or later.

If the drive has to move between a Mac and a Windows PC, pick one of these instead:

  • Keep the drive ExFAT and put the private part in an encrypted disk image on it. The drive works everywhere; the image opens only on a Mac. Encrypt a folder with Disk Utility walks through making one.
  • Encrypt individual files before copying them over, for example PDFs with an open password, which any computer can read with the password.
  • Buy a hardware-encrypted drive with a PIN keypad. The encryption happens inside the drive, so once unlocked on the keypad it looks like an ordinary drive to any computer.

If what you really want is a few private folders on your Mac rather than an encrypted drive, Hushbox locks individual files and folders in place from the Finder right-click menu. It does not encrypt whole drives, so for a stick or backup disk, the methods above are the right tools.

Questions

Why is there no Encrypt option when I right-click my USB drive? The drive is almost certainly formatted ExFAT or MS-DOS (FAT), or uses a Master Boot Record partition map. Copy its files off and erase it as APFS (Encrypted) with the GUID Partition Map scheme.

What if I forget the password to an encrypted external drive? There is no recovery route. If you ticked the option to remember it, check Keychain Access on the Mac where you did. Forgot the password to an encrypted disk image covers the same checks, and the same hard limits.

Does FileVault encrypt my external drives? No. FileVault covers the Mac’s startup disk. Each external drive needs encrypting on its own, as above.

Can I encrypt a drive that has files on it without losing them? Yes, if it is APFS or Mac OS Extended with a GUID Partition Map: Finder’s Encrypt works in place. Keep a backup anyway, and remember the warning about data saved before encryption.