FileVault or a locked folder? What each one protects on a Mac
· 6 min read
FileVault vs an encrypted folder on a Mac is not really a choice between two versions of the same thing, because they protect you at different moments. FileVault encrypts the whole drive and protects a Mac that is shut down, lost or stolen; the moment you log in, everything on it is readable again. A locked folder stays unreadable while you are logged in and working, which is exactly when someone at your desk, another account or an app would see it. Turn FileVault on, then lock the few folders that genuinely matter.
What FileVault protects, and the moment it stops
FileVault is full-disk encryption tied to your login password. Its job is the powered-off Mac: the laptop taken from a car, the drive someone tries to read from another machine. Without the password, the disk is noise. FileVault: what it protects you from and what it does not covers the whole boundary.
The protection ends at login. Once the password is typed, the disk is unlocked for you, for every app you run, for Spotlight, for backup software and for anyone who sits down at the keyboard while you are away. FileVault cannot tell the difference between you opening your tax folder and someone else doing it on your unlocked Mac.
Two details people miss:
- A sleeping Mac is a logged-in Mac. The disk stays unlocked while the lid is closed; the password prompt on wake is a screen lock, not FileVault. If you want FileVault’s full protection while traveling, shut the Mac down rather than closing the lid.
- FileVault unlocks the whole volume, not your part of it. On a shared Mac, whichever permitted account logs in first unlocks the disk for everyone. From then on your files are guarded by ordinary file permissions, and an administrator account can get past those.
To check whether it is on, open System Settings, choose Privacy & Security and scroll down to FileVault. On macOS 12 Monterey and earlier it is a tab in System Preferences, Security & Privacy. Or in Terminal:
fdesetup status
It answers “FileVault is On.” or “FileVault is Off.”
What a locked folder protects that FileVault cannot
A locked folder here means one whose contents are encrypted with their own password, such as an encrypted disk image made in Disk Utility. While it is locked, the contents are ciphertext even though you are logged in. That covers the situations FileVault ignores.
Someone at your unlocked Mac. A partner borrowing it for a minute, a colleague at your desk, a child. They can open Finder; they cannot open the folder.
Other accounts on the same Mac. Permissions keep standard users out of your Documents, but an administrator can read anything with enough effort. An encrypted folder does not care who is asking.
Apps and indexing. Spotlight reads the text inside documents, Finder builds thumbnails, Recents lists what you opened, and sync tools copy plain files. A locked folder gives them one encrypted item and nothing inside to read.
Copies that leave the internal drive. FileVault stops at the internal disk. Copy a folder to a USB stick or a cloud folder and it arrives in plain form. Copy a locked folder and it arrives locked, because the encryption is part of the item itself.
FileVault vs an encrypted folder, side by side
What it covers. FileVault: everything on the internal drive, including mail, browser data, caches and temporary files. Locked folder: only what you put inside it.
When it protects. FileVault: while the Mac is shut down. Locked folder: whenever the folder is locked, including while you are logged in and the Mac is in use.
When it stops. FileVault: at login, for everything and everyone. Locked folder: when you unlock it, and only for what is inside.
What you notice day to day. FileVault: nothing after the first encryption pass, apart from a password at startup. Locked folder: a password or Touch ID each time you open it.
Forgotten password. FileVault: recovery through your Apple Account or a recovery key, if you set one up. Locked folder: usually nothing; encrypted disk images have no recovery route.
Where a locked folder falls short
A locked folder is narrower by design, and its limits are worth stating plainly.
- It protects nothing while it is open. Unlocked, its contents are as exposed as any other file, including to software running under your account. Locking it again is the habit that matters.
- It does not reach copies made elsewhere. The PDF still in Downloads, the attachment in Mail, and backups taken before you locked the folder all stay as they were.
- It does not cover the rest of the disk. Mail, messages, browser history and every other folder are protected only by FileVault, and are readable on a stolen Mac without it.
That last point is the reason this is not an either-or question.
How to make a locked folder on a Mac
With Disk Utility, free and built in. Open Disk Utility, choose File, New Image, Image from Folder, pick the folder, set Encryption to 256-bit AES encryption and Image Format to read/write, then set a password. You get a new disk image; the original folder stays there, unencrypted, until you delete it. Double-click the image and enter the password to open it, eject it to lock it. Encrypt a folder on a Mac with Disk Utility covers every option. The friction is that it stays open until you remember to eject it.
Locked in place. Hushbox does the same kind of encryption (an AES-256 disk image, the format Disk Utility makes) from the Finder right-click menu, leaving the locked item where the folder was. It opens with Touch ID or its password and locks again by itself when the screen locks, when the Mac sleeps or after an idle time you choose. It is honest about its edges: the item’s name still shows in Finder, copies made before you locked it are unchanged, and it is not a FileVault replacement. It is the everyday half of the pair.
Use both: a setup that covers most people
- Turn FileVault on and store the recovery key somewhere that is not the Mac.
- Require a password immediately after sleep or the screen saver (System Settings, Lock Screen), and press Control-Command-Q to lock the screen when you step away.
- Keep sensitive documents in one folder and lock it: tax returns, passport scans, contracts, medical letters. Where to keep tax returns, passports and ID scans sets up that folder properly.
- Shut down, not sleep, before the Mac travels somewhere it could be taken.
FileVault covers the Mac that leaves your hands. The locked folder covers the Mac that stays in them.
Questions
Is FileVault enough to protect my files on a Mac? Against theft of a powered-off Mac, yes. Against anyone or anything with access to the Mac while you are logged in, no. For a handful of genuinely sensitive documents, add a locked folder on top.
Does an encrypted folder work without FileVault? Yes, the folder’s contents are encrypted either way. But everything outside it, including mail, browser data and stray copies of the same documents, is readable on a stolen Mac without FileVault. Use both.
Does FileVault encrypt external drives? No. It covers the internal startup disk only. External drives are encrypted separately: right-click the drive in Finder and choose Encrypt, or erase it in Disk Utility with an encrypted format.
Can another user on my Mac see my files if FileVault is on? Standard users are kept out of your folders by permissions, not by FileVault. An administrator account can get past permissions. If you share a Mac with an admin, lock anything you would not want them to read.