everyday mac tools

Forgot the password to an encrypted disk image? What still works

· 7 min read

If you forgot the password to an encrypted disk image on a Mac, there is no reset, no back door and nothing Apple can do: the password is the key. What still works is finding the password where your Mac may have saved it, finding an unencrypted copy of the files somewhere else, or, if the image is open right now, copying everything out before you eject it.

Work through the checks below in order. The first two take a minute and solve more cases than you might expect.

First, check whether the image is still open

An encrypted image stays unlocked from the moment you enter the password until it is ejected, you log out, or the Mac restarts. Sleep does not close it. So if you unlocked it recently, it may still be open.

Look in the Finder sidebar under Locations. You can also run hdiutil info in Terminal, which lists every attached image with its file path and where it is mounted.

If it is there:

  1. Do not eject it, restart or log out, and plug in a laptop so the battery cannot run flat.
  2. Copy everything inside to an ordinary folder.
  3. Make a new encrypted image from that folder with a password you store properly this time. Encrypt a folder with Disk Utility has the steps.

Also notice how it opened last time. If a double-click opened it without asking for anything, the password is almost certainly saved in your keychain.

Look for the password in Keychain Access

When you unlock an image, the password prompt offers a checkbox: Remember password in my keychain. If it was ticked at any point, the password is stored in your login keychain as an item of kind “disk image password”.

  1. Open Keychain Access. On macOS Sequoia it is no longer in the Utilities folder, so search for it with Spotlight. On Sonoma and earlier it is in Applications, Utilities. The Passwords app is not the place to look for these.
  2. Select login in the sidebar.
  3. Type the image’s file name, or part of it, into the search field. If nothing matches, click the Kind column header to sort the list and look for “disk image password” entries.
  4. Double-click the item, tick Show password, and enter your Mac login password when asked.

A keychain belongs to one user account on one Mac. If you ever opened the image on another Mac, such as an older one or a work machine, check the keychain there too. A login keychain carried over by Migration Assistant comes with its saved passwords.

Then search your password manager for the image’s name, “dmg” and “disk image”. People often saved it and forgot where.

Find an unencrypted copy instead

The files existed unencrypted before the image did, and that copy is often easier to find than the password.

  • The original folder. Disk Utility’s Image from Folder copies a folder and leaves the original in place. Search Spotlight for the name of a file you know was inside, and check the Trash.
  • Time Machine. Open the folder where the original lived, then choose Browse Time Machine Backups from the Time Machine menu bar icon, or open the Time Machine app. Scroll back to a date before you made the image and restore the folder. Private files and Time Machine explains what backups hold and for how long.
  • An older copy of the image itself. If you changed the image’s password at some point, copies of the image in backups from before the change still open with the old password. Restore one alongside the current image and try the old password on it.
  • Anywhere else it travelled. iCloud Drive’s Recently Deleted keeps deleted files for 30 days. Sent mail holds attachments. A USB stick, an old laptop or a colleague may have a copy.

Try your own likely passwords, methodically

You typed the password twice when you created the image, so a typo can be consistent and still be the password. Before giving up, think through:

  • Caps Lock, or a password typed with a different keyboard layout, where some symbols sit on different keys.
  • Your usual pattern with an older year or number.
  • A trailing space, or a password that was pasted rather than typed.
  • Your Mac login password from that time, in case you reused it.

If you end up with a longer shortlist, Terminal can try each one for you. Put the candidates in a plain text file, one per line (in TextEdit, choose Format, Make Plain Text before saving), then run this with your own paths:

while IFS= read -r pw; do
  if printf '%s' "$pw" | hdiutil attach -stdinpass -quiet ~/Documents/Taxes.dmg; then
    echo "Opened with: $pw"; break
  fi
done < ~/Desktop/candidates.txt

When a candidate works, the image mounts and the loop stops. Afterwards, delete the candidates file and empty the Trash; it is a list of your passwords in plain text.

This is for your own guesses, dozens of them, not millions. It is not a way to crack the image.

Why a forgotten disk image password cannot be reset

The image’s contents are encrypted with AES, using a key protected by your password. No master key exists: not at Apple, not in your Apple Account, not in the Mac’s hardware. Staff at an Apple Store cannot open it either. macOS’s own wording for encrypted images is blunt: forgotten passwords cannot be retrieved.

The only attack is guessing, and every guess has to go through the password-to-key step. A short, common password can fall to guessing software. A long, random one will not, in any time that matters, whoever you pay. Services that advertise recovery for encrypted images do that same guessing on faster hardware, so they help only when the password was weak or you can give them strong clues. They would also need a copy of your private files. Be wary of anyone who promises a result.

One narrow exception: an image created in Terminal with a recovery certificate (hdiutil create -certificate) can be opened with the matching private key, using hdiutil attach -recover. Disk Utility never adds one, so this only applies if an IT department or a script made the image. If yours came from work, ask them.

Next time

  • Save the password in a password manager the moment you create an image, under the image’s name.
  • Eject and reopen the image with the password before you delete the original files.
  • Do not rely on a keychain alone. It lives on one Mac and does not help when that Mac is gone.

Hushbox is no different on the fundamental point: no back door and no password recovery, so its password belongs in a password manager too. What it changes is the number of passwords, one for every item you lock, used with Touch ID. After a password change it keeps older passwords only to open older copies, such as Time Machine restores, which covers the old-backup problem above.

Questions

Can Apple unlock an encrypted disk image? No. Apple has no copy of the key and no way to reset the password. Neither does anyone else.

Does my Mac login password open it? Only if you used the same password when you created the image. It is worth one try.

Is there a password hint for a disk image? Images made in Disk Utility do not have one. Drives encrypted with Finder’s Encrypt command do, because Finder requires a hint.

Is it worth paying a recovery service? Only if the password was short or you remember most of it and can describe the rest. Against a long, random password, no service can help.