How to password protect a folder on a Mac: three ways that work
· 7 min read
Finder has no password option for folders, so to password protect a folder on a Mac you put its contents inside something encrypted. The built-in way is Disk Utility: choose File, New Image, Image from Folder, pick AES encryption and a password, and you get a disk image that opens only with that password. The other two routes are an encrypted archive, which is quick but either weak or Mac-only, and locking the folder where it sits with an app.
All three work. They differ in what they ask of you every time you need a file, and that is usually what decides which one you keep using. Two things that sound similar are not on the list: Finder’s Locked checkbox only guards against accidental edits, and a hidden folder reappears the moment someone presses Command-Shift-Period. Neither involves a password.
How to password protect a folder on a Mac with Disk Utility
Disk Utility turns a folder into an encrypted disk image (a .dmg file). There is nothing to install and the encryption is strong.
- Open Disk Utility. It is in Applications, Utilities, or type its name into Spotlight.
- Choose File, New Image, Image from Folder. Select the folder and click Choose.
- In the save panel, name the image and choose where to keep it.
- Set Encryption to 128-bit AES or 256-bit AES (recent versions mark 256-bit as recommended). Either is far beyond breaking by force, so your password is the weak point, not the cipher.
- Type the password twice when asked. There is no recovery if you lose it.
- Set Image Format. Choose read/write if you will add or change files later, or read-only or compressed for an archive you will only read.
- Click Save and wait for Done.
To open it, double-click the .dmg and enter the password. It mounts like a USB stick and appears under Locations in the Finder sidebar. When you finish, click the Eject button beside it, and it is locked again.
Four things catch people out.
The original folder is still there. Disk Utility copies the folder into the image and leaves the original untouched. Until you delete it and empty the Trash, a locked copy and an unlocked one sit side by side, and older copies can survive in Time Machine backups and local snapshots even after that.
The keychain checkbox. The password prompt offers “Remember password in my keychain”. Tick it and the image opens for anyone logged in as you, without asking for anything. Leave it off.
A read/write image made from a folder is nearly full. It is sized to fit what the folder held. If you will keep adding files, make a blank image instead (File, New Image, Blank Image) in the sparse bundle disk image format, which grows as it fills, and copy the folder in. Encrypting a folder with Disk Utility goes through the formats and sizes in detail.
While it is open, it is open. A mounted image behaves like any other disk. Anyone at your Mac can browse it, and apps can list the names of files you opened from it in their Open Recent menus long after you eject it. Eject it when you step away.
An encrypted archive: quick to send, but weak or Mac-only
A password-protected zip is the fastest way to send a folder to anyone, Windows users included. Finder’s Compress command has no password option, so this takes Terminal.
- Open Terminal and move to the folder that contains the one you want to protect, for example
cd ~/Documents. - Run
zip -er Private.zip Private, using your folder’s name. Put quotes around names with spaces. - Type a password twice. Nothing appears on screen as you type; that is normal.
Double-clicking the zip in Finder asks for the password before it expands. Avoid the -P option, which puts the password in your shell history.
The weakness is real. The zip tool uses the old PKZip 2.0 encryption, which its own help text calls weak. The file names inside are readable without any password (unzip -l Private.zip lists them). And every time you open it, the files are expanded unencrypted onto your disk, where they stay until you delete them. It is a fine envelope for sending and a poor place to keep anything. Password protecting a zip file covers the details and the alternatives.
Recent versions of macOS have a stronger archive that few people know about. Open Archive Utility (type its name into Spotlight), choose Archive Utility, Settings, and set “Use archive format” to Apple Encrypted Archive. Then choose File, Create Archive and pick the folder; it asks for a password. It is an Apple format, so it suits Mac users, not Windows, and the expand-to-disk problem is the same. Switch the format back afterwards if you use Archive Utility for other archives.
Lock the folder where it sits
Both built-in methods leave you managing two things: the container, and the open or expanded copy you work from. Hushbox keeps the folder where it is. Right-click it in Finder and choose Lock with Hushbox, and it becomes a locked item in the same place, with a lock icon. The original is deleted only after the locked copy has been checked byte for byte; until then, both exist.
To get in, double-click it and use Touch ID or your Hushbox password; the folder opens in its own Finder window. It locks again by itself when the screen locks, when the Mac sleeps, or after the idle time you pick, and it asks before closing an app with unsaved work. While it is locked, what is inside stays out of Spotlight, Finder Recents and Quick Look.
Under the lock icon is an AES-256 encrypted disk image, the same kind Disk Utility makes. If Hushbox ever goes away, rename the item so it ends in .sparsebundle, double-click it, enter the password, and macOS opens it on its own.
The limits, plainly: the folder’s name still shows in Finder, copies made before you locked it (in Time Machine, say) are unchanged, each locked item uses about 33 MB of extra space, and there is no password recovery. It is $9 once for two Macs after a free 24 hours, and unlocking stays free even if you never buy.
Which one to use
A folder you open most days. Locking in place asks the least of you and relocks on its own. A sparse bundle from Disk Utility also works if you will mount and eject it by hand every time.
A folder you archive and rarely open, such as old tax years or finished contracts. A read-only or compressed encrypted disk image. It is free, strong, and never needs attention.
A folder you need to send. An encrypted disk image if the other person has a Mac; a zip if they are on Windows and the contents are not highly sensitive. Either way, send the password by a different route, such as a text message.
A laptop that might be stolen. Turn on FileVault. None of these replaces it: FileVault protects the whole disk while the Mac is off; a locked folder protects its contents while you are logged in. FileVault or a locked folder explains why you want both.
Questions
Can I password protect a folder on a Mac without installing anything? Yes. Disk Utility’s encrypted disk image is built in and uses AES encryption. The cost is housekeeping: delete the unencrypted original yourself, and remember to eject the image when you finish.
Does a password protected folder hide its name? No. The disk image, the zip and the locked item all have names anyone can read in Finder. Choose a name that says nothing about what is inside.
What if I forget the password? An encrypted disk image, an Apple Encrypted Archive and a Hushbox item have no reset and no back door. Store the password in a password manager the moment you set it.