everyday mac tools

Keep files private from someone who knows your Mac password

· 7 min read

If someone knows your Mac login password, everything that password protects is open to them: every file in your account, the FileVault encryption on the disk, and the passwords saved in your keychain. To keep particular files private from that person, you need a lock with a different password, and you need to make sure the Mac is not quietly remembering that second password for you. The cleaner fix, where you can manage it, is to change your login password and give them an account of their own.

What your login password opens

It helps to be exact about what the other person can reach, because several protections that feel separate are tied to the same password.

  • Your files. Everything in your home folder, including anything you have hidden. Hidden files reappear with Shift-Command-period in Finder.
  • FileVault. FileVault unlocks the disk with your login password. It protects a Mac that is turned off from a stranger who does not know the password; it does nothing against someone who does. FileVault: what it protects you from and what it does not goes into the detail.
  • Saved passwords. The Passwords app, and Keychain Access on older setups, unlock with your login password or Touch ID. Website passwords, Wi-Fi passwords and any disk image password you told the Mac to remember are all readable.
  • Other built-in locks. The Hidden album in Photos uses your login password. Locked notes can use it too, depending on the option you chose when you set them up.
  • Touch ID. Every Touch ID prompt falls back to the password, so a fingerprint lock is no protection from someone who has the password.

The better fix: change the password and separate the accounts

If you can, this solves the problem at the root rather than locking individual files.

  1. Change your login password. In System Settings, Users and Groups, click the info button next to your account and choose to change the password. Doing it this way updates your login keychain to match.
  2. Give the other person their own account: in Users and Groups, click Add User (Add Account on some versions). They get their own desktop, files, browser and settings.
  3. Make their account a standard one, not an administrator. An administrator can reset another account’s password and change file permissions, which undoes most of the point. Standard, admin and guest accounts explains the difference.
  4. Check System Settings, Touch ID and Password, and remove any fingerprint that is not yours.

Files in your account are then out of reach to them without your password.

When one account has to stay shared

Separate accounts are not always practical. A family might share one login for simplicity, or a partner might need to pick up your Mac and use it. In that case, lock the specific files with a password that is not your login password.

The free way is an encrypted disk image, made with Disk Utility:

  1. Open Disk Utility and choose File, New Image, Image from Folder, then pick the folder.
  2. Choose 256-bit AES encryption and enter a password that is different from your login password.
  3. When you open the image later, leave Remember password in my keychain unchecked. If you check it, the password goes into the keychain the other person can open, and the image mounts for them without asking.
  4. Check the new image opens, then delete the original folder and empty the Trash.
  5. Eject the image when you finish with it. Sleep and the screen lock do not close it.

If you have already let the keychain remember an image’s password, open Keychain Access with Spotlight, search for the image’s name and delete that entry. Encrypt a folder on a Mac with Disk Utility walks through the image options in full.

The traces that stay behind

Locking a file protects what is inside it, not the evidence that it exists.

  • Names. The locked item’s name still shows in Finder. Give it a name you would be happy for the other person to read.
  • Recent items. Finder’s Recents and the Open Recent menus in apps remember file names you opened. Clear recent files on a Mac covers each of them.
  • Backups. Time Machine keeps the unencrypted copies it made before you locked anything, and anyone with your password can browse them. Private files and Time Machine explains how to deal with that.
  • iCloud Drive. A folder deleted from iCloud Drive sits in Recently Deleted for 30 days before it is gone.

Things that do not help against this person

  • Hiding a file or folder. Anyone can show hidden files in one keystroke.
  • Finder’s Locked checkbox. It stops a file being changed or deleted, not read.
  • A lock that falls back to your login password. If the password they know opens it, it is not a lock against them.

A lock with its own password: Hushbox

Hushbox turns the disk image method into a right-click. Choose Lock with Hushbox on a file or folder in Finder, and it becomes an AES-256 encrypted disk image, the same kind Disk Utility makes, in the same folder. The original is deleted only after the locked copy has been checked byte for byte. Unlocking takes Touch ID or the Hushbox password, a single password for every item that you set up for Hushbox, so knowing your login password is not enough. That is also why step 4 above matters: a fingerprint of theirs enrolled on your Mac would open it.

It locks again by itself when the screen locks, when the Mac sleeps, or after an idle time you choose, so an item you forgot to close does not sit open all afternoon. The same limits apply as with any disk image: the item’s name still shows, copies made before locking are unchanged, and there is no password recovery, so keep the Hushbox password in a password manager. Hushbox is $9 once for two Macs, free for 24 hours with every feature, and unlocking stays free even after the trial.

Questions

Will the other person be able to see that I locked something? Yes. The name of a locked item or a disk image shows in Finder like any other file. What they cannot do is open it.

Is FileVault pointless if someone knows my password? No. It still protects the Mac from anyone else if it is lost or stolen while turned off. It just is not a barrier between two people who share a password.

What if this is about my safety, not just privacy? Take it seriously and start with your accounts, not your files. On an iPhone, Safety Check, in Settings, Privacy and Security, reviews and resets what you share with other people and devices, including your Apple Account.