everyday mac tools

Lock a folder with Touch ID on a Mac: what macOS allows

· 6 min read

macOS has no built-in way to lock a folder with Touch ID. Finder cannot put a fingerprint on a folder, and the encrypted disk images Disk Utility makes ask for a typed password every time. Touch ID does guard a handful of things inside Apple’s own apps (locked notes, the Hidden album in Photos, password-protected Pages, Numbers and Keynote files), so for an ordinary folder of files your choices are a password-only encrypted image or an app that puts Touch ID in front of one.

What Touch ID actually is on a Mac

Touch ID is a shortcut for a password, not a separate lock. Everything that accepts your fingerprint also accepts a password, and the password is what really protects the data. Anyone who knows it gets in without your finger.

You have Touch ID if your MacBook has the sensor in the top-right key, or if you use a Mac with Apple silicon and a Magic Keyboard with Touch ID. Everything is set in System Settings, Touch ID & Password:

  1. Click Add Fingerprint and follow the prompts. Each user account can hold up to three fingerprints, and the Mac up to five in total.
  2. Check the switches below: unlocking the Mac, Apple Pay, purchases, and password autofill each have their own.

A fingerprint only unlocks things for the account it is enrolled in, and adding one requires that account’s password. After a restart, the Mac asks for the password before it will accept a fingerprint again.

Where macOS already accepts a fingerprint

If what you want to protect fits one of these, you do not need anything extra.

  • Notes. Locked notes can open with Touch ID once you have set a notes password or chosen to use your login password. It covers the note and what is inside it, not files in Finder. Locked notes on a Mac explains the limits.
  • Photos. The Hidden and Recently Deleted albums can require Touch ID or your password, from the General tab of Photos settings. Hide and lock private photos on a Mac covers the setting and what it leaves out.
  • Pages, Numbers and Keynote. File, Set Password offers an Open with Touch ID checkbox. It applies to that one document. Password protect Pages, Numbers and Keynote files walks through it.
  • Saved passwords. The Passwords app, and Safari’s saved passwords on older versions, ask for Touch ID before showing anything.

None of these reach a folder of PDFs, spreadsheets and scans sitting in Documents. That is the gap people run into.

The closest built-in option: an encrypted disk image

Disk Utility can turn a folder into an encrypted disk image, which opens as a drive in the Finder sidebar when you double-click it and type its password.

  1. Open Disk Utility and choose File, New Image, Image from Folder.
  2. Pick the folder, set Encryption to 256-bit AES, and set Image Format to read/write so you can keep adding files.
  3. Choose a password and save.
  4. Open the new image, check that everything is there, then delete the original folder and empty the Trash. Disk Utility copies the folder; it never removes the original for you.

Encrypt a folder with Disk Utility covers each option.

The password prompt has a Remember password in my keychain checkbox, which looks like a route to Touch ID convenience. It is not. With the box ticked, the image opens without asking for anything at all while you are logged in, so anyone who sits down at your unlocked Mac opens it too. There is no fingerprint step. Leave the box unticked and you type the password each time.

The other habit to know: an open image stays open until you eject it, log out or restart. Sleep and the screen lock do not close it. A locked folder you forgot to eject this morning is an open folder this afternoon.

Adding Touch ID to a folder lock

Hushbox is built for exactly this gap. You right-click a folder in Finder and choose Lock with Hushbox; it becomes a locked item in the same place, with a lock icon. To open it, double-click (or right-click and choose Unlock) and use Touch ID or the Hushbox password. The folder opens in its own Finder window.

What you get compared with a plain disk image:

  • A fingerprint instead of typing, with one Hushbox password behind every item you lock.
  • It locks again by itself when the screen locks, when the Mac sleeps, or after 5, 15, 30 or 60 minutes idle, your choice. If an app still has unsaved work in the folder, it asks first rather than closing the app.
  • Nothing proprietary underneath. A locked item is an AES-256 encrypted disk image of the same kind Disk Utility makes. If Hushbox were ever gone, you would rename the item so it ends in .sparsebundle, double-click it and type the password.

The honest limits. The folder’s name still shows in Finder: Hushbox hides what is inside, not what it is called. Copies made before you locked it, such as Time Machine backups, are not changed. It is not a replacement for FileVault, which protects the whole disk when the Mac is off; Hushbox protects chosen items while you are logged in and using it. There is no password recovery, and each locked item adds about 33 MB, so lock one folder of files rather than each file separately. It costs $9 once for two Macs after a free 24-hour trial, and unlocking stays free even if you never buy it.

Keep the password where you can find it

Every option here comes down to a password. You will need it after every restart, with the lid closed on a keyboard without a sensor, and on any Mac where your finger is not enrolled. Put it in your password manager today.

If the reason for the lock is a stolen or lost laptop rather than someone at your desk, check FileVault too. FileVault or a locked folder sets out which one covers which situation; most people want both.

Questions

Can I lock a folder with Touch ID without installing anything? No. macOS offers Touch ID for notes, hidden photos, iWork documents and saved passwords, but not for Finder folders. The built-in folder option, an encrypted disk image, uses a typed password.

Does Touch ID work with the MacBook lid closed? Only with a Magic Keyboard with Touch ID, which needs a Mac with Apple silicon. The built-in sensor is on the keyboard under the lid, so with the lid shut you type the password instead.

Is a Touch ID lock weaker than a password lock? It is exactly as strong as the password behind it. The fingerprint is a faster way to supply that password, so choose a password that would hold up on its own.

Can someone else’s fingerprint unlock things on my account? No. Fingerprints are enrolled per user account, so one enrolled on another person’s account identifies them, not you. Adding a fingerprint to your account requires your password.