Private files and Time Machine: what your backups keep

26 September 2026 · 6 min read

To exclude a folder from Time Machine on a Mac, open System Settings, General, Time Machine, click Options, then click the plus button under the exclusion list and choose the folder. That stops future backups copying it, but it does not touch backups already made: every earlier copy stays in your backup history until those backups are thinned or deleted. For private files you still want backed up, the better move is usually to encrypt the backup disk, so everything on it needs a password.

How to exclude a folder from Time Machine

On macOS 13 Ventura and later, including Sequoia:

1. Open System Settings and choose General, then Time Machine.
2. Click Options at the bottom of the pane.
3. Under Exclude from Backups, click the plus button.
4. Choose the folder (or file, or external drive) and click Exclude.
5. Click Done.

On macOS 12 Monterey and earlier, the same list is in System Preferences, Time Machine, Options.

Terminal can do the same, and check the result:

tmutil addexclusion ~/Private
tmutil isexcluded ~/Private

The second command prints [Excluded] or [Included] before the path. By default addexclusion sets a “sticky” exclusion that travels with the folder: move it or copy it and the copy stays excluded. Adding -p makes a fixed-path exclusion instead, which applies to whatever sits at that path; that form needs sudo, and Terminal needs Full Disk Access. Sticky exclusions may not appear in the list in System Settings, so tmutil isexcluded is the reliable way to check.

What excluding does and does not do

Excluding is narrower than it sounds.

It only affects future backups. Time Machine keeps hourly backups for the past 24 hours, daily backups for the past month and weekly backups for every month before that, until the disk fills and the oldest are removed. A folder that was included for a year is in every one of those backups, and excluding it today leaves all of them as they are.

Local snapshots are separate. When Time Machine is on, macOS also keeps hourly snapshots of the whole volume on the internal drive, usually for about a day. Time Machine local snapshots are taking space covers what they hold and how they age out.

It removes your safety net. An excluded folder is not backed up at all. If the Mac’s drive fails, those files are gone. That is fine for things you can download again or that are backed up another way. It is the wrong answer for your only copy of a tax return or a scanned passport.

So for most private files, the question is not how to keep them out of the backup. It is how to make sure the backup cannot be read by the wrong person.

Encrypt the backup disk instead

An encrypted backup disk needs a password before anything on it can be read, so a backup drive that is lost, stolen or plugged into someone else’s Mac gives nothing away.

For a new backup disk: in System Settings, General, Time Machine, click Add Backup Disk (or the plus button), choose the drive, and turn on the option to encrypt the backup when asked. Set a password and a hint. Time Machine stores the password in the Mac’s keychain so backups run on their own.

For a disk that already holds unencrypted backups: remove it from the Time Machine list and add it again with encryption turned on. Depending on how the disk is formatted, macOS either encrypts it in place, which can take many hours, or has to erase it first; read the message before you confirm. If it needs erasing, the disk’s backup history goes with it.

To check an existing disk, connect it and run diskutil apfs list in Terminal. The Time Machine volume shows FileVault: Yes when it is encrypted. Disk Utility shows the same thing in the volume’s format.

Keep that password in a password manager, not only on the Mac. The Mac remembers it, but if the Mac dies you will need it to restore to a new one, and there is no way to recover it.

One limit to know: because your Mac remembers the password, anyone using your Mac while you are logged in can open Time Machine and browse your history. Encrypting the disk protects the drive away from the Mac, not the backup seen from your own unlocked account.

How locked and encrypted items back up

Time Machine copies files as they are on disk. It never asks for passwords to anything it backs up, so an encrypted item is backed up encrypted.

An encrypted disk image made in Disk Utility is backed up as the image file. The contents stay encrypted in every backup, and a restored copy needs the password the image had when that backup was made. Time Machine copies the image file itself; it does not treat the opened image as a separate drive to back up.

Choose the format with backups in mind. A read/write .dmg is one large file, and Time Machine copies a changed file whole, so editing one document inside a 10 GB image sends 10 GB to the next backup. A sparse bundle stores the image as many small pieces, and only the changed pieces are copied. Encrypt a folder on a Mac with Disk Utility covers choosing between the formats.

Items locked with Hushbox are AES-256 encrypted disk images of the same kind, so they back up the same way: encrypted, with nothing inside readable from the backup. A restored item comes back locked. If you change the Hushbox password later, it keeps the older passwords only for opening older copies such as Time Machine restores. It cannot change backups made before you locked something, which is the next problem.

The older plain copies in your history

If a folder of scans sat unencrypted for months before you locked it, every backup from those months holds a plain copy. Locking or excluding it now does nothing to them. You have three honest options.

Leave them, if the backup disk is encrypted. The plain copies sit behind the disk’s password and stay until the disk fills and Time Machine removes its oldest backups. For most people this is enough.

Delete the backups that hold them. On an APFS backup disk, the default since macOS 11 Big Sur, you cannot remove one file from a backup, only whole backups. With the disk connected, list them and delete by timestamp:

sudo tmutil listbackups -t
sudo tmutil delete -d "/Volumes/Backup Disk" -t 2026-03-14-091522

Use your own disk name and timestamp. Terminal needs Full Disk Access, and deleted backups cannot be brought back. Older HFS+ backup disks allowed deleting one path from every backup.

Start a fresh, encrypted backup. Set up a second drive with encryption on, let it finish a full backup, and only then erase the old one. Erasing first leaves you with no backup for a while.

Backups are only one place old copies live. Delete a file for good on a Mac covers local snapshots, iCloud’s Recently Deleted and the rest.

Questions

Does excluding a folder from Time Machine delete it from old backups? No. It only keeps the folder out of future backups. Earlier backups keep their copies until Time Machine thins them or you delete those backups.

Are Time Machine backups encrypted? Only if encryption was turned on for the backup disk. Run diskutil apfs list with the disk connected, or check the volume in Disk Utility. If it is not encrypted, anyone who connects the drive to a Mac can browse it.

Can Time Machine back up an encrypted disk image? Yes, as the encrypted file it is. The backup never contains the contents in readable form, and restoring the image gives you something you still need the password to open.

Should I exclude private files from Time Machine? Usually not. Excluding means no backup, so a drive failure loses them. Encrypt the backup disk and keep the files themselves locked; exclude only things you can get back another way.