Here’s a fact that surprises most Mac users: macOS has no menu item, no right-click option, and no built-in “add password to folder” button. Unlike Windows, which has offered a basic folder-locking feature for years, Apple’s desktop operating system simply doesn’t ship with a one-click way to lock a directory behind a password. According to NIST’s Guide to Storage Encryption Technologies, protecting data at rest requires actual encryption, not just access restrictions, and that distinction is exactly where most people go wrong on the Mac.
The good news is that macOS does include a genuinely strong encryption tool. It’s just hidden inside Disk Utility, and it works differently than most people expect. This guide walks through the approaches that work, the ones that give false confidence, and the practical details that trip people up.
Why “Password Protecting” a Folder Is Trickier Than It Sounds
Before touching any menus, it helps to understand what you’re actually asking for. There are three very different things people mean when they say “password protect a folder”:
- Hiding it from casual eyes. A guest or coworker shouldn’t stumble onto your tax returns.
- Restricting access on the same machine. Only your user account can open it.
- Encrypting the contents. Even someone who yanks the drive or boots into Recovery Mode can’t read the files.
Only the third option delivers real security. And on macOS, the native path to it is an encrypted disk image — a `.dmg` file that mounts like a virtual drive and demands a password every time it opens.
The Native Method: Create an Encrypted Disk Image in Disk Utility
This is Apple’s own built-in solution, and it’s been available in some form for well over a decade. The interface has shifted over the years, so menu labels may differ slightly depending on your macOS version — but the workflow is consistent.
- Open Disk Utility (find it via Spotlight or in Applications → Utilities).
- From the menu bar, choose File → New Image → Image from Folder (older versions may say “Blank Image” if you want an empty container).
- Select the folder you want to protect.
- In the save dialog, choose 128-bit AES encryption or 256-bit AES encryption. Pick 256-bit unless you have a specific reason not to.
- Enter a strong passphrase and confirm it. Do not check “Remember this password in my keychain” if the whole point is a separate lock.
- Choose where to save the `.dmg` file, then click Save.
When it finishes, you’ll have a `.dmg` file. Double-click it, type the password, and your folder appears as a mounted volume. Eject it when you’re done, and the contents are sealed behind AES encryption until the next unlock.
What to Do With the Original Folder
This is the mistake almost everyone makes. Creating the disk image doesn’t delete or alter the original folder — it makes a copy inside the encrypted container. If you leave the source folder sitting on your Desktop, you’ve protected nothing.
After verifying the `.dmg` opens correctly and contains everything, delete the original folder with Command + Delete and empty the Trash. Then rename the `.dmg` to something inconspicuous if you like. If you’re nervous, keep the original on an external drive until you’re confident, then wipe it.
The Terminal Shortcut
For anyone comfortable with the command line, `hdiutil` does the same job in one line. The general form creates an AES-256 encrypted image from a source folder, prompting for a passphrase interactively. Apple’s man pages for `hdiutil` document the exact flags, and it’s worth checking them against your macOS version since syntax details can vary. The Terminal route is faster for repeat use, but Disk Utility is friendlier and harder to get wrong.
A Faster Option: Encrypted APFS Volumes
If you’re on a modern Mac with an SSD, Disk Utility can also create an encrypted APFS volume rather than a disk image. This lives on your existing drive, mounts only when unlocked, and behaves a bit like a separate partition. It’s arguably tidier than juggling `.dmg` files, though it’s less portable — you can’t email an APFS volume to someone the way you can send a disk image.
The trade-off table looks roughly like this:
| Method | Portable | Works on Windows | Best For |
|---|---|---|---|
| Encrypted disk image (.dmg) | Yes | No (needs third-party tools) | Backups, sharing, archiving |
| Encrypted APFS volume | No | No | Long-term local storage |
| Password-protected ZIP | Yes | Yes | Quick transfers, low sensitivity |
| FileVault | No | No | Whole-disk protection |
The ZIP Trick, and Why It’s Weaker Than It Looks
Many tutorials suggest right-clicking a folder and choosing Compress, then using Terminal’s `zip -er` command to add a password. It works, and the resulting archive opens on Windows too. But there’s a catch worth knowing: standard ZIP encryption uses a legacy scheme called ZipCrypto, which security researchers have considered broken for a long time. Tools exist that crack it in minutes on modern hardware.
Use password-protected ZIPs for convenience, not confidentiality. If the files matter, use AES-encrypted disk images. And if you’re already thinking hard about protecting data, it’s worth pairing folder encryption with broader habits — the same discipline covered in guides on malware protection and how to protect your devices applies here, because encryption won’t help if malware is already logging your keystrokes.
FileVault Is Not the Same Thing
A common misconception: turning on FileVault protects individual folders. It doesn’t. FileVault encrypts the entire startup disk, which is excellent for the scenario where a laptop gets stolen and someone pulls the drive. But once you’re logged in, FileVault is transparent — every folder is readable by anyone using your unlocked session.
Think of it as the lock on the front door of a building, while an encrypted disk image is the safe inside your office. You want both, but they solve different problems.
Permissions Are Not Passwords
Another trap: changing file permissions via Get Info → Sharing & Permissions to restrict access. This is useful for shared Macs with multiple user accounts, but it is not encryption. Anyone with an administrator account can override permissions, and anyone who boots into Recovery Mode can reset them entirely. If someone physically possesses the machine, permissions offer almost no protection.
The same logic applies to hiding folders by renaming them with a leading dot. It’s obscurity, not security.
Practical Habits That Make Folder Encryption Work
Encryption is only as strong as the password behind it. A few habits separate people who are genuinely protected from people who just feel protected:
- Use a passphrase, not a password. Four or five random words beat a clever string of substitutions every time.
- Store it in a password manager. If you’re choosing one, this guide to how to choose a secure password manager covers the criteria that matter, and there are solid free password managers for personal use if budget is tight.
- Don’t reuse the passphrase. A locked folder with the same password as your email is one breach away from being useless.
- Test before deleting. Always mount the image, open a few files, and confirm nothing is missing before you remove the source folder.
- Back up the `.dmg` file itself. An encrypted image is a single file, and single files get corrupted. Keep a copy somewhere safe.
If you ever lose the passphrase, there is no recovery. Apple’s encryption is real, which means no backdoor, no reset link, no support ticket that fixes it. That’s the point — but it also means a forgotten password is a permanent loss. If you’re prone to forgetting credentials, the workflow in this guide on how to recover a forgotten website password is a good reminder of how painful recovery can be when it’s even possible.
Common Mistakes People Make
After enough time in Mac support forums, clear patterns emerge. These are the errors that show up again and again: (Cybersecurity)
Saving the password in Keychain by accident. The checkbox is easy to miss, and it means the disk image unlocks automatically for anyone using your account. Convenient, but it defeats the purpose.
Leaving the original folder in place. Covered above, but it’s the single most common failure. The encrypted copy is only as good as the deletion of the original.
Using a weak passphrase because it’s typed often. If you open the folder daily, the temptation is real. A password manager solves this entirely — copy, paste, done.
Assuming Time Machine backs up mounted images. If the disk image isn’t mounted when Time Machine runs, the backup may not capture its contents. Keep a separate copy of the `.dmg` file.
Forgetting that screenshots and previews leak. Thumbnails of sensitive files can linger in caches and screenshot folders. If you handle confidential material, it’s worth knowing how to take a screenshot on a Mac so you understand where those images land — and clean up accordingly.
Skipping malware checks. Encrypted or not, a Mac can carry unwanted software. If something feels off, this walkthrough on how to check for malware on a Mac is a sensible first step before you trust any folder with sensitive data.
When to Reach for a Third-Party Tool
Dedicated encryption apps exist that create vault-style folders with drag-and-drop simplicity, and some integrate with cloud storage. They can be genuinely convenient. The catch is that you’re trusting a third party’s implementation, and you should verify that the product has undergone independent security audits before handing it your most sensitive files. For most people, Apple’s built-in disk images are sufficient and require no trust beyond Apple itself.
If you spend a lot of time in Terminal, it’s worth knowing your way around the basics — even simple things like the undo shortcut key for Windows and Mac save time when you’re configuring encryption commands. And if you’re setting up a work machine for this kind of task, choosing the best code editor for Mac matters less than picking one you can navigate quickly.
Conclusion
Password-protecting a folder on a Mac isn’t a single click, and anyone who tells you otherwise is probably describing permissions, hiding tricks, or weak ZIP encryption. The real solution is an AES-encrypted disk image created through Disk Utility, unlocked with a strong passphrase you store in a password manager, with the original folder deleted once you’ve verified the copy. It takes about two minutes, it uses tools Apple already ships, and it delivers protection that holds up even if the machine ends up in the wrong hands.
The pattern to remember: FileVault guards the whole disk, permissions guard against casual snooping, and encrypted disk images guard the specific files you care about. Use all three for what they’re each good at, and stop relying on the ones that only look like security.
Frequently Asked Questions
Can I password protect a folder on Mac without any extra software?
Yes. Disk Utility, which comes preinstalled on every Mac, can create an encrypted disk image from any folder. No downloads, no subscriptions, no third-party apps required.
What encryption should I choose, 128-bit or 256-bit AES?
Choose 256-bit AES. It’s stronger, and the performance difference on modern Macs is negligible for typical file storage. There’s rarely a good reason to pick 128-bit today.
What happens if I forget the disk image password?
There is no recovery option. Apple’s encryption has no backdoor, so a forgotten passphrase means permanent loss of access. Store the passphrase in a password manager before you delete the original folder.
Is a password-protected ZIP file safe enough?
For casual use, yes. For anything sensitive, no. Standard ZIP encryption relies on a legacy scheme that’s widely considered breakable. Use an encrypted disk image when confidentiality actually matters.
Does FileVault protect individual folders?
No. FileVault encrypts the entire startup disk and protects data when the Mac is powered off or the drive is removed. Once you’re logged in, it doesn’t restrict access to any folder.
Can I open an encrypted Mac disk image on Windows?
Not natively. Windows can’t mount `.dmg` files without third-party utilities, and those utilities don’t always handle Apple’s encryption. If you need cross-platform access, consider a well-reviewed encrypted archive format instead.
