How to Password Protect a Folder on Mac

macOS has no “protect this folder” command. What it has is Disk Utility, which can create an encrypted container that behaves like a disk — and that is the built-in answer. Third-party vaults exist for the cases where a container is the wrong shape.

Method 1: An Encrypted Disk Image

1. Open Disk Utility (in /Applications/Utilities).
2. Choose File → New Image → Image from Folder…
3. Select the folder you want to protect.
4. Set Encryption to 256-bit AES, enter a password.
5. Choose read/write as the image format, and save the .dmg.

Open the .dmg and it mounts like a drive, asks for the password, and shows the folder’s contents. Eject it and the contents are inaccessible — the file on disk is ciphertext.

Two details matter. The password is the only key, so put it in a password manager before you finish the dialog. And keep a copy of the image somewhere else: a corrupted container with no backup is data you have destroyed, not protected.

You can also create one from the command line, which is easier to script:

hdiutil create -encryption AES-256 -srcfolder ~/Documents/Private \
  -volname Private ~/Private.dmg

Method 2: A Vault App

A disk image is a single file that has to be mounted and unmounted. That is awkward for a folder you edit daily, and it does not sync well — two machines editing the same mounted image is a corruption waiting to happen.

Cryptomator solves the sync case: it keeps an encrypted vault in a normal folder, so a cloud service syncs ciphertext while you work through a mounted view. The provider sees encrypted files, not filenames. That is the property a plain .dmg in a synced folder does not have — there the whole container is re-uploaded on every change.

If what you are protecting is credentials rather than documents, Strongbox is the right shape: a KeePass-compatible vault with local or self-hosted sync. Our guide to local secret managers covers that category.

What This Does Not Protect Against

Encryption at rest protects a file that is not open. Once a vault is mounted or an image is open, anything running on the Mac can read it — including malware. That is why an encrypted folder is not a substitute for the disk being encrypted and the account being locked.

It also does not hide the existence of the container. An observer can see that there is a 2 GB .dmg in your Documents folder. Hiding the contents is what encryption does; hiding that you have something to hide is a different problem.

The Backup Rule

An encrypted container is the one file where a lost password is unrecoverable and a lost copy is unrecoverable. Both failure modes are permanent, and both are prevented the same way: write the password down somewhere that is not the container, and keep a second copy of the image on another disk.

If the folder is part of a larger backup plan, our guide to backing up a Mac to an external drive covers the rest — with the caveat that a backup of an encrypted image is only as useful as the password you kept.