How to password protect a folder on Mac

There is no right-click "password protect" in macOS. Finder has no such command, and it never has. What macOS gives you instead is Disk Utility, which can turn a folder into an encrypted disk image — a single file that asks for a password and then mounts as a drive. It works, it is genuinely strong encryption, and it takes about two minutes.

It also has three costs that no one mentions until you have lived with it for a week. This page covers the method first, then the costs, so you can decide which one you are actually signing up for.

The short answer

Built into macOS

Disk Utility → an encrypted disk image (.dmg). Free, AES-256, already on your Mac.

Its catch

Fixed size, a visible .dmg, and remembering to eject it is on you every time.

Subfile

Unlock and browse inside the app — no volume is mounted. No size limit, and it can hide inside a file you already have.

Its trade-off

$29, and a third-party app rather than something Apple already shipped you.

If you want one folder locked and you will open it occasionally, the disk image is the right tool and you can stop reading after the next section. If this is something you will use every day, the section on what the disk image costs you is the part that matters.

Method 1 — an encrypted disk image, step by step

1. 01Put everything you want protected into one folder.
2. 02Open Disk Utility. It is in Applications → Utilities, or press Command-Space and type "Disk Utility".
3. 03In the menu bar choose File → New Image → Image from Folder.
4. 04Select your folder and click Choose.
5. 05Give the image a name and pick where to save it.
6. 06Set Encryption to 256-bit AES.
7. 07Enter a password twice. Uncheck "Remember password in my keychain" — leaving it checked means anyone already logged into your Mac can open the image without the password.
8. 08Set Image Format to "read/write" so you can add files later. "Compressed" is smaller but read-only.
9. 09Click Save. When it finishes, you have a .dmg file.
10. 10Delete the original folder — the disk image is a copy, not a move. Until you delete the original, nothing is protected.

To use it: double-click the .dmg, enter the password, and it mounts as a drive in Finder. Work in it normally. When you are done, eject it — right-click the drive in the sidebar and choose Eject, or drag it to the Bin. Until you eject, it is open, and anyone who walks up to your unlocked Mac can read it.

AES-256 with a strong password is not the weak point here. If you pick a real password and do not store it in the keychain, the file itself is not getting opened. Everything below is about living with the format, not about the encryption.

What the disk image actually costs you

Three things, in the order you will hit them.

• The size is fixed at creation. A read/write image is the size you made it, full or empty. Run out of room and you create a second, larger image and copy everything across. Choosing "sparse bundle" instead lets it grow, but it does not shrink when you delete files, and it stores your data as thousands of small band files rather than one.
• It never forgets to stay open. There is no auto-lock. If you mount an image in the morning and close your laptop at a café, it is still mounted when you open the lid. Ejecting is entirely on you, every single time.
• It announces itself. A file called Documents.dmg sitting on your Desktop is unmistakably an encrypted container. That is fine if the only thing you are worried about is a stranger who finds the laptop. It is not fine if the point was for the data not to look interesting in the first place.

There is a fourth if you use cloud storage: sparse bundles and cloud sync interact badly. Because the format writes many small band files, a one-line edit inside the image can dirty dozens of them, and two machines syncing the same bundle can corrupt it. iCloud Drive, Dropbox and Google Drive all have variations of this failure.

Method 2 — an encrypted ZIP, and why to skip it

You will find advice to run this in Terminal:

It does prompt for a password, and it does produce a file you cannot casually open. But the zip tool shipped with macOS uses the legacy ZipCrypto cipher, not AES. ZipCrypto has known practical attacks and should not be treated as protection for anything that matters.

A second problem holds even for AES zip files made with other tools: the ZIP format encrypts the contents of each file but leaves the file listing readable. Anyone with the archive can see every filename and size without the password. If your folder contains passport-scan.jpg or resignation-letter.docx, the archive has already said most of what an onlooker wanted to know.

What about hiding the folder instead?

Renaming a folder to start with a dot, or running chflags hidden on it, removes it from Finder. This is not protection. Pressing Command-Shift-Period in any Finder window reveals every hidden item instantly, and it is one of the first things anyone technical does. Hiding without encryption buys you nothing against a person who is actually looking.

What about FileVault?

Turn FileVault on. It is the single best security setting on a Mac and it takes one click in System Settings → Privacy & Security. But it solves a different problem: it encrypts the whole disk while the Mac is off, so a stolen laptop is a brick.

Once you have logged in, FileVault is transparent. Every file on the disk is readable to anything running as you — every app, every process, and anyone sitting at your unlocked Mac. FileVault protects against theft. It does nothing about the person who borrows your laptop for five minutes. Those are separate jobs and you want both.

Where Subfile fits

Subfile takes the same job and does it differently. There is no disk image and no mounted volume: you unlock the vault and browse it inside the app, as folders and files. That one difference removes all three costs.

• No fixed size. The vault grows as you add to it, with no bands and no second copy to migrate to.
• It closes on its own. You do not have to remember to shut it, the way you have to remember to eject an image.
• It does not have to look like a vault. Keep it as a standalone container, or write it inside a file you already have — a video, a photo, an audio file. That file still plays and still opens as what it is.

The encryption is XChaCha20-Poly1305 with Argon2id key derivation, both standard and well reviewed, and the container format is documented so your data is never locked to one app. Nothing is installed into the system: no kernel extension, no macFUSE, and no volume appearing in Finder that you then have to remember to eject.

It is $29 once. There is no subscription and no account, and it never makes a network request — you can turn networking off entirely and every feature still works.

Which one should you use

One folder, rarely opened

Disk Utility. It is free and it is enough.

Daily use

No size ceiling and nothing to remember to eject.

On a shared Mac

The risk is the unlocked screen, not the file at rest.

Should not look notable

A carrier file rather than a .dmg on the Desktop.

Laptop theft

FileVault, whichever of the above you also use.

Whatever you pick, two things stay true. Encryption is only as good as the password in front of it, so use a long one you have not used elsewhere. And an unlocked vault is an open vault — whatever is on screen is decrypted, so lock it when you step away.