macOS password-protects folder contents by storing them in an encrypted Disk Utility disk image that asks for a password when opened.
Changing Finder permissions can restrict who may read or edit a folder, but it does not give the folder its own password prompt. Learning how to password-protect a folder on Mac starts in Disk Utility, which places the folder’s contents inside an encrypted disk image.
The result is usually a .dmg file. Double-clicking the encrypted image asks for the image password, and after it mounts, Finder treats it like a local volume. Ejecting that volume closes access again. The original folder stays separate, so do not remove it until the encrypted copy has been opened and checked.
How Does Folder Password Protection Work On Mac?
Disk Utility protects the files by encrypting a disk image rather than adding a password field to an ordinary Finder folder. Apple Platform Security lists 128-bit and 256-bit AES encryption for encrypted disk images.
A mounted image behaves like a drive in Finder: you can open files inside it, and some image formats let you add, remove, or edit files. The protection matters again after you eject the mounted image, because the encrypted file then needs its password before macOS can mount it.
Password-Protect A Folder On Mac: The Disk Utility Steps
An existing folder can be copied into an encrypted image directly from Disk Utility. The current Disk Utility procedure uses File > New Image > Image from Folder, followed by encryption and image-format choices.
- Open Disk Utility. On current macOS, open the Apps view from the Dock, search for Disk Utility, then open the app.
- Choose File > New Image > Image from Folder.
- Select the folder you want to protect, then click Open.
- Enter a filename for the disk image and choose where to save it.
- Open the Encryption menu and select an AES option. Use 256-bit AES for sensitive files, then enter and verify the password when macOS prompts you.
- Open Image Format. Pick RAW Image for an image you plan to work inside later; pick Read-only Compressed for an archive.
- Click Save, then click Done after Disk Utility finishes.
Disk Utility saves the image where you chose and mounts it on the desktop and in the Finder sidebar. That mounted volume confirms the image was created; eject it before testing the password.
The Original Folder Is Still Unencrypted
Creating an encrypted disk image does not convert the source folder in place. Disk Utility writes a separate image, so the files you started with remain accessible in the original folder until you remove that copy.
Test the image before deleting anything: eject the mounted volume, reopen the disk-image file with its password, and check several files. Only after the protected copy passes that test should the original folder be removed if you want the encrypted image to be the only working copy.
Choose The Image Settings For The Way You Work
Encryption controls who can open the image, while Image Format controls what you can do after it opens. The choices below separate editable storage from archive formats so you do not discover a limitation after moving files.
| Disk Utility Choice | What It Does | Good Fit |
|---|---|---|
| 256-bit AES encryption | Encrypts the image with 256-bit AES | Sensitive files and long-term private storage |
| 128-bit AES encryption | Encrypts the image with 128-bit AES | An Apple-supported encrypted image with 128-bit AES |
| Read-only image (UDRO) | Cannot be changed after creation | Records you want left unchanged |
| Read-only Compressed (ULFO) | Stores a read-only image in compressed form | Archives that do not need in-place edits |
| RAW Image | Allows files to be added, removed, or edited | An existing folder you still need to work in |
| DVD/CD master | Creates a master-style image intended for other disk-image workflows | Special disk-copy needs, not normal private-folder use |
| Hybrid image (HFS+/ISO/UDF) | Combines multiple file-system standards in one image | Special compatibility workflows |
| Image password | Required to open the encrypted image | Every encrypted folder image; Apple warns there is no access if it is forgotten |
Apple’s current Disk Utility disk-image instructions document the same Image from Folder path, the encryption control, and the current image-format choices. Apple also warns that a forgotten disk-image password blocks access to the files inside.
Use A Secure Blank Image For Files You Change Often
A blank encrypted image is a better fit when the protected storage will grow and change over time. Apple documents a read/write secure-image setup that lets you set the mounted volume’s capacity when you create it and copy files into it as you work.
- In Disk Utility, choose File > New Image > Blank Image.
- Enter the disk-image filename, save location, volume name, and a size large enough for the files you expect to store.
- For a current Mac using macOS 10.13 or later, choose APFS or APFS (Case-sensitive) from Format.
- Choose an option from Encryption, enter the password twice, then click Choose.
- Leave Partitions at Single partition – GUID Partition Map and set Image Format to read/write disk image.
- Click Save, then Done. Copy the private files into the mounted image in Finder.
The new volume appears on the desktop and in the Finder sidebar after creation. Once the files are inside, eject the volume; the disk-image file remains in Finder and requires the image password the next time it is mounted.
Does FileVault Replace A Folder Password?
FileVault does not give one folder a separate password. FileVault protects the Mac startup disk and ties access to authorized login credentials, so it solves a different problem from an encrypted disk image.
Use FileVault when the concern is someone getting the Mac or its internal storage while it is locked or powered off. Use an encrypted disk image when a particular set of files needs its own password boundary, including while those files sit inside your normal user account.
Match The Protection Method To The Situation
The same macOS security feature is not ideal for every storage job. A folder image, a read/write vault, FileVault, and full-device encryption each protect a different boundary.
| What You Need | Built-In Choice | Main Limitation |
|---|---|---|
| Protect one existing folder | Encrypted Image from Folder | The original folder remains separate until you remove it |
| Keep adding and editing private files | Encrypted blank image with read/write disk image | It starts with the capacity you set during creation |
| Archive files without changing them | Encrypted Read-only Compressed image | The mounted image is not editable |
| Protect the Mac startup disk | FileVault | Uses account-level access, not a separate folder password |
| Protect an entire external drive | Encrypted storage-device format | Disk Utility’s format-and-encrypt procedure erases the device first |
| Limit another local account’s folder access | Finder permissions | Permissions are not a separate encryption password |
Open, Work, And Lock The Image Again
An encrypted image is protected only while it is not mounted. Double-click the disk-image file, enter its password, and macOS mounts the volume so the files inside can be used in Finder.
When you finish, eject the mounted volume from the Finder sidebar. Apple warns that while a secure disk image remains mounted, anyone who already has access to that Mac session can use the documents inside it. Ejecting the volume is what puts the password barrier back in place.
Lock It, Test It, Then Remove The Plain Copy
The final check is about avoiding the easiest mistake: keeping an encrypted image beside an unencrypted source folder. Test the protected copy before removing anything.
- Create the encrypted image from the folder, using 256-bit AES for sensitive files.
- Eject the mounted image as soon as Disk Utility finishes.
- Double-click the disk-image file and confirm that macOS asks for the password.
- Enter the password and verify that the files you need are present and open correctly.
- Eject the image again so it returns to its password-protected state.
- If the unencrypted folder should be gone, move it to the Trash, then choose Finder > Empty Trash after the test.
- Store the disk-image password somewhere you can recover it; Disk Utility cannot open the image for you if that password is lost.
References & Sources
- Apple.“Create a disk image using Disk Utility on Mac”Documents encrypted folder images, secure blank images, current image formats, and the password-loss warning.