How to Lock a Folder on Mac: Complete 2026 Security Guide
· lock folder mac, mac folder encryption, password protect mac, disk utility encryption, macos security
Most advice on how to lock a folder on Mac gets one thing wrong. Finder's Locked checkbox does not password-protect a folder, and it doesn't encrypt anything. It mainly helps stop accidental edits or deletion, while the folder still lives in the same place and remains accessible to anyone with enough account privileges, which is why Apple frames it as a permissions safeguard rather than real protection. Apple Support's guidance on locking documents makes that distinction clear, and it's the reason serious Mac admins steer people toward encrypted disk images instead of the checkbox. If you care about actual confidentiality, the question isn't whether a folder looks locked, it's whether its contents are encrypted.
Table of Contents
- Why the Finder Locked Checkbox Is Not Real Protection
- Creating an Encrypted Disk Image with Disk Utility
- Choosing Between 128-bit and 256-bit AES Encryption
- Using Terminal Commands for Faster Encryption Workflows
- Modern macOS Compatibility and Portable Vault Strategies
- Matching Protection Methods to Real-World Scenarios
Why the Finder Locked Checkbox Is Not Real Protection
A lot of Mac users discover the Locked checkbox in Finder's Get Info window and assume they've created a password. They haven't. Apple describes this as a way to protect a document by changing how it can be modified, not by encrypting its contents, which means it's closer to a guardrail than a vault.
What the checkbox actually does
The practical effect is simple. A locked item is harder to edit or delete by accident, but it still exists as a normal file or folder on disk. If someone already has sufficient access to the account or storage location, the checkbox doesn't stop them from opening the contents.
That's why the shortcut feels secure without being secure. It can help in a shared home account, or when you're trying to keep from overwriting a folder by mistake, but it does nothing to meaningfully hide sensitive material from another user with access to the Mac. Apple's own support guidance points people toward permission changes for folders and disks, not a universal Finder password lock, which tells you where the actual boundary is.
Practical rule: if the goal is confidentiality, the Locked checkbox is the wrong tool.
If you're tightening privacy settings across the machine, it helps to think in layers. The same basic logic applies to Mac privacy settings, where convenience controls and real access controls are not the same thing.
What real protection looks like
Real protection on macOS means encryption. Major Mac guides consistently recommend encrypted disk images because they change the folder into a password-protected container instead of merely marking it as not to be edited. That distinction matters more than the interface suggests.
If you only need to prevent accidental changes, the checkbox is fine. If you need to keep other people out, you want a password gate that blocks access to the contents. On Mac, that means leaving the Finder checkbox behind and using a container that can't be read until it's mounted with the right password.
Creating an Encrypted Disk Image with Disk Utility
The standard built-in way to secure a folder on macOS is to turn it into an encrypted disk image. Disk Utility does this cleanly, and the workflow hasn't changed much over the years: open Disk Utility, choose File > New Image > Image from Folder, pick the folder, set encryption, choose a password, and save the resulting .dmg file.
The workflow that actually protects contents
Start by opening Disk Utility from Applications > Utilities. Then choose File > New Image > Image from Folder and select the folder you want to secure. Disk Utility will ask for encryption settings, and the security decision happens.
After you choose an encryption level and set a password, save the disk image as a .dmg file. Once created, it behaves like a normal mounted volume after you enter the password. That's the important shift, the folder isn't staying “locked” in place. It's being converted into an encrypted container whose contents stay unreadable until the image is opened.
Why image format matters
Apple Community guidance emphasizes setting the image format to Read/Write if you want to keep adding or removing files after creation. That detail gets skipped in a lot of casual how-to posts, but it matters if you plan to use the container as an active working vault instead of a one-time archive. A read-only image is awkward for ongoing work, and a properly set read/write image saves you from recreating the container every time the contents change.
Create the container once, then treat it like a small encrypted volume you mount when needed and eject when you're done.
For readers trying to clean up storage while keeping sensitive material separate, it's useful to think of this alongside broader folder management. Cleaning up Mac storage and securing sensitive files often happen together, and encrypted containers make that workflow much easier to keep organized.
Why this remains the native answer
Apple's own guidance points toward permissions changes for folders and disks, but that doesn't replace encryption. Disk Utility is the native path that meaningfully restricts access to the contents without installing anything extra. For those who want real confidentiality on a Mac, this is the method that earns the word “locked.”
Choosing Between 128-bit and 256-bit AES Encryption
When Disk Utility asks you to choose an encryption level, bigger isn't automatically the right answer. The choice is really about balancing security strength against performance and daily convenience. Guides consistently cite 128-bit AES and 256-bit AES as the standard options, and that's the decision you need to make with your actual use case in mind.
| AES Encryption Level Compared | Security Strength | Performance Impact | Best Use Cases |
|---|---|---|---|
| 128-bit AES | Strong enough for everyday privacy | Easier on performance | Personal photos, routine documents, casual privacy on a shared Mac |
| 256-bit AES | Stronger protection | Slower than 128-bit AES | Financial records, confidential work files, high-sensitivity data |
When 256-bit AES is worth it
Choose AES-256 when the folder holds material that would cause real harm if exposed. That includes financial documents, legal files, confidential client work, or anything tied to a regulated workflow. Independent Mac guides describe 256-bit encryption as more secure, and they also note that it comes with a speed tradeoff.
When 128-bit AES is enough
For everyday use, 128-bit AES is often the more practical choice. If you're mainly keeping family photos, ordinary paperwork, or private notes away from casual access on a household machine, it gives you genuine encryption without making the container feel heavier than it needs to be. In day-to-day work, that convenience matters because the best protection is the one you'll keep using.
The mistake I see most often is people choosing the strongest option by reflex, then resenting the friction and abandoning the workflow. That's bad security. A slightly lighter container that you use consistently beats a stronger one that sits unopened because it feels annoying to mount.
Pick the level that matches the damage you're trying to prevent, not the one that sounds most impressive.
Using Terminal Commands for Faster Encryption Workflows
For power users, the GUI path through Disk Utility can feel slower than it needs to be. That's where Terminal comes in, because macOS exposes the same encrypted-image idea through hdiutil, which lets you create containers without clicking through Finder and menus every time. The command-line route is especially useful when you're working on multiple Macs or need the process to fit into a repeatable workflow.
A practical hdiutil example
A common pattern looks like this:
hdiutil create -encryption AES-256 -stdinpass -srcfolder ~/Documents/Confidential ~/Desktop/SecureFolder.dmg
Here's what the flags do. -encryption AES-256 chooses the stronger encryption level, -stdinpass lets the command read the password instead of hardcoding it, and -srcfolder points the command at the folder you want to convert into a disk image. The last path tells macOS where to save the resulting .dmg file.
If you manage a fleet or regularly repeat the same setup, that command can be wrapped into scripts and called as part of a bigger deployment or backup process. That's a real advantage over the GUI, which is fine for one-off tasks but not ideal for routine administration.
When Terminal makes sense
Use Terminal when you want speed, consistency, or automation. Use Disk Utility when you want a visual, low-risk path for a single folder. Both work on modern Macs, including Apple silicon and Intel systems, but the better choice depends on how often you're doing it and how standardized your process needs to be.
If you're also thinking about quick archive protection for files you don't need to reopen often, a passworded archive can be simpler, and password-protected ZIP workflows on Mac are often used for that narrower job. For an always-mountable confidential workspace, though, the encrypted disk image is still the more flexible native option.
Modern macOS Compatibility and Portable Vault Strategies
A common worry is whether the old encrypted-image method still works on modern macOS releases. In practice, the workflow remains familiar, and the more relevant question is how to keep the container portable without breaking access later. The important thing to remember is that the encrypted folder is no longer really a folder at all, it's a file-based vault.
Why portability changes the conversation
Because the vault is a file, you can move it, copy it, back it up, or store it on an external drive. That's useful, but it also changes how you should think about sync and recovery. If you store the .dmg in cloud storage or back it up with Time Machine, the image file is what gets copied, not the unencrypted contents.
That's a good thing from a privacy standpoint, but it means you need to be deliberate about where the image lives and how you access it. If you rename it, move it between machines, or restore it after a hardware change, the password still controls access. The container's location changes, the encrypted contents don't.
What matters on newer Macs
Mainstream guides still answer the basic creation steps, but they often skip the practical questions that come up on current systems. Users want to know whether the container will open on newer macOS versions, whether Apple silicon changes anything, and how to keep the vault usable after updates. The native image workflow remains the same idea, so the issue is operational discipline, not compatibility drama.
A solid portable strategy is to treat the image like a sealed document archive. Keep a backup copy, mount it only when you need it, and eject it when you're finished. If you use cloud sync, remember that the sync target is the encrypted container, not the raw folder contents, which is exactly what you want.
The safest portable vault is the one you can restore without guessing where the plain files went.
Matching Protection Methods to Real-World Scenarios
Not every folder deserves the same treatment. If you apply heavy encryption to everything, you create friction, and friction pushes people toward shortcuts. The smarter move is to match the protection method to the actual risk.
Quick privacy
Use the Finder Locked checkbox when the goal is to avoid accidental edits or deletion. That's its real purpose, and it works well enough for important but non-sensitive files that you just don't want changed by mistake.
Daily security
Use an encrypted disk image for most personal confidentiality needs. This is the right fit for family records, work drafts, private paperwork, and any folder you want to keep away from other users who might otherwise have account-level access. If you need a built-in option that requires a password, this is the one I recommend most often.
High security
For more demanding environments, a third-party encrypted volume tool can make sense when you need features outside Apple's native workflow, especially in professional or compliance-driven settings. Tools like VeraCrypt are often used for that kind of container-based protection, though that moves you beyond Apple's built-in path. Crufti is a separate example of a privacy-first Mac utility, but it's for removing app leftovers, not folder encryption, so it doesn't replace any of these protection methods.
The key is honesty about threat models. If the danger is a family member opening the wrong folder, encryption is enough. If the danger is accidental edits, the Locked checkbox may be all you need. If the folder holds sensitive business data, use a real encrypted container and stop pretending a visual badge is security.
If you want more Mac privacy and file-handling guidance that's written for actual workflows, visit Crufti and explore the Mac-focused articles there. Crufti's local-only approach to cleaning app leftovers pairs well with a careful security setup, especially if you're trying to keep sensitive files organized without adding clutter or telemetry.