Hide Mac Folders (Encrypted DMG Disk Images)
To protect selected Mac files, place them in a password-encrypted disk image made with Disk Utility. Choose AES-256 when the Macs that need access support it, keep a safe copy of the password, and eject the image when you finish. A discreet filename or location may reduce casual attention, but only encryption protects its contents when the image is closed.
Would you like to keep tax records, identity documents, or work files private without changing how you use the rest of your Mac? An encrypted disk image can help: macOS opens it like a drive after you enter its password. The image file itself remains visible wherever you save it, so treat concealment as a convenience, not a security measure.
Planning — intent, standards, and verified specifications
An encrypted disk image is a file that macOS can mount as a virtual drive. When it is closed, a password is required to access its contents. Plan for what the image will hold, who needs access, and how you will back it up before creating it.
Apple’s Disk Utility offers 128-bit AES and 256-bit AES encryption options for disk images. AES is a widely used encryption standard; the key practical choice is to select a supported option and protect the password. Apple’s macOS security guidance and Disk Utility are the relevant tools for individual Mac users. For organizational storage-encryption planning, NIST SP 800-111 provides guidance on storage encryption.
A disk image is not the same as a hidden folder. Changing a file’s name or location does not encrypt it, and it may still be found through search, backups, or other means. Encryption protects the contents when the image is unmounted, but does not protect files that are open in an unlocked Mac session.
Choose a format for how you work
A read/write image lets you add, edit, and remove files after mounting it. A sparse bundle is a type of image that grows as you add data, up to the maximum capacity you set. The capacity is a limit, not the amount of space it uses right away.
| Need | Suitable choice | Keep in mind |
|---|---|---|
| Edit files inside the image | Read/write image | Leave room on the Mac’s storage for the image and backups. |
| Add files over time | Sparse bundle | Set a realistic maximum and monitor available space. |
| Share across Macs | A format supported by each intended Mac | Test the image on the macOS versions that will use it. |
| Protect files on the startup disk | Encrypted image, with FileVault as a separate layer | FileVault protects the Mac’s startup volume; it does not replace image encryption. |
A fixed-size image reserves its chosen capacity on the host volume. A sparse bundle uses space as data is added, but its maximum size still matters. Neither option removes the need to keep enough free space for normal Mac use and backups. Next step: choose the image type based on editing needs and storage limits.
Access and clearances — survey before creating the image
Before making the image, decide where it will live, how large it needs to be, and who will open it. Check free space and backup plans, and confirm that the intended Macs can open the format. These choices help prevent a password-protected image from becoming hard to use or recover.
Start with a clear estimate of the files you plan to store. Allow for growth, but avoid setting an unnecessarily large maximum. For a sparse bundle, the maximum is its growth limit; it is not the space already occupied. Keep free space available on the Mac and on any storage volume used for backups.
Consider access as carefully as capacity. If several people need the files, decide who should know the password and how you will share it securely. Do not send the password in the same message or channel as the image. Check your organization’s rules before placing work or client data in a personal image.
Create a unique, strong password and keep a recoverable copy in an approved password manager or another secure recovery method. If you lose the password and have no recovery copy, the files may be unrecoverable. Saving the password in Keychain is convenient, but it weakens protection against someone who can use the already-unlocked Mac user account.
Make a quick pre-creation check
- Identify the files and estimate their current size and likely growth.
- Choose a location with enough room for the image and its backup.
- Decide whether you need a read/write image or a sparse bundle.
- Check that the Macs you plan to use can open the chosen image format.
- Set up password recovery outside the image itself.
A common setup is an image in a user’s Documents folder, with a separate encrypted backup stored on another supported destination. This is a practical example, not a rule: choose a location that fits your backup plan and access needs. Next step: confirm the password and recovery copy before you create the image.
Execution — create, populate, and close the image
Disk Utility creates the encrypted image, and Finder lets you use it after mounting. Choose the image’s name, location, capacity, format, and encryption option, then enter its password. Copy files into the mounted image and check them before ejecting it.
- Open Disk Utility. From the menu bar, choose File → New Image → Blank Image.
- Set the image name and choose where to save it. The name and location affect how easily it is noticed, but do not add encryption.
- Enter a capacity suited to the files and expected growth. For a sparse bundle, this is the maximum size it can reach.
- Choose AES-256 if the Macs that need to open the image support it. Disk Utility also offers AES-128. Choose based on compatibility and your security requirements.
- Choose read/write for files you will edit. Choose sparse bundle if you want the image to grow as you add data, up to the limit you set.
- Click Save, then enter the password when prompted. Decide deliberately whether to save it in Keychain. For stronger separation from an unlocked account, do not save it there.
- Once the image mounts, open it in Finder and copy the selected files into it. Wait for copying to finish, then open a few files to confirm they work.
- Eject the image in Finder when you are done. Ejecting unmounts it, so the files are no longer available as an open drive.
The exact labels for image format may vary with macOS versions. If you do not see the option you expect, check Disk Utility’s available choices rather than guessing. Avoid changing the image’s internal files or structure in Finder; use the mounted image to manage its contents.
| Example use | Image choice | Practical check |
|---|---|---|
| A small set of records that may change | Read/write | Confirm there is enough room for the image and backup. |
| A collection that will grow over time | Sparse bundle | Check available storage and the configured maximum. |
| Files opened on more than one Mac | Format and encryption supported by all target Macs | Test opening, editing, and ejecting on each Mac before relying on it. |
Next step: mount the image, verify the copied files, and eject it before leaving the Mac unattended.
Verification — test protection and maintain it
Verification checks that the image prompts for a password, opens correctly, and can be restored from backup. Test these steps before relying on it for important files. Remember that an image protects data while unmounted; it does not protect files from someone using an already-unlocked account while the image is open.
After ejecting the image, open it again from its saved location. Confirm that macOS asks for authentication, enter the password, and check that the intended files are present. If you chose to save the password in Keychain, the prompt may not behave as expected; review that choice and test access under the conditions you need.
When the image is mounted, its contents are available in decrypted form to that logged-in session. A person with access to the unlocked account, or malware running in that session, may be able to access open files. Eject the image when finished and lock your Mac when stepping away. Encryption is one layer, not a defense against every kind of access.
Back up the encrypted image and test that you can restore and open the backup. Keep the password available independently of the Mac and the image. Do not rely on a password saved only in that Mac’s Keychain as the sole recovery route. FileVault can protect the startup volume at rest, but it is complementary to the separate encrypted image.
I recommend treating the first setup as a rehearsal: create the image with noncritical files, test reopening it, and test the backup before moving important records. That simple check can expose a forgotten password, an unsupported format, or a backup that did not copy as expected. Next step: schedule a periodic restore test and confirm the image is ejected whenever it is not in use.
Conclusion and FAQ
An encrypted disk image gives selected files a password gate when the image is closed. Use Disk Utility, choose a suitable format and AES option, store the password safely, and test both access and backup recovery. A hidden-looking filename is not a security feature, and an open image is not protected from use by an already-unlocked session.
What does an encrypted Mac disk image do?
It stores files in a disk image that macOS requires a password to open. When mounted, it appears as a drive; when ejected, its contents are encrypted at rest.
Does hiding the image file encrypt it?
No. A less noticeable name or location does not encrypt the image or prevent it from being found. Use Disk Utility’s encryption option to protect its contents.
Where is the option to create one?
Open Disk Utility, then choose File → New Image → Blank Image. Set the image details and select an encryption option before saving.
Should I choose AES-128 or AES-256?
Disk Utility offers both. Choose AES-256 if the Macs that need access support it; consider compatibility and your security requirements when choosing.
What is a sparse bundle?
A sparse bundle is a disk image that grows as you add data, up to the maximum capacity you set. Its maximum capacity is not its current storage use.
Should I save the password in Keychain?
Keychain can make access easier, but someone with access to your unlocked Mac user account may also gain easier access. Keep a separate recovery copy if you do not save it there.
What happens if I forget the password?
Without a working password or recovery copy, you may be unable to access the image’s files. Keep the password in an approved password manager or another secure recovery method.
Is FileVault enough?
FileVault protects the Mac’s startup volume at rest. It is useful alongside an encrypted disk image, but it does not replace the image’s separate password protection.
Does the image protect files while it is open?
No. When mounted, files are available in decrypted form to the logged-in session. Eject the image when you finish and lock the Mac when you step away.
How do I know the image works?
Eject it, reopen it, confirm the password behavior, and check the files after mounting. Also test restoring a backup and opening the restored image.
(This article was written by one of our staff writers, Richard Montclair. Visit our Meet the Team page.)
