Search "encrypted vault for Mac" and the results mix three different kinds of tool: dedicated vault apps, general file-encryption utilities, and macOS's own built-in options. They solve overlapping but not identical problems, and picking the wrong category is the most common mistake.
This is a practical comparison of the vault apps Mac users actually reach for: what each one really encrypts, what it does if you're forced to open it, and who should pick what.
What actually matters in a Mac vault
Before the tools, the five things that separate a vault you trust with real files from one that's just a folder with a password on it.
1. A named cipher, not just the word "encrypted." Plenty of apps say "military-grade encryption" without saying which algorithm, in what mode, or how the key is derived. AES-256-GCM, named plainly, is the standard worth expecting.
2. Reach beyond the Mac. A vault that only exists on your Mac is a vault you can't check from your phone when you actually need something in it. Cross-platform coverage — genuinely the same vault, not a separate app with a separate password — is the difference that matters most day to day.
3. What happens if you're made to unlock it. A password stops someone who doesn't have it. It does nothing for the situation where someone is standing over you, or has legal power to compel you, and you have to type it anyway. Decoy vaults, duress wipes, and hidden volumes exist specifically for this, and most vault apps have none of them.
4. A viewer that doesn't hand files back to the OS. If opening a photo inside your "secure" vault means Preview opens it and macOS caches a thumbnail, the vault has already leaked outside itself. A built-in viewer that never writes to disk closes that gap.
5. What free actually includes. Some vaults are free with real limits that hold indefinitely. Others are a full-featured trial with a hard deadline. Both are legitimate business models, but they behave very differently once you've moved real files in.
The comparison
| Cipher named | Platforms | Under coercion | Built-in viewer | Free tier | |
|---|---|---|---|---|---|
| Vaultine | AES-256-GCM | Mac, Windows, iPhone, Android | Decoy Vault + Duress Vault | Yes, nothing written to disk | 1 vault, 10 files, no time limit |
| Cryptomator | AES-256 (custom scheme) | Mac, Windows, Linux, iPhone, Android | None built in | No, opens in your normal apps | Desktop free forever; mobile is a 30-day trial |
| NordLocker | AES-256 + RSA-4096 | Mac, Windows, iPhone, Android | None | Limited, cloud-storage focused | Small amount of free storage |
| Folder Lock | Not named | Windows, Mac, Android (iOS separate) | None | Gallery/photo/video viewers | Usable free tier, feature-limited |
| VeraCrypt | AES, Serpent, Twofish, cascades | Mac, Windows, Linux only | Hidden volumes (manual setup) | No, mounts as a virtual disk | Entirely free |
| macOS FileVault / Disk Utility | AES-XTS | Mac only | None | No | Built in, no extra app |
The rest of this post is the detail behind that table.
Vaultine
Built specifically as a vault, not a general encryption utility repurposed into one. Every file is encrypted with AES-256-GCM on the device before it's stored, split and randomised so nothing on disk resembles the original, with the key derived from a 5x5 pattern or PIN that's never stored.
The part that answers "what if I'm forced to open it" is the Decoy Vault, which opens on a second code and shows a vault you stocked in advance with harmless files, and the Duress Vault, which opens on a third code and wipes the real vaults as it does. Photos, videos and PDFs open in a built-in viewer, so nothing is handed to Finder or its thumbnail cache while the vault is locked. The free tier — one vault, up to 10 files — uses the same encryption as paid, with no trial clock. Pro adds unlimited files, multiple vaults, and encrypted Dropbox backup, at $1.99 a month, $14.99 a year, or $39.99 once for lifetime.
Where it's the wrong choice: if you need Linux support or a broader spread of connected cloud providers, it isn't there yet.
Cryptomator
The strongest open-source option here, and a genuinely different design: instead of a self-contained vault, Cryptomator encrypts a folder that lives inside a cloud provider — Dropbox, Google Drive, OneDrive, iCloud Drive, S3 or WebDAV — so the provider only ever sees ciphertext. That's a real, audited promise, and it reaches Linux and more cloud providers than most alternatives.
What it doesn't have is anything built for the coercion scenario — no decoy, no duress code — and its mobile app requires a paid unlock after a 30-day trial, unlike its fully free desktop apps. A closer look at how it compares to Vaultine covers the trade-offs in full, including what its own recent reviewers report about the vault failing to open after updates.
NordLocker
From the team behind NordVPN, NordLocker leans cloud-first: it's as much an encrypted storage service as a vault app, with apps for Mac, Windows, iPhone and Android. Files are locked into "lockers" with AES-256 and RSA-4096, and the free tier includes a small amount of built-in cloud storage, with paid plans scaling storage and device count, billed through Nord's own account portal rather than the App Store.
It's a reasonable pick if you already want cloud backup bundled with your encryption tool. It has no equivalent to a decoy or duress vault, and the viewer experience is built around cloud file management rather than a locked-down in-app preview.
Folder Lock
One of the few in this category that reaches past the phone, with native apps for Windows, Mac and Android and a separate iOS app. It locks and encrypts files and photos and backs them up to Google Drive, Dropbox and OneDrive, though its own listing doesn't name a specific cipher.
Its free tier locks files, photos, videos, notes and cards, with a one-time Unlocked Feature Pack or subscription to remove limits. Recent reviewers most often report lost files after an update or sync, and ads appearing inside an app bought for security — themes covered in more detail in Vaultine vs. Folder Lock.
VeraCrypt
The free, open-source, technically deepest option on this list — the direct successor to TrueCrypt, with a choice of AES, Serpent, Twofish and cascades of the three, and genuine hidden-volume support for plausible deniability. It's also Mac, Windows and Linux desktop only, with no phone app, no built-in viewer, and no recovery path if you forget your password.
It's the right tool if your encrypted volume only ever needs to exist on one desktop machine and you're comfortable with manual setup. The full comparison, including how its hidden volumes stack up against Vaultine's Decoy and Duress vaults, is in Vaultine vs. VeraCrypt.
macOS FileVault and Disk Utility
Worth naming because it's already on your Mac. FileVault encrypts your entire startup disk with AES-XTS, protecting everything if your Mac is off and someone gets the drive. Disk Utility can also make a password-protected encrypted disk image (a .dmg or .sparsebundle) that behaves like its own separate volume, with AES-128 or AES-256 depending on what you choose.
Neither is portable — a FileVault-protected disk isn't readable on a Windows PC, and an encrypted disk image doesn't move to your phone. Neither has a built-in viewer, a decoy mode, or a duress option. They're a reasonable baseline, not a substitute for a vault you actually use day to day.
So which one
If you need the same vault on your Mac and your phone, with a real answer for being forced to unlock it, that's what Vaultine is built for, and the free tier is enough to test the whole workflow first.
If the job is encrypting a shared cloud folder across the widest set of platforms, including Linux, and open source matters to you, Cryptomator is the stronger fit.
If you want cloud storage and encryption bundled together and don't mind a subscription, NordLocker covers that.
If Windows and Android reach matters more than iPhone, Folder Lock is one of the few that gets there, with the trade-offs its own reviewers report.
If you're technical, your files live on one desktop Mac, and you want full control over the cipher, VeraCrypt is free and excellent at exactly that.
If you just want your whole Mac protected at rest and nothing more, FileVault is already there and costs nothing extra — it just isn't a vault for individual files you carry with you.
Getting started
Whichever direction you go, the underlying question is the same: what is this vault protecting you from — a lost laptop, a shared computer, or being made to unlock it in person? That last case is the one most vault apps skip entirely. If it matters to you, our post on Decoy Vault vs. Duress Vault walks through when each one applies, and you can try Vaultine's free tier at vaultine.app.
