Can I encrypt just one folder on a Mac without installing anything?

Yes. macOS's built-in Disk Utility can create an encrypted disk image from an existing folder, using AES-128 or AES-256, with no third-party software required. It's a real, genuinely-encrypted container, not just a hidden or password-protected folder.

Does FileVault encrypt individual folders?

No. FileVault encrypts the entire startup disk as one unit, protecting everything at rest while the Mac is powered off or locked. It doesn't let you encrypt a single folder separately, and once you're logged in, FileVault-protected files are fully readable, since the whole disk decrypts together at login, not folder by folder.

What's the difference between encrypting a folder and encrypting a whole disk?

Whole-disk encryption (FileVault) protects data at rest, when the Mac is off or locked, but everything opens normally once you're logged in. Folder-level encryption, whether via a Disk Utility encrypted disk image or a dedicated vault app, adds a second, separate lock that stays shut even while you're logged into macOS normally, which matters if the login itself isn't the only thing you want to protect against.

Is a Disk Utility encrypted disk image as secure as a dedicated vault app?

The encryption itself, AES-128 or AES-256, is equally real either way. What a dedicated vault app adds isn't stronger math, it's usability and extra security features: a proper unlock flow instead of a password prompt buried in Disk Utility, a built-in file viewer, and features like a Decoy Vault or Duress Vault that a plain encrypted disk image has no equivalent for.

Is a Mac's built-in encryption enough for sensitive files?

For many people, FileVault plus a Disk Utility encrypted image for anything especially sensitive is a genuinely solid setup, and it costs nothing beyond time. Where it falls short is convenience across devices (an encrypted .dmg doesn't have a matching mobile app) and situational features like plausible deniability, which is where a purpose-built vault app becomes worth the tradeoff instead of a limitation.

How to Encrypt a Folder on Mac (Built-In vs. a Vault)

You don't need a third-party app to encrypt a folder on a Mac; macOS has had the tools built in for years. What it doesn't have is a convenient way to do it, or an answer for a few situations that a plain encrypted folder can't cover. Here's the actual built-in method, and where it runs out.

Option 1: FileVault (Whole Disk, Not a Folder)

FileVault, found in System Settings → Privacy & Security, encrypts the entire startup disk using XTS-AES-128 encryption. It's a strong, well-tested feature and it should be turned on regardless of anything else in this guide; it's the thing standing between a stolen, powered-off MacBook and a drive a thief can just read (see What Happens to Your Data When Your Laptop Gets Stolen for what that gap actually looks like).

The catch for this specific guide: FileVault doesn't do folders. It encrypts everything or nothing, as a single startup-disk-wide operation, and it only actually protects data while the Mac is off or hasn't been unlocked yet. Once you're logged in normally, FileVault-protected files are just... files. Fully readable, because the whole disk decrypted together the moment you logged in.

Option 2: An Encrypted Disk Image via Disk Utility

For folder-level encryption specifically, macOS's built-in Disk Utility can do it, no extra software needed:

Open Disk Utility (Applications → Utilities).
From the menu bar, choose File → New Image → Image from Folder…
Select the folder you want to encrypt.
In the encryption dropdown, choose 128-bit AES encryption or 256-bit AES encryption (slower to create, more resistant to brute force).
Set a password when prompted, and save the resulting .dmg file.
The original unencrypted folder still exists separately; move it to the Trash and empty it once you've confirmed the encrypted image opens and contains everything, so an unencrypted copy isn't sitting next to the encrypted one.

The result is a genuine encrypted container: double-click it, enter the password, and it mounts like a drive; without the password, its contents are unreadable ciphertext, the same category of protection described in AES-256 Explained Simply. This is real encryption, not a hidden folder or a locked-looking icon.

Where the Built-In Method Runs Out

The Disk Utility method works, but it has some rough edges worth knowing before relying on it:

No mobile access. A .dmg file doesn't open on an iPhone or Android device. If the files need to be reachable away from that specific Mac, this method doesn't help.
No recovery beyond the password. Forget the disk image's password and there's no recovery phrase, no backup mechanism, just the same password prompt indefinitely.
Manual cleanup risk. Step 6 above matters: it's easy to encrypt a copy and forget to securely delete the original, leaving an unencrypted version sitting right next to the encrypted one.
No situational features. There's no equivalent to a decoy vault for a moment when you'd rather show something harmless than refuse to unlock anything at all.
Single point of entry per image. Managing separate encrypted images for separate categories of files (say, financial documents vs. ID scans) means juggling multiple .dmg files and passwords by hand.

None of this makes the built-in method bad; it's genuinely solid for a one-off, Mac-only need. It just doesn't scale well past that.

When a Dedicated Vault App Is Worth It Instead

A purpose-built vault app like Vaultine uses the same category of encryption (AES-256, generated on-device) but wraps it in a system built for ongoing use rather than a one-time export: a proper unlock screen with its own PIN separate from your Mac login, a built-in viewer so files don't need to be extracted to be checked, the same vault reachable on iPhone, Android, and Windows too, and a Decoy Vault and Duress Vault for situations where being asked to unlock something is itself the risk.

The tradeoff is honest: Disk Utility is free and already on your Mac; a dedicated vault app is a separate purchase. For a single sensitive folder you'll access once and forget about, Disk Utility is genuinely fine. For files you're organizing and opening regularly, want reachable from more than one device, or want protected by more than "know the password," a dedicated vault earns its keep. (See Best Encrypted Vault for Mac in 2026 for how several dedicated options, Vaultine included, compare on that front.)

The Short Version

Turn on FileVault regardless; it's free, built-in, and protects the whole disk when the Mac is off. For a specific folder you want locked even while you're logged in, Disk Utility's encrypted disk image is a real, no-cost option using the same AES encryption a paid app would use. Where it runs out is convenience and cross-device access, which is the actual gap a dedicated vault app fills, not a stronger lock, just a better-built one.

Try the dedicated version, 10 files free, at vaultine.app.