How to Encrypt Files on Your Mac (and What AES-256 Means)

Encryption is one of those words that sounds more complicated than it is. Strip away the jargon and it means this: scramble a file so thoroughly that without the right key it is just noise, then unscramble it on demand when you supply the key. This guide explains what that means on a Mac, what the term AES-256 is pointing at, and how to actually encrypt specific files.

What encryption protects against

Encryption answers a specific question: what happens to your files if someone gets the bytes without your permission. A stolen laptop. A lost external drive. A backup that ends up on the wrong machine. A repair technician with the disk in their hands. In all of these cases the person has your files, but if those files are encrypted, having them is useless. They cannot read the contents without the key.

It is worth being clear about what encryption does not do. It does not protect a file that is already open on an unlocked screen. It does not stop someone who knows your password. Encryption is about protecting data at rest, when it is sitting on a disk and not in active use. For the screen-is-unlocked problem, you want an app lock instead, and the two work well together.

What AES-256 actually means

AES stands for the Advanced Encryption Standard, the encryption algorithm adopted by the United States government and now used essentially everywhere, from banking to messaging apps. The 256 refers to the key size, 256 bits.

A 256-bit key means there are roughly 2 to the power of 256 possible keys. That number is so large that trying every one of them, even with every computer on Earth working together for billions of years, is not a realistic attack. When people say something is protected with AES-256, they are saying the encryption itself is not the weak point. The weak point is always the key: your password, where it is stored, and whether you keep it secret.

This is the practical takeaway. You do not need to worry about whether AES-256 is strong enough, it is. You need to worry about choosing a good password and not leaving an unencrypted copy of the file lying around.

FileVault: useful but not enough on its own

macOS ships with FileVault, which encrypts your entire startup disk with AES. You should turn it on. Go to System Settings, Privacy and Security, and enable FileVault if it is not already on.

But FileVault has a limit that people miss. It protects your disk when the Mac is fully powered off or logged out. The moment you log in, the whole disk is decrypted and available, and every file is readable to anyone using your session. FileVault defends against the stolen-laptop scenario brilliantly and does nothing about the borrowed-laptop scenario. For that you need encryption that stays locked while you are logged in.

How to encrypt specific files

When you want particular files protected even while your Mac is on and unlocked, you encrypt them individually or in a dedicated vault rather than relying on the whole-disk approach.

The built-in route is an encrypted disk image through Disk Utility, choosing AES-256 as the encryption and a strong password. We walk through that in how to password protect a folder on your Mac. It works, but it means managing disk images by hand.

A simpler route is a tool that gives you an encrypted folder protected with AES-256 and opened with Touch ID. This is what Cloak does. You drop sensitive files into the vault, it encrypts them with AES-256, and they stay scrambled on disk until you authenticate with your fingerprint. It complements FileVault rather than replacing it: FileVault covers the whole disk when the Mac is off, and the vault keeps your most sensitive files sealed even while you are logged in.

Cloak can now lock a single file in place too, not only a whole folder. Pick the file, and it is encrypted and hidden until you unlock it. See how to lock a file on Mac for the steps.

Habits that matter more than the algorithm

Strong encryption is undone by weak habits. A few that catch people out:

• Duplicate copies. Encrypting a file does nothing if an unencrypted version still sits in Downloads or syncs to the cloud.
• Weak passwords. AES-256 is unbreakable, but a four-character password is not. The key is only as strong as what protects it.
• Trusting “delete.” Moving a file to the Trash does not erase it. The original data can linger until overwritten, so encrypt before you create sensitive files, not after.

Get the habits right and AES-256 does the rest. The math has been doing its job for decades.

If you want files encrypted with AES-256 and unlocked with Touch ID, kept private even while your Mac is on, Cloak handles it locally, with nothing sent to the cloud.