How to Lock a File on Your Mac

You have one file you do not want anyone else opening. A contract, a tax return, a spreadsheet of passwords, a photo. macOS gives you a strong login password and FileVault for the whole disk, but nothing for that single file. Right-click it and there is no Lock option. The lock checkbox in Get Info only stops the file from being edited or deleted. It does not stop anyone from reading it.

Here are the ways that actually work, in plain terms, with the catch for each.

Option 1: The app’s own password

Some apps can protect their own documents. Pages, Numbers, and Keynote have File, Set Password. Microsoft Word and Excel have a password option under File, Protect. Preview can add a password to a PDF when you export it.

This is the right answer when the file lives in one of those apps and you only ever open it there. The limits are real, though. It only covers that file type, the password is separate from everything else on your Mac, and a file that is “protected” in Word is still visible in Finder with its real name for anyone to see. We go through this route in more detail in how to password protect a document on your Mac.

Option 2: An encrypted disk image

The built-in route for any file type is Disk Utility.

1. Put the file in a folder by itself.
2. Open Disk Utility, choose File, New Image, Image from Folder, and pick that folder.
3. Set Encryption to 256-bit AES and choose a password. Untick “Remember password in my keychain” or it will never ask again.
4. Delete the original file once you have confirmed the image opens.

It is secure and it is free. It is also clumsy for a single file. You now mount a disk, open the file from inside it, and remember to eject it afterwards. Leave it mounted and the protection is gone for anyone sitting at your Mac.

Option 3: A password protected zip

For a file you want to tuck away and rarely open, Terminal can make an encrypted archive:

zip -e protected.zip "tax return.pdf"

Type a password twice and you get a zip that asks for it on opening. Fine for cold storage. Not fine for a file you edit, because you have to unzip, edit, re-zip and delete the plain copy every time, and zip encryption is weaker than AES.

Option 4: Lock the file in place

The simplest day to day option is a tool that encrypts the file where it sits and puts it back when you ask. That is what Cloak does:

1. Open Cloak and press + under Locked folders & files.
2. Pick the file.

The file is encrypted with AES-256 and disappears from Finder and Spotlight. To use it again, press Unlock in Cloak, confirm with Touch ID or your password, and the file is back exactly where it was, unchanged. Lock it again when you are done. Nothing is mounted and there is no second copy to remember to delete.

If someone else tries to unlock it and gets the password wrong, Cloak can take their photo and show you next time you open it. That is off by default and you turn it on in Settings.

Which one to pick

• A Pages, Word, or PDF document you only open in that app: use the app’s own password.
• A file you almost never open: a password protected zip is enough.
• Any file type, free, and you do not mind the ritual: a Disk Utility image.
• A file you actually use and want locked between uses, opened with a fingerprint: lock it in place with a vault.

Two mistakes people make

Leaving the original behind. Every method above except the last one creates a protected copy. If the plain file is still sitting in Downloads, nothing is protected. Check, then delete it, then empty the Trash.

Forgetting cloud sync. If the file’s folder syncs to iCloud Drive, Dropbox, or Google Drive, the plain version may already be on another device or in the cloud. Protect the file before it syncs, or move it out of a synced folder first.

If you want to lock a file with Touch ID and AES-256 without managing disk images, Cloak does it locally on your Mac, with a one-time purchase and nothing sent to the cloud.