Some of the links in this post are affiliate links, which means I may earn a small commission if you choose to make a purchase at no extra cost to you. As an Amazon Associate, I earn from qualifying purchases. Read my full Ethics & Affiliate Relationship Disclaimer.
If you have an external SSD you want to lock down so nobody can plug it in and read your files, macOS can do it. The usual advice is that you have to fully format and erase the drive to add a password, but there is a Finder trick that encrypts the drive in place without deleting anything. This guide walks through the exact steps, and it covers the two caveats you need to understand before you rely on it.
- Caveat 1: it only locks when the drive is unmounted
- Caveat 2: old deleted files are not fully protected
- Check the drive format first (APFS or Mac OS Extended)
- How to encrypt the drive in Finder
- When the encryption actually kicks in
- Save to keychain: should you?
- Using the encrypted drive day to day
- How to remove the encryption
- Lose the password, lose the data
- For true data wiping, use Disk Utility instead
- Who this method is actually for
Caveat 1: it only locks when the drive is unmounted
This encryption locks the drive when it is unmounted from your Mac, or when the computer is off and locked. It does not protect your files while the drive is mounted and your Mac is unlocked. So if someone is sitting at your unlocked machine with the drive plugged in, the files are readable. The lock kicks in once the drive is ejected or the computer is powered down.
Caveat 2: old deleted files are not fully protected
Some SSD recovery software can pull up files that were already on the drive before you turned on Finder encryption. Finder encryption protects what is currently readable on the volume, but it does not guarantee that old file remnants sitting in previously used space are unrecoverable.
The way to think about it: this is a lock to keep people out of your SSD, not a guarantee against forensic recovery of anything ever written to the drive. It fully protects files you add after you encrypt. If you have sensitive files you already deleted and you need them truly gone, see the Disk Utility section at the end.
Check the drive format first (APFS or Mac OS Extended)
Your drive has to already be formatted as APFS or Mac OS Extended for Finder encryption to show up. If the drive is formatted as exFAT or FAT32 (the formats that move between Mac and Windows computers), Finder will not offer the encrypt option. In that case you have to fully reformat the drive, which means pulling all your files off it first before you can go any further.
How to encrypt the drive in Finder
Once the drive is in the right format, this part is quick:
- Open Finder and find your drive under Locations in the sidebar.
- Right click the drive and choose Encrypt.
- Enter an encryption password. Do not use something like 1234. Pick a real password.
- Add a password hint. Finder requires one.
- Click Encrypt Disk.
You have to keep this password to unlock the drive going forward. Do not lose it and do not forget it, because if you do, you will not be able to access the data.
When the encryption actually kicks in
Right after you hit Encrypt Disk, it can look like nothing happened. That is normal. The encryption only takes effect the next time the drive is unmounted and remounted. Safely eject the drive and plug it back in. Now when you connect it to the Mac, you get a prompt asking for the passcode to unlock the disk.
Save to keychain: should you?
At the unlock prompt you can check Save to Keychain to remember the password on that computer. I do not recommend this if your computer lives in a publicly accessible space, since it defeats the point. It can be useful if your main worry is the drive itself walking off and getting plugged into someone else’s computer, since that machine will not have the password saved.
Using the encrypted drive day to day
Once the drive is unlocked, you use it like any other external SSD. Open Finder and access it from Locations exactly as before. It stays unlocked until the drive is removed and reconnected, at which point it will ask for the password again.
How to remove the encryption
If you decide you no longer want a password on the drive, you can turn it off:
- Go back to the drive in Finder.
- Right click it and choose Decrypt.
- Type in the original password.
- Click Turn Off Encryption.
The encryption is now removed from the drive.
Lose the password, lose the data
This is worth repeating. There is no reset and no Apple backdoor. If you lose the password, no support team is going to be able to help you, and you lose the data. Store the password somewhere you trust.
For true data wiping, use Disk Utility instead
If the drive previously held sensitive files that you deleted and you want those to be genuinely unrecoverable, encrypting in place with Finder is not enough. To be sure everything is gone, open the drive in Disk Utility, securely format it (which erases everything), and set it up in a fresh encrypted state.
That means you lose everything on the drive, so you would pull off the files you want to keep and put them back afterward. It is the trade-off you make for the speed of the Finder method.
Who this method is actually for
The main benefit of the Finder method is speed. You do not have to delete anything, and you get a password wall so someone cannot just grab the drive and open all your files. That makes it a good fit if you have a drive full of footage you do not want anyone accessing, or client work you need to protect, as long as you understand the limits above. If you want a hand picking a new Mac or an SSD, I have links for that in the video description.
