Open Disk Utility and choose . Set Format to APFS, Encryption to 256-bit AES and Image Format to Sparse Bundle Image, then click Save and choose a password. The image opens like a drive; eject it to lock it. In Terminal, hdiutil create does the same.
Not sure a disk image is the right tool? Our guide to every way to password-protect a folder on Mac compares it with archives, locked PDFs, Notes and separate accounts.
On this page
Which image format to choose
Disk Utility offers several image formats, and macOS Tahoe renamed them. For a private folder you'll keep adding to, the answer is almost always a sparse bundle. Here's why, and what the others are for.
| Format (Tahoe name) | Called on Sequoia and earlier | Grows with contents | Good for | Verdict |
|---|---|---|---|---|
| Sparse Bundle Image.sparsebundle · UDSB | sparse bundle disk image | Yes | Private folders you keep adding to. Backs up efficiently. | Best for most people |
| Apple Sparse Image.asif · ASIF | New in Tahoe 26 | Yes | Virtual machines, and storage on drives that aren't APFS. | Skip if encrypting |
| RAW Image.dmg · UDRW | read/write disk image | No, full size at once | A fixed-size container, or sharing with older Macs. | Works, wastes space |
| Read-only or compressed.dmg · UDRO, ULFO | read-only, compressed | — | Archiving or handing out files that won't change. | Can't add files |
The older single-file “sparse disk image” (.sparseimage) no longer appears in Tahoe's Blank Image options. Existing ones still open.
Why a sparse bundle wins
- It only takes the space it needs. Set a 50 GB maximum and a new image with a few documents in it is a few megabytes on disk.
- It backs up efficiently. A sparse bundle is really a folder of small “band” files. When you change something, only the bands that changed are new, so Time Machine copies those instead of the whole image.
- It's fast when encrypted. Tahoe's new ASIF format is quick unencrypted, but in The Eclectic Light Company's tests encrypted sparse bundles read about twice as fast as encrypted ASIF images. ASIF images can also only be created on Tahoe.
Create one in Disk Utility
- Open Disk Utility from Applications › Utilities, or press ⌘ Space and type “Disk Utility”.
- Choose .
- Name it and choose a place. Type the file name in Save As and pick a folder in Where. Then type the Name the unlocked image should show in Finder.
- Set the size and format. Enter a generous maximum size and set Format to APFS.
- Turn on encryption. Choose 256-bit AES encryption from the Encryption menu, then type the password twice.
- Choose the image format and save. Pick Sparse Bundle Image, leave Partitions alone, and click Save. The new image unlocks straight away and appears in Finder's sidebar under Locations.
Every setting, explained
Save As and Where
This is the image file itself — the thing you double-click to unlock. It can live anywhere, including an external drive. If you'd rather it stayed off Apple's servers, avoid iCloud Drive, and avoid Desktop and Documents when “Desktop & Documents Folders” syncing is on.
Name
The volume name you'll see in Finder's sidebar and in /Volumes while it's unlocked. It can differ from the file name. Pick something that doesn't give away what's inside.
Size
For a sparse bundle this is a ceiling, not a reservation. The image starts small and grows as you add files. Making the image bigger later is possible but fiddly (see below), so go generous from the start.
Format
Choose APFS, the file system every Mac has used since macOS High Sierra. Only pick “Mac OS Extended (Journaled)” if the image has to open on a Mac older than that.
Encryption
Choose 256-bit AES. Neither 128-bit nor 256-bit AES has been broken, and the speed difference on a modern Mac is small. This is the one setting you can't change afterwards: to encrypt an unencrypted image, you make a new encrypted one and copy the files across. Your password matters more than the key size — use a long passphrase you don't use anywhere else.
Partitions
Leave it at Single partition - GUID Partition Map. The other options are for specialised uses such as bootable images.
Image Format
Sparse Bundle Image, for the reasons above.
Encrypt a folder you already have
There are two routes. The first is more reliable.
Recommended: new image, then move the files in
- Create a blank encrypted sparse bundle as described above, sized with room to spare.
- Drag the folder's contents into the unlocked image and check that everything opens.
- Delete the original folder and empty the Trash. Until you do, an unencrypted copy still sits on your Mac. With FileVault on, any leftover data in free space is encrypted too.
Alternative: Image from Folder
makes an encrypted copy of a folder in one go. The catch is that the default formats are read-only, so you can't add files later. Choose RAW Image (“read/write” on older macOS) if you'll keep using it, and remember that it takes up its full size on disk and your original folder is left untouched.
The Terminal method (hdiutil)
Everything Disk Utility does with images is also available through the hdiutil command. It's handy if you're making several images or scripting a setup.
# Make a folder to keep images in mkdir -p ~/Vaults # Create a 50 GB encrypted sparse bundle (you'll be asked for a password) hdiutil create -size 50g -fs APFS -type SPARSEBUNDLE \ -encryption AES-256 -volname "Tax 2026" ~/Vaults/Tax-2026.sparsebundle # Unlock it hdiutil attach ~/Vaults/Tax-2026.sparsebundle # Lock it again hdiutil detach "/Volumes/Tax 2026"
Don't type the password into the command itself. Let hdiutil prompt for it. A password written into a command, or piped in with echo, ends up in your shell history file.
Everyday use: unlock, lock, open at login
Unlock
Double-click the .sparsebundle file and enter the password. The image appears in Finder's sidebar and behaves like any other drive.
Enter a password to access “Tax-2026.sparsebundle”
If you tick Remember password in my keychain, the image will open for anyone using your logged-in account, without a prompt. That's convenient on a Mac only you use, and it defeats the purpose on a shared one.
Lock
Eject it: click the eject button next to its name in the Finder sidebar, or select it and press ⌘ E. It also locks when you log out, restart or shut down. Nothing locks it for you in the meantime — walk away with it unlocked and it stays unlocked.
Open at login
Add the .sparsebundle file to the apps and items that open at login, in (“Login Items & Extensions” on newer versions). You'll be asked for the password each time you log in, unless you saved it in your keychain.
Change the password
Eject the image first, then run hdiutil chpass. It asks for the current password, then the new one twice.
hdiutil chpass ~/Vaults/Tax-2026.sparsebundle
If you'd saved the old password in your keychain, update or delete that entry too — search for the image's name in Keychain Access or the Passwords app. If chpass ever fails, the fallback always works: make a new encrypted image with the new password and copy the files across.
Make it bigger
If you're running out of room, raise the maximum size:
- Eject the image, so it isn't in Disk Utility's sidebar.
- In Disk Utility, choose , pick the image file and click Choose.
- Type the new size and click Resize.
If Disk Utility won't resize it, create a new, larger sparse bundle and copy everything across. It's slower, but it never fails, and it also tidies up wasted space (see the next section).
Get space back after deleting files
Sparse bundles grow easily but don't reliably shrink. Delete files inside an APFS sparse bundle and the image on disk often stays the same size, because the file system's leftovers are spread across its bands. There's a command for this:
# Eject the image first
hdiutil compact ~/Vaults/Tax-2026.sparsebundle
In practice it reclaims little from APFS images. In The Eclectic Light Company's testing, the only reliable fix was the same as for resizing: create a fresh sparse bundle and copy the contents across, then delete the old one.
Backups and iCloud
Time Machine
Time Machine backs up the image file, not the unlocked contents, so your backup stays encrypted. With a sparse bundle it only copies the bands that changed. A single-file .dmg gets copied in full every time it changes, which fills your backup drive much faster.
The flip side: to restore one file from an old backup, you restore the image, unlock it with the password you used at the time, and take the file out. Another reason not to lose that password.
iCloud Drive and Dropbox
An encrypted image stays encrypted wherever it's copied, so syncing it doesn't expose anything. But a sparse bundle is hundreds of small band files that change while it's open, and sync services can copy them mid-change. If you sync one, only use it on one Mac at a time and let it finish syncing after you eject. If it should stay on this Mac, save it somewhere that doesn't sync.
Troubleshooting
-
“I can't add files to my image.” It's read-only, usually because it was made with Image from Folder. Make a new sparse bundle and copy the files in, or use to create a read/write copy.
-
“The disk wasn't ejected because one or more programs may be using it.” A file inside is still open — in Preview, Word, a Terminal window, or an app that's indexing it. Quit or close it and try again. Force-ejecting can lose unsaved changes.
-
“It opens without asking for a password.” The password is saved in your keychain. Find the entry by searching for the image's name in Keychain Access or the Passwords app, and delete it.
-
“It's using far more space than the files inside.” That's the sparse bundle keeping space after deletions. See getting space back.
-
“It says my password is wrong.” Check Caps Lock and your keyboard layout, and your keychain for a saved copy. Past that there's no recovery or reset — our forgotten-password section explains why.
Frequently asked questions
What's the difference between a .dmg and a .sparsebundle?
A .dmg is a single file, usually a fixed size or read-only. A .sparsebundle is a folder of small band files that grows as you add data, up to a maximum you set. For a private folder you keep adding to, a sparse bundle is the better choice: it only uses the space its contents need, and backups only copy the bands that changed.
Is an encrypted disk image secure?
Yes, when it's locked. Disk images use AES encryption, and with a strong password the contents can't be read without it. While the image is unlocked, though, its contents are as open as any other folder to anyone using your Mac, so eject it when you're done.
Can I add encryption to a disk image I already have?
The simplest reliable way is to create a new encrypted sparse bundle, copy everything from the old image into it, check the copy, then delete the old image.
How big should I make an encrypted disk image?
Bigger than you think you need. A sparse bundle only takes up the space of what's inside, so a 50 GB maximum costs nothing extra until you fill it, and it saves you resizing later.
Should I use the new ASIF format or a sparse bundle?
For an encrypted folder, use a sparse bundle. ASIF is new in macOS Tahoe 26 and is designed mainly for virtual machines. In independent tests, encrypted sparse bundles were noticeably faster than encrypted ASIF images, and creating ASIF images requires macOS Tahoe.
Can I store an encrypted disk image on a USB drive?
Yes. Save or copy the image to any drive and it stays encrypted. It opens on any Mac with the password. Windows can't open Mac disk images without extra software.
About this guide
Written by the Doghouse team at Sprout Media in Dublin. Doghouse is built on the same Apple encrypted disk images this guide covers. Steps are checked against Apple's documentation for macOS Tahoe 26, and older menu names are noted where they differ.
Published · Last updated . Spotted something out of date? Tell us.
Sources
- Create a disk image using Disk Utility on Mac — Apple Support
- Resize a disk image using Disk Utility on Mac — Apple Support
- Should you use Tahoe's new ASIF disk images? — The Eclectic Light Company
- Sparse bundles leak space — The Eclectic Light Company
- How to manage disk images, Time Machine and large backups — Macworld
- hdiutil command reference — SS64