How to password-protect a file on Mac

Every file type compared

The built-in password option for each common file type, and what it actually stops. Some “passwords” only block printing or editing, and don't encrypt anything.

Scroll sideways on small screens.

Password to open vs. restrictions: the difference that matters

Many apps offer two kinds of password.

• A password to open encrypts the file. Without it, the contents are unreadable in any app, on any computer.
• A password to restrict leaves the file readable. PDF owner passwords, Word and Excel's password to modify, and Excel's sheet protection only ask the app to block printing, copying or editing.

Microsoft says outright that Excel's worksheet protection “is not intended as a security feature”. PDF owner passwords don't encrypt the file either, and free software removes them easily.

A simple test: if someone without the password can still read the file, it isn't protected.

• Encryption Yes, with a password to open
• Cost Free, built in
• Opens in Almost any PDF reader

Preview encrypts a PDF when you export it. Apple's steps are the same from High Sierra to macOS Tahoe 26.

1. Open the PDF in Preview.
2. Choose File › Export. To keep an unprotected original, type a new name for the protected copy.
3. Click Permissions and tick Require Password To Open Document. Type the password, then verify it.
4. Set an owner password. Then choose which actions, such as printing, are allowed without it. Anything left unticked needs the owner password.
5. Click Apply, then Save.

To change the password or permissions later, open the protected PDF and choose File › Edit Permissions.

Apple doesn't document which cipher Preview uses. Answers on Apple's community forums report 128-bit AES, which has never been broken.

• Encryption Yes, the whole file
• Unlock with Password or Touch ID
• Best for Documents you open often

Apple's iWork apps share one password feature, and it's the only built-in option here that opens a file with Touch ID. The steps are identical in Pages, Numbers and Keynote.

1. Open the document and choose File › Set Password.
2. Type the password and the other details it asks for.
3. Tick Open with Touch ID if your Mac has Touch ID. Without it, you'll see “Remember this password in my keychain” instead.
4. Click Set Password.

For Touch ID to work, add a fingerprint in System Settings › Touch ID & Password, and tick Use Touch ID in the app's settings, such as Pages › Settings. To change or remove the password, choose File › Change Password.

Apple says the password encrypts the file. On a shared Mac, skip the keychain option: once ticked, the document opens without asking for anyone using your account. For Touch ID on other files, see our guide to locking a folder with Touch ID.

• Encryption AES-256 with a password to open
• Password limit 15 characters
• Opens on Mac and Windows

Microsoft Office offers two separate passwords: one to open the file and one to modify it. Only the first encrypts.

Word

Choose Review › Protect › Protect Document. Enter a password to open, a password to modify, or both, and type each again to confirm. Then save: the password only takes effect once you do (Microsoft's steps).

Excel

Choose File › Passwords, enter a Password to open, and optionally a Password to modify, then save (Microsoft's steps). Don't confuse this with Review › Protect Sheet or Protect Workbook, which stop changes but not reading.

PowerPoint

PowerPoint for Mac offers the same two passwords. Microsoft's PowerPoint page covers the Mac versions but doesn't spell out the Mac menus, so look for the password options on the File menu or the Review tab.

How strong it is

Microsoft's documentation says password-protected .docx, .xlsx and .pptx files use AES with a 256-bit key by default. Passwords in Word and Excel for Mac are case-sensitive and limited to 15 characters, and neither app can recover a forgotten one.

A password to modify only decides who can save changes. Microsoft even documents a case where Word doesn't ask for it at all: when the document sits in an Outlook mail folder.

• Encryption Yes, per note
• Unlock with Password or Touch ID
• Best for Text, photos and scans

A locked note suits small private things: account numbers, recovery codes, a scan of your passport. Select the note, click the More button next to the search field and choose Lock Note. You can use your Mac login password or a separate notes password, and unlock with Touch ID.

The catch is what a locked note can hold. Apple doesn't allow PDFs, documents, audio or video in a locked note. Images, scanned documents, drawings, tables, maps and web attachments are fine. Shared notes can't be locked either.

• Encryption AES-256 with 7z · weak with zip
• Cost Free
• Best for Sending files of any type

An archive wraps files of any type behind one password, the classic way to email something sensitive. Finder's Compress command can't add a password, so people turn to Terminal:

# Asks for a password, but uses weak ZipCrypto encryption
zip -e Contract.zip Contract.pdf

That uses zip's old standard encryption, often called ZipCrypto. Even the zip manual calls it relatively weak. It keeps out the casually curious, not anyone determined.

For real encryption, use 7z. Keka, a free Mac archiver, encrypts 7z archives with AES-256. Pick 7z, not zip: Keka's zip option uses the same legacy encryption as Terminal. It's free from Keka's website, or paid on the Mac App Store.

The trade-off: to open a file you extract it, leaving an unencrypted copy until you delete it. Archives suit sending and storing, not files you edit.

• Encryption AES-256
• Works with Every file type
• Best for Files you keep and reopen

Photos, videos, audio, plain text: most file types have no password option, so put them inside something that does. An encrypted disk image is a single file that holds any number of files and opens like a drive once you enter the password.

With Disk Utility (free)

In Disk Utility, choose File › New Image › Blank Image, set Encryption to 256-bit AES, choose a password and click Save. Drag your files in, delete the unprotected originals, then eject the image to lock it. Apple's warning is simple: forget the password and you won't be able to open the image. Our encrypted disk image guide explains every setting.

With Doghouse

Doghouse makes the same Apple AES-256 disk images, called vaults, and handles the routine. Right-click any file in Finder and choose Add to Doghouse Vault to copy it in, or move it in and put the original in the Trash. Unlock with the password, or with Touch ID if you save the password in Keychain. Vaults lock themselves after 15 minutes idle, when the screen locks or when the Mac sleeps.

One vault is free, forever; €19 / $19 once gets you unlimited vaults. Vaults are standard disk images, so you can open one without Doghouse. One password covers every file inside, with nothing to extract.

Sending a password-protected file

• Send the password another way. A password in the same email travels with the file if the message is forwarded. Text it, say it on a call, or share it through a password manager.
• Pick a format they can open. Protected PDFs open in almost any PDF reader, and Office files in Office on Mac or Windows. Pages, Numbers and Keynote files suit people with Apple devices. A 7z archive needs an app that handles 7z. Disk images are for Macs: Windows can't open them without extra software.
• Use a long passphrase. Once a file leaves your Mac, anyone holding it can keep guessing passwords.
• Check shared iWork documents. Anyone with edit access can change or remove the password.

What doesn't protect a file

• lock
  The “Locked” checkbox. Preview's Locked option, like the one in Finder's Get Info, stops a file being edited or deleted. There's no password: anyone can open it, or duplicate it and edit the copy.
• edit_off
  Restriction-only passwords. A PDF owner password, a password to modify or Excel's sheet protection stops changes, not reading.
• visibility_off
  Hiding the file. A hidden file is readable by anyone who shows hidden files or searches for it. See our guides to hiding files on Mac and private files on a shared Mac.

Which method should you use?

Frequently asked questions

About this guide

Written by the Doghouse team at Sprout Media in Dublin. We make Doghouse, a Mac app for password-protected folders built on the Apple encrypted disk images in method 6. Steps are checked against Apple's and Microsoft's documentation for macOS Tahoe 26, current Pages, Numbers and Keynote, and Microsoft 365 for Mac.

Published 10 September 2026 · Last updated 10 September 2026. Spotted something out of date? Tell us.

Sources

1. Password-protect a PDF in Preview — Apple Support
2. Lock PDFs and images in Preview — Apple Support
3. Password-protect a Pages document — Apple Support
4. Password-protect a Numbers spreadsheet — Apple Support
5. Password-protect a Keynote presentation — Apple Support
6. Lock your notes on Mac — Apple Support
7. Create a disk image using Disk Utility — Apple Support
8. Protect a Word document with a password — Microsoft Support
9. Set or clear read-only status in Excel for Mac — Microsoft Support
10. Protect a workbook — Microsoft Support
11. Protection and security in Excel — Microsoft Support
12. Password protection for presentations in PowerPoint — Microsoft Support
13. Word “modify” password not prompted — Microsoft Support
14. Cryptography and encryption in Office — Microsoft Learn
15. What PDF encryption does Preview use? — Apple Community
16. PDF — Wikipedia
17. Secure encrypted zip or 7z archives — How-To Geek
18. zip command reference — SS64
19. Keka, the macOS file archiver — Keka