1. Home
  2. Help
  3. Unlock and lock

Help · Everyday use

Unlock and lock a vault

What happens when you click Unlock, how Touch ID and the Keychain fit in, working with the open vault in Finder, and locking it again.

In short

Click Unlock on the vault’s card. With a saved password it opens at once (after Touch ID, if you require it); otherwise type the password. A Standard Vault appears in Finder as a folder; a Pocket Vault opens its own window. Click Lock when you are done, or let auto-lock do it.

On this page
  1. Unlock a vault
  2. Touch ID
  3. Working in Finder
  4. Add files from Finder
  5. Lock a vault
  6. From the menu bar
  7. When the vault file isn’t where it was

Unlock a vault

Click Unlock on the vault’s card (or the row in the menu bar panel). What happens next depends on the vault:

  • Password saved in your Keychain, no Touch ID — the vault opens immediately.
  • Password saved, “Require Touch ID to unlock” on — macOS asks for your fingerprint, or your Mac login password as the fallback. Cancel and nothing opens.
  • No saved password — the “Unlock” sheet appears. Type the password and click Unlock (or press Return). If you set a hint, it is shown under the field as “Hint: …”. Tick Remember password in my Keychain to save it for next time; in this sheet the box is off by default.

A wrong password shows “Wrong password for “Name”.” If a saved password stops working (for example because the file was replaced by an older copy with a different password), Doghouse removes the stale Keychain entry and asks you to type it.

While Doghouse is busy, the card shows a spinner. Opening can take a moment the first time after a restart.

Touch ID

Touch ID is a per-vault option in Vault Settings and needs a password saved in the Keychain; it gates the use of that saved password. Vaults with it on show a small fingerprint icon on their card. On a Mac without Touch ID, or with the lid closed, macOS offers your login password instead. The same gate protects maintenance actions and deleting the vault. Our guide explains how Touch ID and the Keychain work together.

Working in Finder

An unlocked Standard Vault is mounted as a volume with the vault’s name. It appears in Finder’s sidebar under Locations and, with Show in Finder after unlocking on (the default), a Finder window opens on it in list view. Drag files in and out, open and save documents, make folders: it behaves like any folder. Everything written there is encrypted on the fly.

The first time this happens macOS asks whether Doghouse may control Finder. Allowing it lets Doghouse open the window in list view; if you decline, the folder still opens, just in whatever view Finder chooses. The permission can be changed later in System Settings › Privacy & Security › Automation.

On the card, Open brings the Finder window back and resets the vault’s auto-lock timer. The capacity bar and “used of” caption update every few seconds while the vault is open. Spotlight is told not to index the open vault, so file names and contents don’t linger in search after locking.

Two different things in Finder. The vault folder (the mounted volume) holds your files while the vault is unlocked. The vault file (Name.sparsebundle or Name.nosync) is the encrypted container that stays on disk all the time; right-click the vault and choose Reveal Vault File in Finder to see it. Don’t put files next to the vault file thinking they are inside.

Add files from Finder

Doghouse adds an Add to Doghouse Vault item to Finder’s Services menu. Select one or more files in Finder, right-click and look under Services (or use Finder › Services). An “Add to Vault” window opens:

  1. Choose the vault from the pop-up. If it is locked and has no saved password, a Password field appears; a saved password is used (after Touch ID, if required).
  2. Click Copy In to copy the files into the vault, or Move In (originals to Trash) to copy them and put the originals in the Trash.

The vault unlocks if needed and stays unlocked afterwards. Files with the same name as one already in the vault get a number added. For a Pocket Vault the same rules apply as in its window: notes, photos and PDFs up to 5 MB each, within the vault’s capacity.

If the item is missing from the Services menu, turn it on in System Settings › Keyboard › Keyboard Shortcuts… › Services, under Files and Folders.

Lock a vault

Click Lock on the card. The volume is ejected, the Finder window closes, and the file on disk is unreadable without the password. Other ways to lock:

  • Lock All at the top of the window (shown while anything is open), in the menu bar panel or menu.
  • The panic shortcut, ⌃ ⌥ ⌘ L by default, from any app.
  • Automatically after a period of inactivity, when the screen locks, when the Mac sleeps or when Doghouse quits. All four are on by default; see auto-lock and the panic shortcut.
  • For a Pocket Vault, the Lock button in its window (⌘ L) or simply closing the window.

Locking is never forced. If a file inside is still open in some app, macOS refuses to eject the volume and Doghouse shows “Could not lock vault — a file inside may still be open”. Close the document (or quit the app using it) and lock again. Automatic locks simply try again later; nothing is ever force-ejected, so nothing can be corrupted by locking.

Everything above also works from the menu bar icon without opening the main window: Unlock and Lock per vault, Lock All, and a folder button that opens the vault in Finder. When a password is needed, a small standalone “Unlock Vault” window appears. See the menu bar panel.

When the vault file isn’t where it was

Doghouse remembers the path of each vault file. If the file is gone, the card says one of two things:

  • “Vault file not found” — the disk is there but the file isn’t at its last known path, usually because you moved or renamed it in Finder. Click Locate Vault… on the card (or in the right-click menu) and choose the file. The list entry is updated; your saved password, Keychain entry and Touch ID setting stay attached. Doghouse takes the vault’s name from the file name you pick.
  • “Waiting for disk” — the vault lives on an external drive or network share that isn’t connected. Plug in the drive or reconnect the share, then unlock as usual.

Clicking Unlock on a missing vault explains the same thing in an alert, with Locate… and Remove from List buttons.