Encrypted Folder

Finder for an encrypted folder. No mount, no container, no plaintext temp files.

Warning

This is new software with a new file format. Keep backups of the whole vault, especially encrypted-folder.json. Lose that file and the ciphertext is decorative.

Why?

I have used Encrypted Sparse Bundles for encrypting files before, but I am not a huge fan because:

• Size is larger than content
• Not resizable
• If bitrot† occurs then multiple files or even the entire contents is lost
• Opening files from the sparsebundle hands apps the decrypted files
• Probably even viewing the contents in Finder may end up storing decrypted copies in caches

† All storage formats may randomly flip bits. Hence you want to store data on a RAID with ECC (error-correcting code) enabled. However that is not usually convenient. Bitrot is inevitable, but all the same: unlikely.

Hence this app.

Install it

$ brew install --cask mxcl/made/encrypted-folder

Build it

Requires macOS 15 or newer and Xcode 26.

$ make run
swift build -c release --product EncryptedFolder
Built build/Encrypted Folder.app
# ^^ signed, sandboxed, opened

Pick an empty folder, choose a password, then drag files in. Drag them back to Finder to export. Images, PDFs, audio and video stay inside the app while viewing.

Recover without the app

Every new vault includes RECOVER.command, a standalone copy of the v1 decryption code. Double-click it, enter the vault password, and it writes the plaintext to a new sibling folder named <vault>-decrypted. It never overwrites an existing folder and refuses to put plaintext inside the vault.

The script needs Apple's Command Line Tools (xcode-select --install). Anyone who can modify the vault can replace its recovery script, so obtain a trusted copy before entering the password if the folder may have been tampered with.

What it does not do

• It does not mount a filesystem.
• It does not sync anything. Put the vault in iCloud, Dropbox, rsync or whatever already disappoints you least.
• It does not hand plaintext to Quick Look. Apple's API doesn't promise the cache/process boundary this app requires.
• It is not gocryptfs-compatible. The per-file format is documented in FORMAT.md.

Touch ID stores the vault's master key in the device-only data-protection Keychain. The password is never stored.

Develop it

$ make test
Test run with 4 tests in 0 suites passed.

$ make install
Installed /Applications/Encrypted Folder.app
# ^^ Developer ID signed, notarized and stapled

make install is the maintainer path: it expects Max's Developer ID certificate and injects APPLE_USERNAME and APPLE_PASSWORD with Automic Vault.