If you are searching for this, you are probably not trying to hide a random photo.

You are thinking about real files on your Mac: investor decks, contracts, HR folders, tax PDFs, customer exports, maybe an entire “work” directory that would be painful or risky if it leaked.

The uncomfortable reality is that most incidents are not cinematic hacks. The 2024/2025 breach reports keep saying the same thing: the human element (lost devices, misdelivery, bad access settings, weak passwords) is involved in the majority of breaches.

On macOS, the risks usually look like:

A stolen or lost MacBook with sensitive files on disk.
Shared or unlocked sessions where someone else can browse Finder or Spotlight.
Files synced to iCloud / Dropbox / Google Drive and then over-shared.
Old external drives or Time Machine disks that were never encrypted.

So you are completely right to want more than "I hope nobody opens this."

Let's walk through what you actually need, with a calm, Mac-specific view.

1. Why you need this (how macOS files actually leak)

On a Mac, things usually go wrong in a few boring but important ways:

No full-disk encryption. If FileVault is off and someone gets physical access to your Mac (or just its SSD), they may be able to read data directly, bypassing your user account password. Apple explicitly recommends FileVault to protect data at rest if a Mac is lost or stolen.
Unlocked sessions and shared machines. A family member, colleague, or repair tech can sit at your logged-in Mac and open sensitive folders, Mail attachments, Downloads, or search Spotlight.
Cloud sync over-sharing. iCloud Drive, Google Drive, Dropbox and others are great, but "anyone with the link" shares and poorly managed shared folders show up again and again as sources of data exposure. Without identity-bound access, you lose control over distribution.
Unencrypted backups and USB drives. Time Machine drives and portable SSDs often contain years of history. If they are not encrypted, anyone who finds them can browse your files. Apple's docs explicitly recommend encrypting Time Machine backups and external drives.

You are not being paranoid. You are just acknowledging how many copies of your files exist in the wild.

2. What “password protecting files on Mac” really has to do

People bundle a few different goals under this phrase. It helps to separate them:

Protect the whole Mac if it’s lost or stolen
- This is full-disk encryption: on macOS, that’s FileVault on APFS volumes. When enabled, your disk is encrypted; you must authenticate at boot to decrypt it.
Protect specific folders or bundles locally
- This is “I want a locked container or vault on my Mac,” usually done via encrypted disk images (DMG/sparsebundle) or encrypted archives (ZIP/7z).
Protect files when sharing with other people
- This is "I want only the right people to see this, a gate in front of it, the ability to turn it off, and accountability if it leaks." Secure document sharing platforms provide access revocation and page-level analytics.

FileVault and Disk Utility handle 1 and 2 pretty well. But for 3—sharing—local passwords only go so far. Once you send a file, you cannot revoke it or see what happens next.

This is where Peony is very useful: you keep using your Mac as normal, but sharing flows through Peony, with optional password (passcode) gates on the Peony side.

3. How to protect Mac files using Peony (with passwords)

Think of macOS as your workspace and Peony as your sharing perimeter.

You can:

Keep sensitive files in Peony instead of emailing raw attachments.
Tie access to identities and add a passcode (password) gate on top.
Still combine this with local macOS encryption if the Mac is lost.

Step 1 – Gather the files on your Mac

On your Mac:

Identify what actually matters: contracts, decks, customer exports, financial models, HR folders.
Keep them in a clear folder structure so you know what should be treated as “sensitive.”

You can upload:

Individual files (PDFs, Excel, PowerPoint, ZIPs, images).
Or packaged ZIPs if you have existing workflows.

Step 2 – Create a secure room in Peony

In Peony:

Create a room named by context, for example:
- “Investors – 2025 Docs”
- “Client – Project Files”
- “HR – Confidential Employee Docs”
Upload your files from the Mac into that room.

From now on, the Peony room is the “home” of those files when you share them, instead of your Desktop or Mail attachments.

Step 3 – Set access and add a passcode (your “password gate”)

In that Peony room:

Grant access only to specific email addresses or trusted domains (e.g. @client.com, @fund.co) using identity-bound access.
Add passwords to Peony rooms for an additional layer of protection—you can require both identity verification and a password.
For external people, set view-only by default.
Decide whether to allow downloads or keep documents view-only inside Peony using secure document sharing platforms.

Then add the "password" layer:

Configure a passcode on the Peony link or file using password protection.
Recipients will now need:
1. The Peony link, and
2. The passcode you share out-of-band

before they can view or download. This is the realistic, modern version of "password protecting a file," without tying everything to the file format itself.

You can also upload already encrypted PDFs/ZIPs into Peony if you want two layers (file-level + Peony-level).

Step 4 – Share one secure link from your Mac

From Mail/Outlook/Slack/Zoom on your Mac:

“Here’s a secure link to the documents. They’re protected on our side and gated with a passcode so we keep access under proper control.”

You paste the Peony link, not the file.

If you later update a file:

Replace it in Peony behind the same link.
Everyone sees the latest version without “v7_final_FINAL.pdf” chaos.

And if a project ends:

Revoke access to the room or remove specific users using access management.
See who accessed files with page-level analytics: when, how long they viewed them, and which files they engaged with.
You do not have to hunt down stray attachments.

4. Other macOS methods if you can't use Peony

If Peony is not an option, you still have solid tools on Mac. Just remember: these protect at rest, not after you email the files.

A) Turn on FileVault (baseline for every Mac)

This should be your starting point.

Go to System Settings → Privacy & Security → FileVault and turn it on.
FileVault encrypts the entire startup disk (APFS volume). Without your password (or recovery key), data should not be readable.

This protects you if the device itself is lost or stolen.

B) Use encrypted disk images (password-protected “folders”)

Disk Utility can create a password-protected container:

Open Disk Utility.
Choose File → New Image → Blank Image… (or “Image from Folder…”).
Choose a name and size.
Under Encryption, select 128-bit or 256-bit AES.
Set Image Format: sparsebundle or read/write.
Set a strong password when prompted.

You now have a .dmg / .sparsebundle file:

Double-click → enter password → it mounts like a drive.
Store sensitive files inside, then eject when done.
Without the password, contents remain encrypted.

C) Password-protect PDFs with Preview

For individual documents:

Open the PDF in Preview.
Go to File → Export… → Permissions.
Check “Require password to open document”, set a strong password, and save.

Preview uses modern encryption (AES) on current macOS versions, and the resulting file opens in most standard PDF viewers.

D) Encrypted ZIP/7z archives

To send a bundle cross-platform:

The built-in zip -er command in Terminal creates an encrypted ZIP, but uses legacy ZipCrypto, which is weaker.
For stronger encryption (AES-256), use a tool like Keka or another 7-Zip compatible app for macOS, and create 7z archives or AES-encrypted ZIPs.

This is useful when someone specifically asks for an "encrypted ZIP" as a deliverable. See our ZIP protection guide for more.

5. Practical tips so this becomes a calm system

A few habits quietly put you in the top few percent of Mac users in terms of security:

Always enable FileVault on any Mac with real data. It is built for exactly this and strongly recommended by Apple and major university IT/security teams.
Use long passphrases, not short clever passwords. Modern guidance (including NIST) emphasises length (12–16+ characters) over weird symbol rules. Use a password manager so you do not have to remember them all.
Never send file and password in the same channel. If you use encrypted PDFs/ZIPs, email the file but send the password over SMS/phone or a different secure channel.
Separate "local safety" and "sharing safety" in your mind.
- Local: FileVault + encrypted disk images protect you if your Mac or drive disappears.
- Sharing: Peony rooms (with optional passcodes) protect you when you send files to other people.
Regularly review where sensitive files live. Clean old copies out of Downloads, Desktop, and unencrypted external drives. Make Peony or an encrypted image the "home base" for anything you'd hate to see forwarded.

You do not need to turn into a security engineer to do this well.

If you give your Mac full-disk encryption, give your most sensitive local folders a proper encrypted container, and give anything you share a Peony link with identity + passcode and revocation, you already operate with more discipline and safety than most teams—without making your day-to-day life miserable.

Frequently Asked Questions

How do you password protect files on Mac?

Peony is best for sharing: share your files via a secure Peony link with identity-bound access and optional password protection instead of embedding passwords. For local protection, use macOS built-in tools: FileVault for full-disk encryption, Disk Utility for encrypted disk images, or Preview for password-protected PDFs.

Can you password protect files on Mac without software?

Yes, macOS has built-in tools: FileVault for full-disk encryption, Disk Utility for encrypted disk images, and Preview for PDFs. For secure sharing with tracking, Peony provides identity-bound access and password protection without installing software on your Mac.

What's the best way to password protect files on Mac?

Peony is best for sharing: provides identity-bound access, password protection, watermarking, revocation, and tracking without password sharing. For local storage, use macOS built-in tools: FileVault for full-disk encryption, Disk Utility for encrypted disk images, and Preview for PDFs.

Can you password protect multiple files on Mac at once?

Yes, create an encrypted disk image via Disk Utility (File → New Image → Image from Folder) and choose AES-256 encryption. For sharing multiple files, Peony lets you upload multiple files to a secure room and share one protected link with access controls and optional password protection.

How secure is password protection on Mac files?

macOS uses AES-256 encryption which is considered secure when paired with strong passwords. However, password-protected files provide no tracking, revocation, or access control after sharing. Peony adds identity-based access, password protection, watermarking, and revocation for better security in shared scenarios.

Can you see who accessed password protected files on Mac?

No, password-protected files provide no access logs or tracking. Once the password is shared, you can't see who opened the file or when. Peony provides complete visibility: see who accessed files, when, how long they viewed them, and which pages they engaged with.

Secure Your Documents

How to Password Protect Files on Mac in 2025: Complete Guide to macOS File Encryption & Security