To set up a new external drive for encrypted storage on a Mac, erase and format it in Disk Utility as APFS (Encrypted), then choose a password you can keep safe. This setup is suited to drives used with modern Macs. Erasing deletes the drive’s contents, so first copy anything you need elsewhere.

Choose a format that fits how you’ll use the drive

For a drive used with macOS 10.13 or later, APFS (Encrypted) is Apple’s encrypted APFS format. APFS also supports external storage. Choose ordinary APFS if encryption is not needed; choose APFS (Encrypted) for a password-protected volume. The case-sensitive variants treat differently capitalized file and folder names as distinct, so use them only if your workflow requires that behavior. Apple’s Disk Utility format guide describes these options.

APFS is not Apple’s listed Windows-compatible format. If you need to move files between Mac and Windows, Apple lists ExFAT as a Windows-compatible format, but that is not the APFS (Encrypted) choice described here. Check the requirements of the computers and applications that must use the drive before erasing it. A Mac-only encrypted setup may not suit a shared cross-platform drive.

Back up first and identify the right device

Disk Utility’s encryption setup erases the device. Copy any files you want to preserve to another location, and make sure the copy is accessible before continuing. Do not assume that selecting the drive and choosing Erase will preserve its contents. Apple’s encryption instructions explicitly require erasing for this method.

Connect the external drive, then open Disk Utility from Applications > Utilities, or find it with Spotlight. Choose View > Show All Devices so the sidebar shows physical devices as well as volumes. Identify the external drive by its name and capacity. Take care not to select your Mac’s internal storage or a different attached disk.

Erase and encrypt the drive in Disk Utility

With the external physical device selected, click Erase. Enter a name for the volume, choose GUID Partition Map for Scheme, and choose APFS (Encrypted) from Format. Enter and verify the encryption password when prompted, then confirm the erase. When Disk Utility finishes, click Done. These are the controls in Apple’s documented setup flow; if Scheme is unavailable, Apple says to select the device at the top level of the sidebar hierarchy.

Treat the password as essential to access: Apple says an external encrypted device asks for its password when connected. Keep it in a secure place separate from the drive, and make sure someone who needs the files can retrieve it. Disk Utility lets you change the volume password later by selecting the volume and choosing File > Change Password. Apple’s guide to protecting removable media warns that encrypted disk data cannot be accessed without its password.

Unlock, use, and eject the drive

Reconnect the drive to confirm macOS recognizes it and prompts for its password. Enter the password to unlock the volume, then copy a small, nonessential file to it and open that file as a basic setup check. This check confirms that the volume is usable in your current Mac setup; it does not prove that you have a backup or that the drive will work with every other device.

When finished, eject the volume in Finder before disconnecting the drive. After disconnection, the encrypted volume may lock; Apple confirms that external encrypted storage requires a password when connected. If you forget the password, you may be unable to access the files, so preserve another copy of important data on a separate storage device or backup.

What this setup does not cover

This process protects the external volume itself. FileVault is a separate macOS feature for protecting the Mac’s startup disk; turning it on does not replace formatting an external drive as encrypted. Apple also notes that Disk Utility’s encrypted external storage cannot be connected to an AirPort base station for Time Machine backups. For Time Machine, follow Apple’s separate instructions for encrypting a backup disk instead of assuming this general-purpose setup applies. Apple’s Disk Utility encryption guide documents the AirPort limitation.

If the drive already contains data you need, stop before clicking Erase and make a separate copy first. If you need Windows compatibility, verify the right format and encryption approach for that requirement before proceeding; the Mac APFS instructions here are intended for Mac use.

Sources