How to Create and Mount Encrypted Sparse Disk Images in macOS Using Disk Utility and Terminal

Storing sensitive documents, client contracts, or cryptographic credentials on a Mac requires robust security beyond standard user account permissions. While macOS FileVault provides full-disk encryption, creating isolated encrypted disk images offers modular, portable security vaults that can be backed up to external media or cloud services without exposing plaintext files. Understanding the difference between fixed images, sparse images, and sparsebundles—and knowing how to build them via Disk Utility or Terminal—provides flexible file-level privacy.

Fixed Images vs Sparse Images vs Sparsebundles

When generating an encrypted disk image in macOS, you encounter three primary container architectures:

• Read/Write Disk Image (.dmg): Pre-allocates its entire declared capacity immediately. A 50 GB image consumes 50 GB of disk space on creation, even when empty.
• Sparse Disk Image (.sparseimage): Allocates only the physical storage actually occupied by its files, dynamically expanding up to a maximum declared capacity. It exists as a single monolithic file.
• Sparse Bundle Disk Image (.sparsebundle): Similar to a sparse image, but breaks down stored data into discrete 8 MB filesystem “band” files contained within a directory package. This format is heavily optimised for Apple Time Machine and cloud backup solutions, as modifying a single file requires backing up only the altered 8 MB bands rather than re-uploading an entire multi-gigabyte container.

Creating an Encrypted Sparse Disk Image Using Disk Utility

To construct an encrypted container graphically through the native Disk Utility application:

1. Open Disk Utility from Applications > Utilities (or press Cmd + Space and type Disk Utility).
2. Click File in the top menu bar, hover over New Image, and select Blank Image.
3. Configure the creation parameters:
   • Save As: Enter the file name for the container (e.g. SecureVault).
   • Where: Select the directory destination (such as your Documents folder or an external drive).
   • Name: Specify the volume label that appears in Finder when mounted (e.g. Vault).
   • Size: Define the maximum ceiling capacity (e.g. 100 GB). A sparse image will not take this space up front.
   • Format: Choose APFS (recommended for macOS High Sierra and newer) or Mac OS Extended (Journaled) for legacy compatibility.
   • Encryption: Select 128-bit AES encryption (fast and highly secure) or 256-bit AES encryption (maximum military-grade protection).
   • Partitions: Leave set to Single partition – GUID Partition Map.
   • Image Format: Crucially, switch this from read/write disk image to either sparse disk image or sparse bundle disk image.
4. When prompted, enter a strong passphrase, confirm it, and choose whether to store the password in your macOS Keychain.
5. Click Save. Disk Utility generates and mounts the container immediately.

Creating and Managing Encrypted Images via Terminal with hdiutil

For system administrators, automated backup scripts, or headless management, macOS includes the comprehensive hdiutil command-line utility.

To generate a 256-bit AES encrypted APFS sparsebundle with a maximum limit of 50 GB:

hdiutil create -size 50g -fs APFS -type SPARSEBUNDLE -encryption AES-256 -volname "SecureVault" ~/Documents/SecureVault.sparsebundle

Terminal prompts you securely for an encryption passphrase and verification.

To mount an existing encrypted disk image:

hdiutil attach ~/Documents/SecureVault.sparsebundle

Supply your passphrase when prompted. The decrypted volume mounts directly under /Volumes/SecureVault and appears in Finder.

To unmount and lock the container cleanly:

hdiutil detach /Volumes/SecureVault

Compacting a Sparse Disk Image to Reclaim Unused Space

While sparse images automatically expand as you add files, deleting files from within the mounted volume does not automatically shrink the container file on your host filesystem. To reclaim freed space after purging large files:

1. Eject and unmount the volume so it is completely detached.
2. Open Terminal and execute the compact verb:

hdiutil compact ~/Documents/SecureVault.sparsebundle

macOS scans the container bands, identifies zeroed allocation blocks, and deletes unused 8 MB band segments, immediately shrinking the physical file footprint on your primary drive.