How to Encrypt an APFS Volume in macOS Terminal Using diskutil

Protecting confidential files, intellectual property, and system backups on external SSDs or secondary internal drives requires robust cryptographic encryption. While macOS allows users to enable FileVault on internal boot disks through System Settings or right-click external drives in Finder to select “Encrypt”, these graphical workflows can stall on large storage containers or fail to provide detailed progress feedback. In macOS Terminal, the diskutil apfs command provides direct kernel-level control to convert, encrypt, and manage APFS volumes.

Using diskutil apfs encryptVolume, you can perform non-destructive, in-place cryptographic conversions of existing APFS volumes while retaining full visibility into the background encryption progress.

How APFS Volume Encryption Works

APFS features native, multi-key encryption integrated directly into the file system architecture:

• In-Place Conversion: When you initiate encryption on an existing unencrypted APFS volume, macOS does not require wiping the drive. The volume remains mounted and usable while the encryption engine converts data blocks in the background.
• Volume Encryption Key (VEK): Each encrypted volume possesses a unique AES-XTS 128 or AES-256 cryptographic key. This key is itself wrapped and protected by user passphrases or recovery keys.
• Container Independence: Individual APFS volumes inside the same container can have distinct encryption states—one volume can be encrypted while another remains unencrypted.

Identifying Your Target Volume Identifier

Before issuing encryption commands, locate the precise disk identifier of your unencrypted APFS volume:

diskutil apfs list

Review the output to find your target volume (e.g., /dev/disk3s1). Verify that the FileVault / Encryption field indicates No.

Initiating In-Place APFS Encryption

To convert an existing unencrypted APFS volume to encrypted status, use the encryptVolume verb:

Method 1: Interactive Passphrase Prompt (Recommended)

To avoid saving passphrases in plain-text shell histories, prompt interactively:

diskutil apfs encryptVolume /dev/disk3s1 -user admin

Terminal will display two prompts:

Passphrase for new user:
Repeat passphrase:

Enter a strong password. macOS will initialize the cryptographic metadata and begin background conversion immediately.

Method 2: Supplying Passphrase Directly (Scripted Automation)

For automated provisioning scripts, pass credentials directly:

diskutil apfs encryptVolume /dev/disk3s1 -user admin -passphrase "YourSecurePassword123"

Monitoring Background Encryption Progress

Converting a large external SSD or mechanical drive can take time depending on data volume. To monitor the live encryption progress percentage:

diskutil apfs list

Locate your target volume. The status will display real-time progress indicators:

Encryption Progress: 42.0%
Encryption Type:     AES-XTS
Conversion Direction: forward

When completed, the status will transition to FileVault: Yes (Unlocked).

Command Reference Matrix

The table below summarizes essential commands for managing encrypted APFS volumes in Terminal:

Command	Required Privileges	Operational Role
diskutil apfs encryptVolume diskNsM -user admin	Standard / Admin	Converts an unencrypted APFS volume to encrypted in-place.
diskutil apfs decryptVolume diskNsM	Admin (Passphrase)	Removes encryption and decrypts the volume back to plain text.
diskutil apfs changePassphrase diskNsM	Admin (Passphrase)	Updates the existing volume encryption passphrase interactively.
diskutil apfs listCryptoUsers diskNsM	Standard	Audits authorized cryptographic user UUIDs and recovery key bindings.

Frequently Asked Questions

Can I safely unplug the drive while encryption is in progress?

Yes. APFS encryption is fully transactional and pause-capable. If you unmount or disconnect the drive, the encryption engine automatically pauses and resumes seamlessly the next time the drive is connected.

Can I create a brand new encrypted volume from scratch without conversion?

Yes. If you are adding a fresh empty volume to an existing container, format it as encrypted directly using: diskutil apfs addVolume disk3 "APFS Case-sensitive (Encrypted)" SecureVolume -passphrase "Password".