When you purchase a new Mac, the internal SSD is automatically encrypted using Apple’s FileVault technology, leveraging the Secure Enclave hardware chip. However, this protection does not automatically extend to the external storage you plug into the machine. If you are a video editor backing up client projects to a portable USB-C SSD, or an accountant carrying financial records on a thumb drive, losing that drive means exposing highly sensitive data. To protect that data, you must manually encrypt external drives using macOS native encryption.
The Advantage of Native Encryption
While many hard drive manufacturers (like Western Digital or SanDisk) include their own proprietary encryption software on the drive, you should never use it. Proprietary software often becomes incompatible with future macOS updates, requiring you to install bloated, buggy kernel extensions just to access your own files. By formatting the drive using Apple’s native APFS (Apple File System) Encrypted format, the encryption is handled at the core OS level. It requires zero third-party software and works instantly on any modern Mac you plug it into.
Step 1: Back Up the Drive (Warning)
To encrypt an external drive natively, you must completely format and erase it. If the drive currently contains data, you must copy all of it to a temporary location (like your Mac’s Desktop) before proceeding.
Step 2: Open Disk Utility
- Plug your external USB drive into the Mac.
- Press Command + Space to open Spotlight, type Disk Utility, and press Return.
- In the Disk Utility application, look at the top-left corner and click the View button. Select Show All Devices. (This is crucial, as macOS hides the physical hardware layer by default).
Step 3: Format and Encrypt
- In the left sidebar, look under the “External” heading. Click the absolute top-level physical drive (usually named after the manufacturer, like “SanDisk Extreme Media”), not the indented volume underneath it.
- Click the Erase button in the top toolbar.
- In the dialog box, fill out the details:
- Name: Give the drive a clear name (e.g., “SecureBackup”).
- Format: Click the dropdown and select APFS (Encrypted). (Do not choose Mac OS Extended unless you plan on plugging this drive into a Mac running a 10-year-old operating system).
- Scheme: Ensure GUID Partition Map is selected.
Step 4: Set the Encryption Password
The moment you select APFS (Encrypted), a new window will drop down asking for a password.
- Enter a strong, memorable password.
- Enter a password hint. (Make sure the hint doesn’t give away the password to a stranger).
- Click Choose.
- Click Erase.
Disk Utility will unmount the drive, rebuild the partition map, and format it with AES encryption. This process usually takes less than 30 seconds.
Step 5: Using the Encrypted Drive
When the process is complete, you can copy your data back onto the drive.
The next time you plug this drive into any Mac, a system-level prompt will appear before the drive even mounts to the desktop, asking for the password. If someone steals the drive and plugs it into a Windows or Linux machine, the drive will simply appear as an “Uninitialized Disk,” completely unreadable without the password and Apple’s decryption engine.
Important: If you plan to use this drive on both a Mac and a Windows PC, you cannot use APFS Encrypted. You would have to format the drive as ExFAT and use a third-party encryption tool like VeraCrypt, which is significantly more complex to manage.