Use Mac Built-In Encryption to Protect a USB Drive

Mac Disk Utility USB Encryption — Step-by-Step

This part covers the native macOS approaches. If you need to access this drive on a Windows PC later, skip to the cross-platform section.

⚙️ Difficulty: straightforward | Time: 3 mins

Method 1: How to Encrypt a USB Drive via Disk Utility (Erases Data)

Use this approach if you have a new flash drive, or if you have already backed up the data currently on the drive. This process will securely wipe everything currently on the USB stick.

1. Plug your USB drive into your Mac.
2. Open Disk Utility (Press Cmd + Space, type "Disk Utility", and hit Enter).
3. In the left sidebar, locate your USB drive under the "External" heading. Important: Click the View button in the top left of the window and select Show All Devices. Click the top-level drive name, not the volume underneath it.
4. Click the Erase button in the top toolbar.
5. Enter a Name for the drive.
6. Change the Scheme to GUID Partition Map (if this is not visible, you didn't click "Show All Devices").
7. Change the Format to APFS (Encrypted) or Mac OS Extended (Journaled, Encrypted).
8. A prompt will appear. Enter a robust password and provide a hint. Click Choose.
9. Click Erase. Once finished, your drive is secured with AES encryption.

How to Verify it Worked: Eject the drive safely and physically unplug it. Plug it back in. macOS should immediately prompt you with a password dialog box before the drive mounts to the desktop.

📁 Difficulty: Very straightforward | Time: 1 min

Method 2: Encrypt USB Drive on Mac Without Losing Data

If your USB drive is already formatted correctly (GUID Partition Map with Mac OS Extended or APFS) and contains data you don't want to erase, you can apply encryption non-destructively via Finder.

1. Open Finder.
2. Locate your USB drive in the left sidebar or on your Desktop.
3. Right-click (or Control-click) the drive.
4. Select Encrypt "[Your Drive Name]" from the context menu.
5. Enter and verify your new password. Add a password hint.
6. Click Encrypt Disk.

Note: The encryption process happens in the background. Depending on the size of the drive and the amount of data, this could take anywhere from a few minutes to several hours. Do not unplug the drive until the process completes.

🗂️ Difficulty: Moderate | Time: 5 mins

Alternative: Creating an Encrypted Disk Image

If you want to encrypt files on a usb drive but leave the rest of the drive open for public use (e.g., sharing a presentation file while keeping personal documents locked), create an encrypted DMG.

1. Open Disk Utility.
2. Go to menu bar: File > New Image > Blank Image.
3. Save As: Choose a name. "Where": Select your USB drive.
4. Size: Set the maximum size for your secure vault (e.g., 500 MB).
5. Format: APFS or Mac OS Extended.
6. Encryption: 256-bit AES encryption. Enter a password.
7. Image Format: read/write disk image. Click Save.

You now have a secure, password-secured "folder" (a .dmg file) sitting on your normal USB drive.

Which Option is Right For You?

Not sure whether to use Disk Utility, a DMG file, or external software like USB Secure? Use our interactive tool below.

How USB Encryption Protects Your Data

When you encrypt a flash drive, the raw data on the disk is scrambled using complex mathematical algorithms (usually AES-256). Without the exact cryptographic key (your password), the data appears as randomized, unreadable noise.

Hardware-encrypted vs software-encrypted USB drives

Software Encryption To scramble and unscramble data as it moves to and from the drive, (like Disk Utility, FileVault, or Folder Lock) relies on the computer's CPU. It is highly secure, affordable (often free), but can sometimes be slightly slower on very old machines.

Hardware Encryption requires purchasing a specialized USB drive (often with a physical keypad on it). The encryption chip lives inside the USB drive itself. These are immune to keyloggers on the host computer but are significantly more expensive and cannot be updated if a firmware flaw is discovered.

BadUSB and how do I protect against it? Explained

The BadUSB attack vector explained: A BadUSB is a malicious device that looks like a normal USB flash drive but acts like a keyboard when plugged in. It rapidly types pre-programmed commands into your Terminal or Command Prompt to install malware or steal data. Software encryption safeguards your data from being read, but it does not safeguard your computer if you plug in a random, malicious USB drive you found in public. Never plug untrusted USB drives into your Mac.

Endpoint Control and Organizational USB Policies

While encrypting a portable drive protects the data resting on the device, organizations must also defend the host computers from data extraction. Comprehensive security requires endpoint lockdown protocols that block unauthorized mass storage devices at the port level. By implementing specialized port-blocking applications, IT administrators can establish a default-deny policy for all unknown memory sticks, optical media, and unauthorized network pathways.

These robust endpoint defenses allow network managers to explicitly whitelist trusted, company-issued devices. If an employee attempts to insert an unapproved device, the system demands administrative authentication. Furthermore, enterprise blocking tools can operate invisibly in the background, quietly recording failed access attempts, unauthorized uninstallation efforts, and rogue device insertions, creating a crucial audit trail to combat internal data leakage.