Is there any way to encrypt my drive with a private key, and no external tools (to be installed), and then unlock via command-line?

I'm referring to my second drive and not my boot drive. I’m not keen on turning on file-fault.

  • FileVault would seem to do exactly what you want. Why are you not keen on it? – benwiggy Jan 6 at 13:50
  • @benwiggy Because I don’t want encrypt my main drive. I know you can create a recovery key. And second is I also want to use that for USB drives. – Roger Jan 6 at 13:54
  • You can use FileVault on external drives. – benwiggy Jan 6 at 14:51
  • You say in a comment to an answer below that you have the key on a usb stick. You don't say, but I assume the usb stick itself is unencrypted, along with the file containing the key? If so, it might be possible to create a keychain file on that stick and store the encryption key on it. You'd still have to open the keychain when inserting the stick, and close it when done, I think. All this would be done via Keychain Access. Note that this is beyond anything I ever tried myself, so I don't know if or how well it will work. Just an idea. :-) – Harald Hanche-Olsen Jan 6 at 15:02

You can use APFS encryption (essentially FileVault) on a secondary drives such as USB drives etc. When formatting the drive with Disk Utility choose “APFS (Encrypted)”, and you’ll be asked for a password for the drive.

When you plug in the secondary drive, macOS will automatically try to mount to mount it by opening a pop up asking you to enter the password to unlock.

If you literally want to use a private key, as in a key file (i.e. not a written password, but an encryption key) - then you’re out of luck. No such solution comes built in with macOS. However it can be done with external tools.

  • Yeah. The problem is a strong password will be a nightmare to type. I have my priv. key on a separate usb stick. And that would make it much easier to unlock. Other solutions? – Roger Jan 6 at 14:54
  • Well not without using any tool as you required. If tools are allowed, you can store a small script or program on the USB drive alongside the key file. The script will then be used to provide that key file to the APFS mounter, or even a completely different encryption system. – jksoegaard Jan 6 at 16:37
  • What tools would you mean? My point is I do rant external encryption software. Since that requires to install it, when moving the sticking on multiple macs. Something like a bash script would be fine. – Roger Jan 13 at 11:50
  • You can use bash scripts, doesn’t really matter at all if you use bash scripts, C programs, swift programs or something else. Just design them without dependencies that require installing on the Mac itself. – jksoegaard Jan 13 at 12:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .