Is there any way to encrypt my drive with a private key, and no external tools (to be installed), and then unlock via command-line?

I'm referring to my second drive and not my boot drive. I’m not keen on turning on file-fault.

  • FileVault would seem to do exactly what you want. Why are you not keen on it? – benwiggy Jan 6 at 13:50
  • @benwiggy Because I don’t want encrypt my main drive. I know you can create a recovery key. And second is I also want to use that for USB drives. – Roger Jan 6 at 13:54
  • You can use FileVault on external drives. – benwiggy Jan 6 at 14:51
  • You say in a comment to an answer below that you have the key on a usb stick. You don't say, but I assume the usb stick itself is unencrypted, along with the file containing the key? If so, it might be possible to create a keychain file on that stick and store the encryption key on it. You'd still have to open the keychain when inserting the stick, and close it when done, I think. All this would be done via Keychain Access. Note that this is beyond anything I ever tried myself, so I don't know if or how well it will work. Just an idea. :-) – Harald Hanche-Olsen Jan 6 at 15:02

You can use APFS encryption (essentially FileVault) on a secondary drives such as USB drives etc. When formatting the drive with Disk Utility choose “APFS (Encrypted)”, and you’ll be asked for a password for the drive.

When you plug in the secondary drive, macOS will automatically try to mount to mount it by opening a pop up asking you to enter the password to unlock.

If you literally want to use a private key, as in a key file (i.e. not a written password, but an encryption key) - then you’re out of luck. No such solution comes built in with macOS. However it can be done with external tools.

  • Yeah. The problem is a strong password will be a nightmare to type. I have my priv. key on a separate usb stick. And that would make it much easier to unlock. Other solutions? – Roger Jan 6 at 14:54
  • Well not without using any tool as you required. If tools are allowed, you can store a small script or program on the USB drive alongside the key file. The script will then be used to provide that key file to the APFS mounter, or even a completely different encryption system. – jksoegaard Jan 6 at 16:37
  • What tools would you mean? My point is I do rant external encryption software. Since that requires to install it, when moving the sticking on multiple macs. Something like a bash script would be fine. – Roger Jan 13 at 11:50
  • You can use bash scripts, doesn’t really matter at all if you use bash scripts, C programs, swift programs or something else. Just design them without dependencies that require installing on the Mac itself. – jksoegaard Jan 13 at 12:24

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.