Skip to content
FolderSafe

How FolderSafe works

FolderSafe does not invent its own encryption. It drives the encrypted disk images built into macOS and adds the parts you use every day: a folder that stays in place, Touch ID, a recovery phrase and auto-lock.

The life of a FolderSafe folder

1. Create

You choose a parent folder and a name, for example ~/Archive.

  • FolderSafe creates ~/.Archive.foldersafe/data.sparsebundle, an AES-256 encrypted APFS sparse bundle whose password is your master password.
  • It writes vault.json next to it: copies of the master password encrypted to your recovery phrase and, if you turn it on, to a Touch ID key.
  • It mounts the image, writes a marker, ejects it, unlocks it again with your password and decrypts the recovery copy to check the phrase. Only then is the folder handed to you.

2. Unlock

You enter the password, use Touch ID, or use the 12 words.

  • The image is attached and mounted on the folder path itself (~/Archive) with the nobrowse option, so no disk icon appears on the Desktop or in the Finder sidebar.
  • Before mounting, FolderSafe checks the folder is empty, so nothing you put there by mistake gets hidden.

3. Use

It is a normal folder.

  • Open, edit and save files in place. Move In copies whole folders and compares every file with the original.
  • FolderSafe marks the volume so Spotlight does not index it, keeping file names out of the system index.

4. Lock

Click Lock, close the lid, lock the screen, stay idle, or quit the app.

  • The volume is ejected. If an app still has a file open, FolderSafe tells you which one and lets you decide whether to force it.
  • The folder becomes an empty, read-only folder with a lock icon and a shortcut that opens FolderSafe.

Do it yourself with Disk Utility

You can build the core of this by hand: in Disk Utility choose File > New Image > Blank Image, set Format to APFS, Encryption to 256-bit AES, Image Format to sparse bundle disk image, and save it. Double-click it and enter the password to open it; eject it to lock it. You get the same encryption, but the disk appears under /Volumes instead of your folder, there is no Touch ID or recovery phrase, and nothing locks it for you.

What FolderSafe adds on top

Mounting at the original folder path, Touch ID through a Secure Enclave key, a 12-word recovery phrase that can reset the password, auto-lock on sleep, screen lock, idle and quit, verified copying into the folder, a menu bar switch, and a self-test on creation.

The honest limit

Encryption protects files at rest. The moment you unlock a folder, macOS treats it like any other folder: apps, scripts and AI agents running under your account can read it. FolderSafe keeps that window small with auto-lock, but it cannot make an unlocked folder invisible to software you run.

What is inside

A native Swift app, universal for Apple silicon and Intel. The encryption core is a small separate library with its own tests.

  • Disk images through the macOS hdiutil and diskutil image tools; no kernel extension, no background daemon.
  • Recovery phrase: standard BIP39 words (128-bit), turned into an X25519 key that unlocks an encrypted copy of your password.
  • Touch ID: a P-256 key created inside the Secure Enclave; the private key never leaves the chip.
  • The master password is passed to macOS through a pipe, never on a command line.

How it is tested

Version 0.1.0 passes end-to-end tests on real encrypted images: wrong passwords, Chinese and emoji paths, a busy folder that must not lock, an interrupted password change that must still be recoverable, and copying with per-file verification.

Leave the city open. Lock the keep.

Download FolderSafe (free)