Whole disk encryption is far superior in most respects to encrypting individual files and folders. If your Mac has a T2 chip, like it or not, your internal storage will be fully encrypted. But if your Mac has to perform encryption in software – as it will for any external storage even when it does have a T2 chip – you may not want the whole disk encrypted. As few of us have no documents with sensitive contents, you may still want some to be suitably protected.

Cast your mind back to when Apple first announced APFS and its wonderful new features. Do you remember it referring to both whole-disk and individual file and folder encryption? Look as hard as you like in the Finder, its Quick Actions, contextual menus, and so on, and it’s nowhere to be found. Has Apple not yet got round to implementing this?

It has, but perhaps not in the direct way that you expected. It’s all done with Disk Utility (hdiutil if you prefer), and once set up works rather well.

Setting up an encrypted harbour for your files is straightforward. I’ll do it here using a sparse bundle, although if you prefer you can use a disk image instead. Sparse bundles have the advantage that they store the encrypted contents in chunks or bands, which can minimise the amount of backup space they require as they are modified. They also only use the space they require.

In Disk Utility, make a Blank image using the New Image… command in the File menu. This produces quite a busy dialog, into which you should enter:

• a suitable file name and location for the encrypted sparse bundle, and a name for the mounted volume;
• the maximum size you want the sparse bundle to grow to. Because this is sparse storage, it only occupies the space it needs at the time, so ensure this is healthily large, in GB or even TB;
• APFS as its format;
• either of the encryption options, as you prefer. When you select one, you’ll be prompted for its password;
• a single partition, GUID;
• sparse bundle disk image (in this example).

Once you have set those up, go back and check its size, which Disk Utility has a habit of reverting to its default, so that it will be of little use. Then click on the Save button.

You should then have a mounted disk image of around 33.5 MB in size, which will expand as required to accommodate up to the set maximum. Drag and drop your files and folders into it as you wish. You may then notice an old bug which was first reported in Mojave: the progress circles next to copied files persist in an incomplete state even though the copies have been made successfully. Don’t worry about that. Once your encrypted sparse bundle is complete, eject it.

To mount and decrypt those files and folders, double-click the sparse bundle. You’ll then be prompted for its password. Once that has been entered, the bundle will be mounted, and you can add, remove and edit files within it just as for any read-write volume. Once you’re finished with it, close all files that are open in it and eject the volume.

One operation which you may find handy if the contents shrink noticeably is to compact the sparse bundle using the command
hdiutil compact mybundle.sparsebundle
where mybundle.sparsebundle is the path to and name of the bundle.

Encrypted sparse bundles work fine across both Catalina and Mojave, and perhaps with High Sierra too. They’re nowhere near as secure as whole disk encryption, but if you want to protect just a few items on a volume which would have to be encrypted in software, they may well prove ideal. They are a little fiddly to set up; for instance, if you leave their size set at the default, they can be infuriatingly obtuse.