Encrypted storage is essential for privacy and security, and on the face of it macOS offers the user several robust options, including

• FileVault,
• APFS (Encrypted) volumes,
• encrypted disk images,
• encrypted sparse bundles,
• Apple Encrypted Archives.

No doubt you can think of a few others. But not all of these work as well as you might expect. In particular, encrypted sparse bundles suffer a serious bug that prevents you from changing their password, and Apple Encrypted Archives don’t allow use of a memorable password at all. This article looks at those.

Encrypted sparse bundles

Until Ventura 13.2.1, encrypted sparse bundles seem to have worked as advertised. Although Disk Utility has never offered an easy way to change their passwords, that could be accomplished interactively using hdiutl in Terminal. A command of the form
hdiutil chpass sparsebundle
where sparsebundle is the path to the sparse bundle, starts this process. The user is first prompted at the command line to enter the current password, then the new password twice, thus
hdiutil chpass /Users/hoakley/Documents/0test1.sparsebundle
Enter password to access "0test1.sparsebundle":
Enter a new password to secure "0test1.sparsebundle":
Re-enter new password:

This stopped working by Ventura 13.3.1, since when hdiutil still goes through the same sequence but the password remains unchanged. As there’s no other means of changing a sparse bundle’s password, this severely limits the usefulness of encrypted sparse bundles. The only workaround seems to be to make the change using 13.2.1 running in a VM. Without that, no encrypted sparse bundle can now have its password changed.

Fortunately, this only applies to sparse bundles, and not disk images, and in some uses there are alternatives: for example, if you’re using an encrypted sparse bundle on network storage, you could perhaps replace that with an unencrypted sparse bundle on an encrypted file system. Unfortunately, as you can’t remove encryption from an existing sparse bundle, that’s of no help if you’re storing Time Machine backups in that encrypted sparse bundle, as there’s no way to copy APFS Time Machine backups between volumes.

Signs of a fix coming in the first release of Sonoma aren’t promising. According to those who have tested this in its beta releases, the bug currently remains unfixed there, as well as in Ventura 13.5.2. Given the impact of this on many users, it’s deeply disappointing that this still hasn’t been addressed.

Apple Encrypted Archives

Archive Utility is one of the unsung heroes of macOS, although for many it’s just a convenient way to unzip files. With the arrival of Apple Archive format, it now offers efficient compression that performs particularly well on Apple silicon Macs. Although access is most extensive through its command tool aa, whose man page provides its only documentation, Archive Utility offers Apple Encrypted Archive as a supported option.

This provides a raw and unhelpful interface that makes it unattractive at present. When asked to compress an item in Apple Encrypted Archive format, the app prompts the user for what it claims is a password. Instead what it’s actually doing is informing the user of their randomly generated key required to decrypt that archive. As that’s a long number such as
65764-61713-62440-77407-11836-81743
it’s not memorable, and either has to be stored in the keychain, or recorded elsewhere.

When stored in a keychain, that isn’t readily identifiable, and can’t be copied or transferred to another Mac. If that archive is to be accessible on another Mac, or from a backup, the user has to manually store a copy of that key. As there’s no way to change that key in any way, let alone substitute a password of the user’s choice, the only way for a user to retain access to the items in that encrypted archive is to keep a copy of the key with it. That surely defeats the whole purpose of encryption.

If this option is going to be exposed to the user in a GUI, Archive Utility needs to provide a better method of gaining access to its encryption key that can be protected by a more memorable and portable password. Use of Apple Encrypted Archives also needs to be properly documented.

Summary

As of Ventura 13.5.2, and probably in the first release of Sonoma, two of those five robust options for encrypting files and folders aren’t sufficiently functional for normal use. The bug in changing passwords for sparse bundles needs to be fixed, and shortcomings in passwords for Apple Encrypted Archive need to be addressed in Archive Utility.