FileVault protects the startup disk at rest
FileVault encrypts the Mac's startup volume. It is designed to protect data if a powered-off Mac or its storage is stolen. After an authorized user logs in, the system makes their files available for normal use.
A folder vault protects selected data while unmounted
An encrypted sparsebundle creates a separate boundary around chosen files. The contents are unavailable until the vault passphrase is entered and become available again while mounted.
Operational differences
FileVault is broad and mostly transparent after setup. Folder-level encryption is selective and requires a repeated unlock/relock habit. A folder vault is portable as a package, but moving or synchronizing it safely requires the vault to be unmounted.
Use both when the risk justifies it
FileVault is the baseline for protecting a Mac at rest. A separate vault can add protection for records that should remain closed during an otherwise active session. Neither protects against malware with control of the logged-in account while the relevant data is open.
Choose with this checklist
- Enable FileVault when you need broad protection for the startup disk before login.
- Use a selected-folder vault when specific records should stay closed during an active Mac session.
- Relock the folder vault when finished and keep its passphrase in a trusted password manager.
- Back up both ordinary files and locked vault packages on a separate disk.
Neither replaces backups
Encryption cannot repair corruption or recover deleted files, failed disks, or forgotten passphrases. Keep tested, versioned backups.
Important limitations
A folder vault is readable while mounted, and FileVault is transparent after an authorized login. Neither is malware protection. Avoid using an active cloud-synced sparsebundle as the only copy, and never depend on encryption as a recovery system.