How to Encrypt Your Time Machine Backup on a Mac

Your Time Machine backup contains a copy of almost everything on your Mac: documents, photos, emails, saved passwords in your keychain, and more. If that backup drive is lost or stolen while unencrypted, anyone can plug it into another Mac and read all of it. Turning on encryption locks the backup with a password so only you can open it. The good news is that macOS makes this easy, and you can do it whether you are setting up a new backup disk or already have months of backups on it.

Quick Answer

To encrypt a Time Machine backup, open System Settings, go to General and then Time Machine, click the Options or info button next to your backup disk (or select the disk when adding it), and turn on “Encrypt backups.” Create a strong password and store it somewhere safe, because Apple cannot recover it for you. If your disk is already backing up without encryption, macOS will encrypt it in the background while backups continue, which can take several hours on a large drive.

Why Encrypting Your Backup Matters

A backup drive is small, portable, and usually kept in a drawer or plugged in beside your Mac. That makes it one of the easiest things to steal and one of the most valuable. Without encryption, a thief does not need your Mac password at all — the files on the backup disk can be browsed freely from any computer. Encryption turns the whole disk into locked data that is useless without the password. It also protects you if you ever sell, recycle, or throw away an old backup drive, because the data on it stays unreadable even if you forget to wipe it.

Encryption works hand in hand with FileVault on your Mac. FileVault protects the data on your computer itself, while an encrypted Time Machine backup protects the copy. For full protection you want both turned on. You can learn how to protect the Mac itself in our guide on how to enable FileVault disk encryption on a Mac.

How to Encrypt a New Time Machine Backup Disk

If you are setting up a backup disk for the first time, encryption is a single checkbox during setup:

1. Connect the external drive to your Mac.
2. Open the Apple menu and choose System Settings (or System Preferences on older macOS versions).
3. Click General in the sidebar, then click Time Machine.
4. Click the plus button or “Add Backup Disk” and select your drive.
5. Tick the box labelled “Encrypt Backup Disk” or “Encrypt backups.”
6. Create a password, confirm it, and optionally add a hint. Use a password you do not use anywhere else.
7. Click Done or Encrypt Disk. Time Machine will format the drive if needed and start the first backup.

Your first backup will take longer than usual because macOS is writing every file in encrypted form. Leave the drive connected and your Mac plugged into power until it finishes.

How to Encrypt an Existing Time Machine Backup

Already backing up without encryption? You do not need to start over. macOS can convert the disk in place:

1. Connect your backup drive.
2. Open System Settings, then General, then Time Machine.
3. Click the Options button, or Control-click (right-click) the name of your backup disk and look for the encryption option.
4. Select “Encrypt backups” and enter a new backup password when asked.
5. Confirm the password and click Encrypt Disk.

Your Mac now converts the existing backup in the background. Backups and restores still work while this happens, but the process can take a long time — a few hours for a small drive and a day or more for a large, nearly full one. Keep the drive connected until conversion completes. You can check progress in the Time Machine settings pane, which shows a message while encryption is in progress.

Choosing and Storing Your Backup Password

The password is the only key to your backup. Apple does not keep a copy, your Apple Account cannot reset it, and there is no recovery email. If you forget it, the backup is permanently locked and you would have to erase the drive and start again. Follow these tips:

• Use a long passphrase made of several random words — it is strong but memorable.
• Save it in a password manager, and also write it on paper kept somewhere safe at home.
• Never use your Mac login password or your Apple Account password.
• Add a hint that helps you but means nothing to a stranger.
• Consider ticking “Save password in Keychain” only on your own Mac, never on a shared computer.

Apple’s own documentation on encrypting your Time Machine backup disk explains how the password prompt behaves when you connect the drive to a different Mac.

How to Check Whether Your Backup Is Encrypted

Not sure if you turned encryption on? There are two quick ways to check. In System Settings under General and Time Machine, an encrypted disk shows a lock note or the word “Encrypted” next to its name. You can also open Finder, look at the drive in the sidebar, and choose File and then Get Info — the format line will mention “APFS (Encrypted)” if encryption is active. If it only says “APFS” or “Mac OS Extended (Journaled),” the backup is not encrypted yet and you should follow the steps above.

Common Mistakes to Avoid

• Forgetting the password. This is the number one problem. Store the password in two safe places before you start.
• Unplugging the drive mid-conversion. Interrupting encryption conversion can leave the disk in a half-finished state. Keep it connected until the message disappears.
• Encrypting the wrong disk. Double-check you selected your backup drive, not another external drive with files you need.
• Using a weak password. A short, obvious password defeats the purpose. Length beats clever symbols.
• Assuming a password-protected Mac is enough. Your login password does not encrypt a plain backup drive.

Using Your Encrypted Backup Day to Day

Once encryption is on, almost nothing changes in daily life. If you saved the password in your keychain, backups and restores on your own Mac happen without prompts, exactly as before. If you did not save it, macOS asks for the backup password when the drive connects — a small ritual that guarantees the drive stays locked to everyone else. When you restore files or migrate to a new Mac, the password is requested once at the start of the process; keep it reachable during any restore. Travelling with a backup drive becomes far safer too: an encrypted drive in your luggage is a brick to anyone who takes it, while an unencrypted one is your whole digital life in a pocket. That peace of mind, for the price of remembering one more password, is the real product here.

Conclusion

Encrypting your Time Machine backup takes only a few clicks, costs nothing, and closes one of the biggest privacy holes in a home backup setup. Turn it on when you first set up a disk, or convert an existing backup in the background, choose a strong password, and store that password safely. After that, your backups keep running exactly as before — just locked against anyone who should not see them.

Frequently Asked Questions

Will encrypting my Time Machine backup slow it down?

The first backup and the background conversion take longer than normal. After that, modern Macs encrypt on the fly with almost no noticeable slowdown, because the chips handle encryption in hardware.

What happens if I forget my Time Machine backup password?

The backup cannot be opened, restored, or changed. There is no reset option. Your only choice is to erase the backup disk and start a fresh backup, so storing the password safely is essential.

Can I decrypt a Time Machine backup later?

Yes. In Time Machine settings you can turn encryption off for the disk, and macOS will decrypt it in the background. The process also takes a long time on large drives.

Do I need FileVault turned on to encrypt Time Machine?

No, the two are independent. You can encrypt your backup even if FileVault is off, although using both gives the strongest protection for your data at rest.

Does encryption work with network backups and Time Capsule?

Yes, you can encrypt backups stored on a network volume too. The option appears when you select the network destination in Time Machine settings, and the same password warning applies.