APFS Encrypted Or Not? | Confirm Encryption In Minutes

Yes, APFS can be encrypted, but you must check each volume to know whether your Mac’s data is locked.

If you’ve stared at Disk Utility and wondered what it’s telling you, you’re not alone. APFS has layers, and the words you see depend on what you clicked: the physical drive, the APFS container, or a specific volume.

This article keeps it simple. You’ll learn what “encrypted” means in APFS, how it relates to FileVault, and how to verify the status with tools built into macOS.

APFS Encryption Status On Mac

APFS is Apple’s file system for modern Macs. It stores data inside containers, and containers hold volumes. The detail that trips people up is that encryption is a volume setting, not a container label you can trust at a glance.

A single container can hold one volume that is encrypted and another that is not. That’s normal. It’s also why the right question is often “Which volume is encrypted?” rather than “Is this drive encrypted?”

When you erase or create a volume, macOS offers plain APFS, encrypted APFS, and a case-sensitive variant of each. Case-sensitive volumes treat names that differ only by letter case as different items.

APFS encryption is encryption at rest. Data on the disk is stored in an encoded form. Without the right password, it should look like noise. When you open the volume, macOS can read and write files as usual.

On many newer Macs, the internal storage uses hardware-backed protection. The data is encoded by default, even before you flip any settings. What changes when you turn on FileVault is who can decrypt the disk at startup and how decryption ties back to your login.

APFS (Encrypted) vs FileVault

Think of APFS (Encrypted) as a setting for a specific volume. You give that volume a password (or you open it with a saved credential), and it stays locked until you open it.

FileVault is full-disk encryption for the startup disk. It adds a login-at-boot step so the Mac can’t load your user data until someone enters a valid password.

They can overlap. Your startup volume can be encrypted because FileVault is on. A separate external drive can be encrypted without FileVault, using APFS (Encrypted). Pick the one that matches when you want the password prompt.

APFS Encrypted Or Not? What The Status Means

When people ask “apfs encrypted or not?”, they usually want one of two answers: either “my startup disk is protected” or “this specific external drive is protected.” The checks differ a bit, so match the check to the thing you care about.

In Disk Utility, you may see an APFS volume listed with a label like “APFS (Encrypted)” or “APFS (Case-sensitive, Encrypted).” That wording reflects the format the volume was created with.

In Terminal, the same volume can show fields that describe its encryption state. You might see lines that say the volume is encrypted, whether it is locked, and whether it is open right now.

Common status words you’ll see

Encrypted — The volume stores data in an encoded form when it is not open.
Locked — The volume is encrypted and currently closed, so files on it are not readable.
Open — The volume is encrypted but currently open, so Finder can read it.
FileVault On — The startup disk requires a login at boot to decrypt user data.

Fast checks at a glance

What You’re Checking	Where To Check	What “Good” Looks Like
Startup disk protection	System Settings and Terminal	FileVault shows On
External drive volume	Disk Utility and Terminal	Volume format shows Encrypted
Current lock state	Terminal	Volume shows Locked or Open

Check APFS Encryption In Disk Utility

Disk Utility is the quickest visual check, but you have to click the right item. If you select the physical device or the container, you can miss the fact that a volume inside it is encrypted.

Start by showing the full device tree. Then you can see the device, the container, and each volume under it.

If you’re setting up a new external drive, the encryption choice happens at erase time. Pick an encrypted APFS format, set a password you can actually store safely, then let the drive mount once to confirm it shows up in Finder.

Open Disk Utility — Use Spotlight, then launch the app.
Show all devices — In the View menu, pick “Show All Devices” so the sidebar expands.
Select the volume — Click the volume name, not just the container.
Read the format line — Look for APFS (Encrypted) or a case-sensitive encrypted format.
Check the info panel — Click the Info button to see more fields about the selected volume.

What to do if the sidebar looks confusing

Renamed volumes can hide what you are really selecting. A volume named “Macintosh HD” might sit under a container named “Container disk3,” and the device can be something else entirely. Click the volume, then confirm the selection in the Info panel.

If you manage multiple disks, match the size you see in Disk Utility to the size you expect. That quick check keeps you from chasing the wrong disk.

Check APFS Encryption In Terminal

Terminal gives you the most direct answer because it prints the encryption fields for each APFS volume. This is also the best path when Disk Utility looks fine but you still want a second check.

Use diskutil to list APFS volumes

This command lists your APFS containers and the volumes inside them.

Run the list command — Type diskutil apfs list and press Return.
Find your volume name — Scroll until you see the volume you care about.
Read the encryption line — Look for a line that says Encrypted: Yes or Encrypted: No.
Note lock state — Some outputs also show Locked: Yes or No.

Use fdesetup to check FileVault status

If your goal is startup disk protection, check FileVault directly. In Terminal, the simplest check is:

Run the status command — Type fdesetup status and press Return.
Read the result — You’ll usually see “FileVault is On.” or “FileVault is Off.”

If FileVault is On, your startup disk uses a boot-time decryption flow tied to user credentials. If it is Off, the system can still use hardware-backed storage protection on some Macs, but the decryption flow is different.

Check a specific disk by identifier

When names are similar, use the disk identifier. First run diskutil list. Then use the identifier to get details with diskutil info diskXsY. This helps when you’re checking a USB drive that keeps mounting under the same volume name.

When APFS Shows Unencrypted And How To Fix It

Seeing “not encrypted” doesn’t always mean something is wrong. It can be a choice you made, a volume you didn’t mean to check, or a drive that can’t be encrypted in its current format.

If you expected encryption and you don’t see it, work through the causes below. Each one has a clean fix.

You’re looking at the container, not the volume

This is the most common mix-up. Containers hold volumes. Volumes carry the encrypted flag. Switch your selection to the volume and check again.

The drive is formatted as plain APFS, not APFS (Encrypted)

If you erased a drive and chose APFS without encryption, it will stay unencrypted until you change it. For many external drives, the cleanest fix is to back up the data, erase the volume as APFS (Encrypted), and restore the files.

Copy your files — Move everything to another drive or a temporary folder.
Erase the volume — In Disk Utility, erase and pick an encrypted APFS format.
Set a strong password — Use a long passphrase you can store in Passwords.
Restore your data — Copy files back after the drive mounts and opens.

FileVault is off on a Mac you want protected at boot

If your goal is boot-time protection for the internal drive, turn on FileVault in System Settings under Privacy & Security. Once it’s on, macOS handles the encryption work in the background.

After you enable it, give the Mac time to finish. You can keep using the computer while it runs.

Encryption may still be running

Right after you turn on FileVault or encrypt a large volume, the system can take time to finish the first pass. Some screens show progress, and Terminal output can include a percent complete line. Leave the Mac on and check again later.

You see encrypted, but you never get a password prompt

That can be normal. If you saved the password on Mac, the volume can open when you sign in. If it’s an external drive and you want a prompt each time, remove the saved password entry so macOS asks again when the drive mounts.

On the startup disk, FileVault changes the prompt timing. You’ll see a pre-boot login screen when the disk needs decryption before macOS loads your user data.

Encryption Choices And Tradeoffs For Speed, Backups, Sharing

Encryption affects how you open drives, how you recover them, and how you share files with other devices. Picking the right setup now saves headaches later.

Performance and battery

On modern Macs, encryption overhead is usually small. Most people won’t notice it in daily use.

Backups still work, but test restores

Time Machine can back up encrypted volumes. A good habit is to test a restore on a small set of files before you rely on the setup.

Back up one folder — Pick something small, like a few documents.
Restore it to a new spot — Put it on the desktop and open the files.
Verify the password steps — Make sure you know when macOS asks for a password.

Sharing with Windows and older Macs

APFS is designed for Apple devices. If you need a drive that moves between macOS and Windows, an APFS encrypted volume won’t be the easiest path. You may prefer a different format and separate encryption that works across systems.

If you stay inside Apple devices, APFS encrypted volumes mount in Finder, ask for a password when needed, and keep the data locked when you eject the drive.

Recovery codes, passwords, and real-life habits

Encryption only helps if you can still get your data back. Use a password manager for volume passwords and keep recovery codes where you can reach them when your Mac is down.

If you lose the password, the data is gone. That’s the trade. Backups matter.

If you share a Mac, set accounts so each person unlocks FileVault with their own password.

So, apfs encrypted or not? You now have a clean way to answer it. Check the exact volume, confirm FileVault for the startup disk, and keep your open method written down in a safe offline place, too.