How to Lock Finder on Mac (and Keep Your Files Out of Sight)

macOS has no setting that locks Finder, because Finder is the app that draws your desktop and file windows and it can never be quit. What you can do natively is put sensitive files inside an encrypted disk image (Disk Utility → File → New Image → Blank Image) or give other people their own user account. If you want Touch ID in front of Finder windows themselves, Lockish can lock Finder like any other app.

Why can't I just lock Finder like a normal app?

Most app-lock tricks rely on quitting or hiding an app until you prove who you are. Finder is different: macOS relaunches it the moment it quits, and it owns the desktop, the file windows and the open/save panels' underlying file browsing. Nothing in System Settings → Privacy & Security or Touch ID & Password offers a per-app lock for it either.

So "locking Finder" really means one of three things:

1. Making the files unreadable without a password (encryption).
2. Making the files invisible to other people (separate accounts).
3. Covering Finder's windows until Touch ID succeeds (an app locker).

They protect against different situations, so pick based on who you're worried about.

How do I protect a folder on Mac without extra software?

The built-in way to password-protect a folder is an encrypted disk image. It behaves like a folder when mounted and is unreadable when not.

1. Open Disk Utility (Applications → Utilities).
2. Choose File → New Image → Blank Image.
3. Name it, pick a size larger than what you'll store, and set Format to APFS.
4. Set Encryption to 128-bit or 256-bit AES and choose a password.
5. Set Image Format to read/write disk image, then save it.
6. Move the sensitive files into the mounted image, then eject it.

Double-clicking the image asks for the password. Leave Remember password in my keychain unticked, otherwise the lock is pointless on your own Mac.

The catch is convenience. There's no Touch ID here, you have to remember to eject the image, and while it's mounted anyone at your Mac can read it.

Is a separate user account better for shared Macs?

For a Mac shared with family or housemates, yes. Go to System Settings → Users & Groups → Add Account, create a Standard account for each person, and switch between them with Fast User Switching. Other standard users can't open your home folder's private contents, so your Documents, Desktop and Downloads stay yours.

It's the sturdiest option, but heavy if the only person who touches your Mac is a partner who just wants to check a recipe. Everything you run (mail, messages, browser sessions) is signed in per account too, so it suits permanent separation, not a quick walk to the kettle. I covered the app-level version of this in how to lock individual apps on a shared Mac with Touch ID.

How do I put Touch ID in front of Finder?

This is the gap native macOS doesn't fill, and it's what Lockish does. You add Finder to its list of protected apps, and when Finder locks, every Finder window is covered by an overlay as it appears, on every display. Keystrokes and shortcuts can't reach it while it's locked.

The setup in practice:

1. Install Lockish (macOS 14.0 Sonoma or later, Apple Silicon and Intel).
2. Grant Device Control and Data Access when asked. It's called Accessibility before macOS 27, and it's the one permission Lockish needs.
3. Add Finder to the protected list. Because Finder is driven through macOS's scripting layer, macOS also asks for Automation permission, and only if you lock Finder.
4. Choose when it locks: manually with ⌘L (Lock All Now), automatically when the screen locks or the Mac sleeps, or after an idle timeout from 10 seconds to 60 minutes.

Unlocking uses Touch ID, or your Mac's login password on a Mac with no sensor. Lockish never asks for Screen Recording. The Lockish 1.6.0 release notes cover how Finder locking and multi-window coverage were fixed.

It costs $9.99 once, with a 7-day free trial and no card, and one licence works on up to 3 of your own Macs. I don't use analytics in any of my apps, so nothing about which apps you lock leaves your Mac.

Which method fits which situation?

People tend to buy Lockish for exactly the middle ground: shared family Macs, coworking desks, and keeping one or two sensitive apps private without locking the whole Mac. If that's you, the guide to protecting sensitive apps with Touch ID shows how to choose which apps to cover.

What won't locking Finder protect against?

Be realistic about this. Lockish is convenience protection, not enterprise security, and it doesn't replace FileVault.

• It covers Finder, not the files. Another unlocked app's open/save dialog can still list your folders, and Terminal can read anything your account can.
• Someone with admin access and enough determination could work around it.
• It doesn't encrypt anything, so a stolen Mac without FileVault is still exposed.

For real confidentiality of a few files, combine approaches: FileVault on, sensitive files in an encrypted image, and Lockish to stop casual snooping while you're away from your desk.

Common questions

Can you password protect a folder on Mac?

Not directly in Finder. The built-in route is an encrypted disk image made in Disk Utility, which asks for a password each time you mount it. Compressing a folder with a password isn't supported by Finder's own Compress option.

Can you lock Finder with Touch ID?

Not with anything built into macOS. Lockish can lock Finder behind Touch ID, covering its windows until you authenticate, and falls back to your login password on Macs without a sensor.

Does locking Finder stop someone using Terminal or other apps?

No. Locking Finder covers Finder only. If other people could open Terminal or another unlocked app, lock those too or use a separate user account.