How to Encrypt Plain-Text Notes on a Mac
Quick answer
Need to keep one plain-text note private? You've got three solid options on a Mac: create a password-protected encrypted disk image with the built-in Disk Utility, encrypt the file with age using a single command, or use gpg --symmetric if GPG is already on your machine. All three turn a readable file into ciphertext that only opens with a password.
Here's the trade-off, up front: an encrypted file isn't searchable, previewable, or editable until you decrypt it. On iOS, that usually means you can't touch it at all until you're back on a Mac. If what worries you is losing a note rather than someone else reading it, that's a different problem — see a 3-2-1 backup plan for plain-text notes instead.
Step-by-step: three ways to encrypt a file on Mac
Option 1: an encrypted disk image (Disk Utility, no install needed)
Disk Utility ships with every Mac, so this option costs you nothing extra:
- Open Disk Utility and choose File > New Image > Blank Image.
- Name the file and pick a save location.
- Choose APFS (or APFS Case-sensitive) as the format on modern Macs.
- Pick an option from the Encryption menu.
- Enter and re-enter a password, then click Choose.
- Leave Partitions and Image Format on their defaults, then click Save and Done.
Double-click the finished .dmg to mount it. It shows up on the desktop and behaves like any other drive — drag notes in and out, edit them in place, eject it when you're done. Apple's own guide is blunt about the risk: forget the password, and there's no way to open the disk image or recover what's inside. Put that password in a password manager before you trust anything important to it.
Option 2: age — one command, no configuration
age is a newer command-line tool built on a simple premise: file encryption shouldn't need a manual. To encrypt a file with a passphrase:
age -p notes.txt > notes.txt.ageTo decrypt it:
age -d notes.txt.age > notes.txtThat's the whole interface for this use case. No key pairs to generate, no config file to write. age can also encrypt to multiple recipients or use an existing SSH public key instead of a passphrase, but for one private note, those two commands are all you'll ever need.
Option 3: gpg --symmetric (if you already use gpg)
If GPG is already part of your workflow, its symmetric mode skips public-key setup entirely and derives the encryption key straight from a passphrase:
gpg --output notes.gpg --symmetric notes.txtDecrypting asks for that same passphrase:
gpg --output notes.txt --decrypt notes.gpgThe GNU Privacy Handbook recommends this mode specifically for files where the passphrase never has to be shared with anyone else — which describes a private note exactly. Pick something you can remember but a stranger couldn't guess: mix in numbers and symbols, skip anything that's just a dictionary word.
Common problems and fixes
"Spotlight can't find my notes anymore." That's expected, not a bug. Once a file sits inside a disk image, an .age file, or a .gpg file, it's opaque binary data to Spotlight, iCloud, and any other search or sync tool — until you decrypt it. Decide per note whether privacy or searchability matters more; you don't get both on the same file.
"My encrypted note won't open on iPhone or iPad." Correct — none of these three formats are something iOS opens or edits natively. You'd need to decrypt on a Mac first, then move the plain-text result over. If you regularly need the same note on every device, that's usually a sign it's not a great candidate for file-level encryption. See syncing plain-text notes across your devices for that trade-off — synced plain text and encrypted plain text solve different problems, and trying to do both to the same file causes more friction than it's worth.
"Doesn't FileVault already handle this?" Not the way people assume. FileVault encrypts your whole startup disk, so someone who physically steals the Mac can't read anything on it without your login password. But it does nothing once you're logged in — at that point, any app that can open a file, opens it, encrypted disk image or not. FileVault and file-level encryption guard against two different threats: device theft versus a specific file getting read by the wrong person while the Mac is unlocked.
Frequently Asked Questions
Does FileVault already encrypt my plain-text notes?
FileVault encrypts your whole startup disk against someone who steals the physical Mac, but once you're logged in, any file on that disk — including a plain-text note — opens in any app that can read it. FileVault protects the device; it doesn't add per-file access control while the Mac is unlocked.
Can I still search an encrypted note with Spotlight?
No. Once a file is inside an encrypted disk image, an age-encrypted file, or a gpg-encrypted file, it's opaque binary data to Spotlight, iCloud, and any search or sync tool until you decrypt it. You lose search and at-a-glance previews in exchange for privacy.
What happens if I forget the password on an encrypted disk image?
There's no recovery path. Apple's own Disk Utility documentation states plainly that if you forget the password, you won't be able to open the disk image or view any of the files inside it. Store the password in a password manager before you rely on the image.
Should I use age, gpg, or an encrypted disk image?
For one file you'll reopen occasionally, an encrypted disk image is the most native option — Finder mounts it like any drive. For scripting or automating encryption across many files, age's one-line passphrase command is easier to remember than gpg's flags. gpg --symmetric makes sense if you're already using gpg for other things and don't want a second tool.
Doing this with Carets
None of the three methods above work on a proprietary note database — they need a plain file to act on. That's exactly what Carets gives you: every note lives as plain text and Markdown, so it's always in a format age, gpg, or Disk Utility can use directly, with nothing to export or convert first.
Carets organizes notes into files, projects, and tags, so the note you're about to encrypt can sit right next to the ones you're not — no separate app needed just to isolate one sensitive draft. And because Carets is native on iPhone, iPad, and Mac, the notes you leave unencrypted stay fast to open and edit everywhere, while the ones that need privacy get pulled out and handled with whichever method above fits your habits.
One honest limit: Carets doesn't encrypt files itself, so this stays a manual step outside the app rather than a built-in feature. For most people, that's the right trade-off — a notes app that tried to build its own encryption would just be reinventing tools like age and gpg that already do the job well.