Password-protecting notes on a Mac: your options compared

Checked November 2026 against Apple's support pages linked below. I make Coffee, so read this with that in mind. Coffee isn't affiliated with Apple.

A Mac already has three ways to do this, all free: lock a note in Apple Notes, put your files in an encrypted disk image, or turn on FileVault for the whole disk. They protect different things, so the right one depends on what you're worried about. Coffee, the Markdown editor I make, has a fourth for Markdown notes, with limits I set out below. The biggest: if you lose both its key and its recovery key, the note is gone for good.

I'm not ranking these by strength. Nothing I've read supports a ranking, and Coffee's private notes have had no outside security review.

At a glance

Locked notes in Apple Notes

This is the simplest choice if your notes are already in Notes. Apple's steps:

1. Choose Notes > Settings, then pick Use Login Password or Use Custom Password beside Locked notes.
2. Open the note, click the More button next to the search field, and choose Lock Note.

Opening one locked note opens all of them in that account while you use Notes. They close again after a period of inactivity or when you quit.

Not every note can be locked. Apple lists Quick Notes, notes shared with others, notes with a video, audio file, PDF or document attached, notes with tags, and notes in an iCloud account that hasn't been upgraded. The note must be in iCloud or on your Mac. For iCloud accounts, Apple's iPhone and iPad article says locked notes use end-to-end encryption and that Apple doesn't have access to them.

Pay attention to the password. Apple warns that if you forget a custom password and can't use Touch ID, you can't view those notes, and Apple can't help. Resetting the password doesn't reopen old notes, as they keep the password they were locked with, so Apple recommends changing it instead.

An encrypted disk image

A disk image is a single file that opens like a drive. It suits a folder of notes in any format, in any app. Apple's steps in Disk Utility:

1. Choose File > New Image > Blank Image.
2. Give it a name and size, and choose APFS as the format.
3. Choose an option from the Encryption menu, then enter a password.
4. Under Image Format, choose read/write disk image, then save.
5. Copy your files on to it, and remove the originals.

To use it, double-click the image and enter the password. Eject it when you're done, because Apple notes that anyone with access to your computer can use the contents while it's mounted. If you forget the password, you can't open the image.

You do have to size it, open it and eject it, and that step is easy to forget when you're in a hurry.

FileVault

FileVault encrypts the startup disk, so it's about a lost or stolen Mac and not about one particular note. You turn it on in System Settings > Privacy & Security > FileVault, as an administrator, and choose your iCloud account or a recovery key as the way back in if you forget your password.

Macs with Apple silicon or a T2 chip already encrypt their data, and Apple says FileVault adds the requirement for your login password. Keep any recovery key away from the Mac itself. If you can't reset your password and you've lost the recovery key, Apple warns that your files and settings are lost forever.

FileVault works alongside everything else here. It's worth having whichever way you lock your notes.

Private notes in Coffee

Press ⌘L in a note and Coffee encrypts its file. Each note is AES-GCM with a 256-bit key held in the Keychain, and images under attachments/ are encrypted with the note's key. Coffee shows you a recovery key the first time, which is that same key written out. Locking removes any comments on the note, as they can't be kept on a private note.

What this protects against

• Someone who gets your notes folder without the key, such as in a synced folder or a copy of just that folder, can't read the text or those images.
• Search, Spotlight, Quick Look and AI apps connected over MCP don't see a private note's text or images.

What it doesn't protect against

• The file name stays readable. A note's file name is its title, so don't put a secret there. Its size, its dates, and how many images it has and how big they are can also be seen.
• The recovery key opens everything. Anyone who has it and your files can read your private notes. It can't be changed, and removing a lock and locking again uses the same key.
• A copy of the whole disk or home folder. That includes a stolen disk without FileVault, or a Time Machine backup. The key is in your login keychain, which sits beside the notes in such a copy and is protected by your login password, so a guessed password opens both.
• Someone using your Mac while it's logged in, or anything running as you. The Keychain gives Coffee the key, and an open note is plain in memory.
• What came before the lock. Deleting a file doesn't erase it from the disk, Time Machine or iCloud's history, and text copied earlier stays in clipboard history.
• What you take out. Exports and copied text aren't protected, and neither is a copied recovery key, which stays on the system clipboard until it's replaced.
• Images kept elsewhere. Images linked from anywhere other than attachments/ aren't moved or encrypted. An image that a non-private note also uses keeps its readable copy, and Coffee tells you when that happens.
• Swapped files. Tampering is detected, but a file could be swapped for an older version of itself, or for another note or image encrypted with the same key.

The code hasn't had an outside security review, so read all of this as what the design intends.

If you lose the key and the recovery key, your notes are gone

Nobody can open the note after that, including Coffee, which keeps no copy of your key. The key doesn't use iCloud Keychain, so it doesn't follow you to a new Mac that way. You need the recovery key to open private notes on another Mac, or on this one if its keychain is lost. Save it somewhere that isn't this Mac, such as a password manager, before you rely on any of this. Settings has a Show button for it under Recovery key.

Where Apple's options are better

They're free and already on your Mac, with no extra app to trust or pay for. A disk image holds any kind of file and works with any app. FileVault covers the stolen-disk case that Coffee's private notes specifically don't. Locked notes can also be viewed on your other Apple devices, which Coffee can't offer, as it's Mac only.

Where Coffee is different

Your note stays an ordinary file in your notes folder, one encrypted file for each note, so it can sit in a synced folder next to the unlocked ones. Locking covers one note and the images it keeps under attachments/. There's also a second way back, the recovery key, if the Keychain is lost. That only helps if you saved it, and it's also a second thing someone could steal.

The Apple pages I read don't say whether a locked note's title stays visible, so I can't compare that with Coffee, where the file name stays readable.

Choose Apple's options if

• Your notes are in Notes, and they're text, images or scans you don't need to tag: use locked notes.
• You want to protect a set of files of any kind: use a disk image.
• You're worried about losing the Mac: use FileVault, whatever else you do.

Choose Coffee if

You already keep notes as Markdown files, you want to lock a few of them where they sit, and the limits above are acceptable for what's in them. If a note would do real harm in the wrong hands, weigh the missing security review seriously.

Questions

Does FileVault password-protect my notes?

Not one by one. It protects the startup disk, and once you've logged in your notes open as usual. Coffee's private notes don't cover someone using your logged-in Mac either.

What happens if I forget my Apple Notes password?

With a custom password and no working Touch ID, you can't view those locked notes, and Apple says it can't help. Resetting only affects notes you lock afterwards.

Can Coffee recover a private note if I lose my key?

No. If you've lost both the key and the recovery key, nobody can open the note, including Coffee.

Does Coffee hide the title of a private note?

No. The title is the file name, and it stays readable. So do the file's size and dates.

Has anyone audited Coffee's private notes?

No. There has been no outside security review.