How to Encrypt Files and Folders with a YubiKey on macOS

Most file encryption on a Mac comes down to a password: something you can forget, reuse, or type into the wrong place. A YubiKey replaces that with something you hold. You tap the key, and only that physical key can unlock the file.

This guide covers how that works in VaultSort, which keys are compatible, how to avoid being locked out, and the steps to encrypt and decrypt files and folders.

New to security keys? Start with what a YubiKey is and what it can do. For the full technical design, see the free encryption whitepaper and VaultSort V4: hardware-bound file encryption.

Why Use a YubiKey Instead of a Password

• Nothing to remember or leak. There's no password to forget, reuse or have phished.
• The key never touches your disk. Each file's encryption key is protected by a secret that only your physical YubiKey can produce, through the WebAuthn PRF extension. An attacker with a copy of your encrypted file and your Mac's disk still can't open it without the key.
• Strong, standard encryption. File contents are sealed with AES-256-GCM, which also detects tampering.
• Works on Windows too. The same YubiKey opens the same files in VaultSort on a Windows PC, so files can move between machines with you.

Which YubiKeys Work

VaultSort needs a security key that supports the WebAuthn PRF (hmac-secret) extension. That includes:

• The YubiKey 5 series
• The Security Key series by Yubico
• Other modern FIDO2 keys with PRF support, such as Google Titan and Feitian keys

Older U2F-only keys, such as the YubiKey 4, aren't compatible. VaultSort checks for PRF support when you register a key, so you'll know straight away.

If you'd rather not carry a key, Touch ID works the same way on Macs running macOS 14 Sonoma or later. Windows Hello does the same on a PC.

How It Works

1. Register your key once. In VaultSort's key settings, register your YubiKey and give it a name ("Keyring key", "Backup in the safe").
2. Encrypt. VaultSort creates a random key for the file, encrypts the file with it, and wraps that key with a secret only your YubiKey can produce.
3. Decrypt. Tap the key again; VaultSort unwraps the file key and opens the file.

The file header stores only non-secret details about which credentials can open it, never the key itself.

About the browser tab: the WebAuthn step runs on a local localhost page, so a browser tab opens briefly while you tap your key, then closes by itself. Use a Chromium-based browser (Chrome, Edge or Brave); Safari and Firefox may not support the PRF extension yet.

Don't Lock Yourself Out: Backup Keys and the Recovery Code

Hardware encryption is only as good as your plan for losing the hardware. VaultSort builds that in:

• Register more than one key. A single file can be opened by several keys, so register a second YubiKey and keep it somewhere safe. Any one of them opens your files.
• Save the recovery code. When you register your first key, VaultSort offers a recovery code: a long passphrase hardened with Argon2id. If every key is lost, the recovery code still opens your files. Keep it on paper or in a password manager on another device, never only on the Mac it protects.
• Rotate keys without re-encrypting. Retiring a key, or adding a new one, doesn't mean re-encrypting every file.

Step by Step: Encrypt Files and Folders with a YubiKey

Set up (once):

1. Install VaultSort and open its key settings.
2. Insert your YubiKey and register it. Then register a second key if you have one.
3. Save the recovery code somewhere off the Mac.

Encrypt:

1. Select the file or folder in VaultSort.
2. Click Encrypt and tap your YubiKey when prompted.
3. The file is now encrypted; only your registered keys or the recovery code can open it.

Decrypt:

1. Select the encrypted file or folder.
2. Click Decrypt and tap your YubiKey.

Encrypted files stay encrypted when they're copied, backed up or emailed, unlike whole-disk encryption such as FileVault, which only protects files while they're on that disk. Use both: FileVault for the Mac, VaultSort for the files that matter most.

Encrypting Many Files: The Vault

If you'd rather not encrypt files one at a time, the Vault is an encrypted place on your disk where everything you put in is encrypted on the way in. It opens with your YubiKey, Touch ID, Windows Hello or a password, and locks itself when your Mac sleeps.

Try It

YubiKey encryption is part of VaultSort's paid licence: $24.99 once, for up to six Macs or PCs.

VaultSort provides strong encryption tools, but always keep backups and follow good security practice. For enterprise deployments, involve your IT security team.