CryptKey

A macOS app that locks a folder: its contents are encrypted, the folder itself disappears, and only your password, your fingerprint, or your recovery key brings it back.

Built for macOS 26, distributed outside the Mac App Store with a Developer ID signature and Apple notarisation.

---

## The one thing that matters

**When you lock a folder for the first time, the app writes a recovery key file to your Desktop. Move it somewhere off this Mac — a USB stick, a printout, a safe — and then delete it from the Desktop.**

That key is the only way into your folder if you forget the password, if the keychain is lost, or if the Mac is gone. It cannot be regenerated. The app does not keep a copy.

Everything else in this app can be replaced. That cannot.

---

## What it protects you from, and what it doesn't

**It protects against someone at your unattended, logged-in Mac.** You walk away, someone sits down, and your locked folders are opaque to them. That is what it is for.

**It does not protect a stolen or discarded Mac — FileVault does.** Turn FileVault on. The app asks you to confirm it once, because it has no way to check.

**Locking never wipes anything.** On modern SSDs no application can guarantee erasure, and this one does not pretend to.

**macOS remembers file names the app cannot erase.** While a folder is unlocked, apps you open files with record their names in their Open Recent menus, and those names stay after locking. To stop macOS keeping those lists: System Settings → Desktop & Dock → Recent documents → None.

---

## Using it

**1. Add a folder to manage.** Pick something like your Documents folder. Anything inside it can then be locked without asking again.

**2. Lock a folder.** Choose one inside the managed folder and set a password of at least 12 characters — a memorable sentence beats a short scramble. The folder vanishes and a hidden, opaque folder takes its place. The recovery key file appears on your Desktop.

**3. Unlock it.** Password, or the recovery key. **Touch ID becomes available after the first unlock** — the app deliberately makes you use the password once, so you find out then rather than months later that you remember it.

**4. Lock it again** with the Lock button. The recovery key stays the same.

**Automatic locking** is on by default: on sleep, screen lock, and after 15 minutes idle. Open folders are also locked when you quit the app. If the app is killed while a folder is open — a crash, or Force Quit — the folder is shown in red on next launch as *"Unlocked and unprotected"*, with a button to lock it.

**Changing a password** is in the `…` menu on a locked folder. Nothing is re-encrypted, your recovery key still works, and Touch ID is unaffected.

---

## Things worth knowing

**A locked folder is portable; its key is not.** Copy the hidden folder to a USB stick or another Mac and the contents are unreadable there — the key never leaves the Mac that locked it. The exception is the recovery key, which is exactly why it belongs on paper somewhere else.

**The hidden folder has an unrecognisable name**, like `.39e507ad-….noindex`, and the app lists it under a placeholder until it is opened. That is expected: the real name is inside the encrypted part. Your recovery key file records which folder it belongs to. Press ⇧⌘. in the Finder to see hidden folders.

**Backups work.** A locked folder survives Time Machine, SuperDuper and ChronoSync, and restores intact.

**Two Macs, one shared folder: don't.** A folder on a network share is safe to use from one Mac. Locking or unlocking the same folder from two Macs at once is not protected against.

**Cloud-synced folders are refused** — iCloud Drive, Dropbox, OneDrive and similar. While a folder is unlocked its files are plain text, and a sync client would upload them in that state.

---

## Requirements

macOS 26 or later, on an Apple silicon Mac. Touch ID optional but recommended.

## Installing

Copy `CryptKey.app` to `/Applications` and open it. It is signed and notarised, so Gatekeeper will let it run without complaint.

---

**Icon:** `CryptKey/AppIcon.icon`, built in Icon Composer from the layered SVGs in `Icon/`.