I'm currently trying to find my personal best solution for storing passwords and other sensible data. Recently I've used 1Password on iPhone and Mac but I'm not really satisfied with its predefined structure and storage scheme.

So I've decided to give a simple plain text file another chance... ideally a Wiki like editor with Markdown syntax - like TrunkNotes. But I've not yet found my final solution.

But now to the point: I plan to store that data on an encrypted volume in my DropBox to be accessible wherever I've need for. Since DropBox needs to transfer the whole file upon change I've thought about a growing sparse image created with the DiskUtilities from Apple using AES-256 encryption. Is the Apple solution equally secure as a TrueCrypt using the same encryption?

Both solutions rely on images that hold several files. Is there any alternative that can easily be integrated into the OS to encrypt single files instead of whole disk images? That would significantly reduce overall sync traffic.

  • 4
    Have you looked at GPG? It has been a while since I looked at it, but I seem to remember them having a secure text editor that would decrypt a file and allow you to edit it, and then reencrypt it. It would handle memory and temporary files so as to not leak information.
    – mikeazo
    Commented Mar 12, 2012 at 11:52
  • 1
    I'll check this out... suppose you mean gnupg.org Commented Mar 12, 2012 at 13:24
  • Gave it a try... but the handling of encrypt/decrypt with copies of the files being generated is not ideal. Also the need for defining myself as receiver is not very intuitive. Commented Mar 12, 2012 at 20:38
  • Hmm, must have changed some since I last used it. Anottherone to try is called Encryption Wizard spi.dod.mil/ewizard.htm
    – mikeazo
    Commented Mar 12, 2012 at 20:51

4 Answers 4


Is the Apple solution equally secure as a TrueCrypt using the same encryption?

Assuming that there is no "publicly known" security flaw within the file structure of the images created by said applications, the logical strength of said "container" would depend on the encryption algorithm utilized as well as the pass phrase implemented. Although, there are conspiracy theories surrounding TrueCrypt, they are beyond the scope of this question.

Is there any alternative that can easily be integrated into the OS to encrypt single files instead of whole disk images?

Yes, GnuPG, as stated by "mikeazo". You could generate a key-pair and encrypt your "sensitive" data using the public-key. You could write a script which would encrypt and decrypt, etc, all required files as necessary.

On the note of encryption algorithms, Blowfish, designed by Bruce Schneier, has the following notes based on cryptanalysis work:

There is no effective cryptanalysis on the full-round version of Blowfish known publicly as of 2011. A sign extension bug in one publication of C code has been identified. In 1996, Serge Vaudenay found a known-plaintext attack requiring 28r + 1 known plaintexts to break, where r is the number of rounds. Moreover, he also found a class of weak keys that can be detected and broken by the same attack with only 24r + 1 known plaintexts. This attack cannot be used against the regular Blowfish; it assumes knowledge of the key-dependent S-boxes. Vincent Rijmen, in his Ph.D. thesis, introduced a second-order differential attack that can break four rounds and no more. There remains no known way to break the full 16 rounds, apart from a brute-force search. Bruce Schneier notes that while Blowfish is still in use, he recommends using the more recent Twofish algorithm instead.

~ Wikipedia

GnuPG can utilize Blowfish; Blowfish has also been included in the mainline GNU/Linux kernel since version 2.5.47. A list of products utilizing the Blowfish cipher may be found here.

On a side note, the key size utilized by the encryption algorithm (chosen by you) also plays a role in the overall security of said information. Generally, the larger the key (measured in bits {b}), the more computing power required to brute-force said pass phrase.


You can do file level encryption in OSX with the openssl shell command's enc option.

A bit tedious to type every time, of course, but you can automate it with a shell script, or find a gui front end to it like Fileward.

However, there's a gotcha with this method: you have to be sure you securely delete the original file after you make the encrypted version.

  • OS X offers an option to securely delete trash contents. Choose Finder > Secure Empty Trash. When you see a warning message, click OK. (support.apple.com/kb/PH13765)
    – SPRBRN
    Commented Nov 4, 2014 at 10:02

For fast, easy, and free file encryption, nothing beats Encryption Wizard

The latest version even has an encrypted password / key organizer.


You can install EncFS on your Mac. I've installed it on a Linux desktop, and tried to install it on my Mac as well, but for some reason I cannot get it working. I suppose that is a problem with my laptop, not with OS X.

  • EncFS was not that stable back in the but now it works for me. I'm just using the brew install encfs version
    – kizzx2
    Commented Feb 25, 2016 at 18:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .