Disk Utility vs. FileVault for external drive encryption?

[jzw (Jolin)]

@Technogeezer

I’m remembering something about Apple disabling the ability to encrypt HFS+ volumes. IIRC, I tried this on a HFS+ volume and found that the HFS+ volume got converted to APFS.

Yes, this is the case from MacOS 10.15 Catalina :

@jzw

as well as removing HFS support 10.15 Catalina dropped support for creating encrypted HFS+ partitions. And if you have an existing HFS+ disk or partition and choose to encrypt it (by ctrl-/right-clicking on it in the Finder), it will first be converted to APFS. Existing encrypted HFS+ disks are supported for read/write, there’s just no way to create them (even using diskutil on the command line).

I learnt this the hard way when I got my M1 MacBook Pro which was my first Mac running a version of MacOS greater than 10.14. Luckily I was able to recover, again using my MacBook Air running 10.14 to create the encrypted HFS+ external disks that I need. It’s another very irritating deprecation, especially given the abysmal performance of APFS on hard disks with lots of files.

@Sebby

If you use the “diskutil” CLI tool, you should get more control over the process.

Unfortunately not. There is literally no way to create an encrypted HFS+ volume from 10.15 Catalina onwards, even using diskutil cs.

@Shamino

But I think enabling/disabling encryption on the fly only works for APFS volumes.

No, encrypting/decrypting on the fly works for HFS+ volumes as well (ctrl-/right-clicking on the volume in the Finder and choosing Encrypt or Decrypt as appropriate). The catch is that to encrypt and keep it in the HFS+ format, you need to use a version of MacOS that supports creating encrypted HFS+ volumes – 10.14 Mojave or earlier.