A small native macOS menu bar app that locks and unlocks encrypted disk-image vaults (AES-256 APFS sparse bundles), and locks them again on sleep, screen lock or idle. The password is never stored anywhere.
brew install --cask roypadina/tap/vaultbar
- Your password is never stored. Not in the Keychain, not on disk, not in the clipboard. It goes to macOS's own disk-image tools through a pipe, and a person types it every time.
- It locks itself. Sleep, screen lock or idle: the vault unmounts without you remembering to. A panic hotkey locks everything at once.
- One click, native, scriptable. A menu bar icon, plus a
vaultbarcommand line,vaultbar://links and Raycast scripts. Built on macOS's own AES-256 APFS images: no kernel extension, no FUSE, no network.
A short, honest comparison. VaultBar is a small front end for macOS's built-in encrypted disk images, not a new encryption product.
| VaultBar | Cryptomator | VeraCrypt | |
|---|---|---|---|
| Platforms | macOS only | macOS, Windows, Linux, iOS, Android | macOS, Windows, Linux |
| How it encrypts | macOS's own AES-256 APFS images (hdiutil / diskutil) |
Its own per-file encryption in a folder | Its own volumes (needs macFUSE on a Mac) |
| Cloud sync | Warns about it; one big image is a poor fit for sync | Built for it (file by file) | Poor fit (one big container) |
| Kernel extension or FUSE | None | FUSE-style mount (macFUSE or FUSE-T) | macFUSE |
| Auto-lock | On sleep, screen lock and idle | Idle (and manual lock) | Auto-dismount options (logoff, screen saver, power saving, inactivity) |
| Panic hotkey, URL scheme, built-in CLI | Yes | No (a separate CLI project exists) | CLI |
| Cross-platform vault you can open anywhere | No, macOS only | Yes | Yes |
| Hidden volumes, plausible deniability | No | No | Yes |
| Independent security audits | No (it is a thin wrapper, but the code is small and open) | Yes | Yes |
| Price | Free, MIT | Free for desktop, paid mobile apps | Free |
Choose Cryptomator to sync encrypted files through a cloud service or to open the same vault on other systems. Choose VeraCrypt for hidden volumes or a container that works on every desktop OS. Choose VaultBar if you only use a Mac, want the vault one click away, and prefer macOS's own encryption with no extra drivers. Comparison from each project's public docs at the time of writing; check their sites for current details.
- One click — left-click the menu bar icon to lock or unlock your default vault. Right-click (or Control-click) for every vault (Unlock… / Lock, Open in Finder or Unlock & Open…), Lock All, New Vault…, Add Existing Vault…, Settings…. Hover the icon for its state and what a click does.
- Welcome window on first launch (once, also after an update): where the icon lives, that the password is never stored, a Launch at login switch and a first step. Reopen it from Settings → Welcome Guide….
- Icon hidden by a full menu bar? Open VaultBar again from Applications or Raycast: it opens Settings. While a window is open, VaultBar shows a Dock icon and a real menu bar (About, Settings…, Hide, Quit, Edit, Window).
- Open in Finder after unlocking (optional setting), or per vault with Open /
vaultbar://open. - Read-only unlock: per vault by default, or once with ⌥ in the menu ("Unlock Read-Only…"),
?readonly=1orvaultbar unlock --readonly. The password prompt shows the mode ("Work — Read-Only" with a blue icon, "Work — Read & Write" with an amber one) with a Read & Write | Read-Only switch you can flip before pressing Enter (⌘R). Nothing can be written to a read-only mount, and a forced lock can't lose anything. - Private mount: per vault, mount at a folder you choose (e.g.
~/Vaults/mnt/Work) instead of/Volumes, and optionally hidden from Finder (-nobrowse: not in the sidebar, Desktop or file pickers). The folder exists only while the vault is unlocked: VaultBar creates it (mode 700) right before unlocking and removes it after locking, also when the vault is ejected some other way (Finder,hdiutil detach, another app), so a locked vault leaves no empty folder anything could write into. It refuses a non-empty folder and any folder that syncs to a cloud. - Command line:
vaultbar status --json,vaultbar path Work,vaultbar unlock Work --wait 60, … (see below). - Panic lock: a global hotkey (default ⌃⌥⌘L, no Accessibility permission) locks every vault at once, forcing busy
ones unless you turn that off. ⌥-click the icon to lock all without forcing;
vaultbar://lockall. - Notifications when idle or screen-lock auto-lock locks a vault (sleep locks are silent), before idle auto-lock force-locks a busy one (with Keep unlocked 15 min), and when a lock fails (sleep included). The wording never names a vault: notifications can show on the lock screen. macOS asks for the notification permission after your first unlock, not at launch.
- History: the menu shows the last event ("Last: Locked Work (idle 15 min), 10:42"); History lists the last 50. Kept in memory only.
- Change password… (Settings, per vault, while it's locked), with a check that the new password opens the image.
- Unlock prompt hints: Caps Lock and the current keyboard layout, the usual causes of a "wrong" password. VoiceOver announces the prompt; Settings controls are labelled.
- Password popup that never saves anything: no Keychain, no "remember password", no clipboard.
- Auto-lock, for every vault:
- on sleep: forced, immediately;
- on screen lock: clean unmount; if a file is still open, forced after 30 s, but only if the screen is still locked;
- after N idle minutes: clean unmount; if busy, forced after 60 s, but only if you're still away.
- Pause Auto-Lock for 1 Hour — for long unattended jobs that work inside a vault (idle only counts keyboard and mouse). Sleep still locks. The icon gets a warning badge; the pause ends after an hour, on Resume, or on quit.
- New Vault… creates an encrypted AES-256 APFS sparse bundle, warns about weak passwords and about folders that
sync to a cloud (iCloud Drive, Desktop & Documents,
~/Library/CloudStorage, Syncthing, Synology Drive). - Add Existing Vault… for any encrypted
.sparsebundleor.dmg(unencrypted images are rejected). - URL scheme and optional Raycast Script Commands.
- Always running: the login item is a LaunchAgent (
~/Library/LaunchAgents/com.padina.vaultbar.login.plist), so macOS starts VaultBar at login and restarts it if it ever crashes (not after you choose Quit). Exactly one copy runs, and (from 0.2.1 on) never zero: when one copy hands over to another (a copy you started yourself handing over to the supervised one once it's idle, or an upgrade), the old copy quits only after the new one has confirmed it is running. No Dock icon, except while one of its windows is open. - Quit asks first while a vault is unlocked, since auto-lock stops while VaultBar is closed: Lock All & Quit, Quit or Cancel.
Menu bar icon: a monochrome notebook with a closed padlock when everything is locked; an amber open padlock as soon as any vault is unlocked (however it was mounted: VaultBar, Finder, Terminal); an orange warning badge while auto-lock is paused.
macOS 14 Sonoma or later · Apple Silicon and Intel (universal binary)
brew install --cask roypadina/tap/vaultbarNot notarized. VaultBar is signed with a self-made certificate (no paid Apple Developer ID), so macOS may block the first launch. Open System Settings → Privacy & Security, scroll down and click Open Anyway (right-click → Open no longer works on macOS 15+), or clear quarantine once:
xattr -dr com.apple.quarantine /Applications/VaultBar.appOr download VaultBar.zip from the latest release,
unzip it and move VaultBar.app to /Applications.
Upgrades (brew upgrade --cask vaultbar) are picked up automatically: within about 30 s, once nothing is in
progress, the running VaultBar starts the new version and quits as soon as it has taken over, so from 0.2.1 on
auto-lock never stops. The upgrade from 0.2.0 or older still runs the old version's restart, which can leave
VaultBar stopped for 1–2 s (coming from 0.1.2 or older, quit VaultBar and open it once after upgrading).
- Click the menu bar icon → New Vault… (or Add Existing Vault…).
- Save the password in your password manager first. There is no recovery key.
- Left-click the icon to unlock or lock. The password prompt is ready to type right away (also when opened from
Raycast or a
vaultbar://link); Enter unlocks, Esc cancels. The vault mounts in Finder like any disk. - Once per new vault, stop Spotlight from indexing it (VaultBar shows the command with a Copy button):
sudo mdutil -i off "/Volumes/<volume name>".
If a vault is busy when you lock it, VaultBar asks before forcing it. Forcing can lose unsaved changes in open apps.
Hold ⌥ in the menu to swap Unlock… for Unlock Read-Only… (or Unlock Read-Write… for a vault that unlocks read-only by default). ⌥-click the menu bar icon to lock everything. The menu shows "(read-only)" for read-only mounts.
~/.config/vaultbar/vaults.json (mode 600, never holds a password). Settings edits it for you:
{
"defaultVault": "Personal",
"autoLock": { "onSleep": true, "onScreenLock": true, "idleMinutes": 15 },
"launchAtLogin": true,
"raycastScriptsDir": "~/Raycast",
"openAfterUnlock": false,
"panicHotkey": "ctrl-opt-cmd-L",
"panicForces": true,
"vaults": [
{ "name": "Personal", "imagePath": "~/Vaults/Personal.sparsebundle" },
{ "name": "Work", "imagePath": "~/Vaults/Work.sparsebundle",
"mountPoint": "~/Vaults/mnt/Work", "hidden": true, "readOnly": true }
]
}idleMinutes: 0turns idle locking off.raycastScriptsDiris optional (no scripts without it).openAfterUnlock: trueopens the vault in Finder after every unlock: the menu bar click, the menu's Unlock…,vaultbar://unlockand the Raycast Unlock script. Defaultfalse.- Per vault, all optional:
mountPoint(a private mount folder; without it macOS uses/Volumes/<volume>),hidden(-nobrowse),readOnly(the default unlock mode). panicHotkey:ctrl-opt-cmd-L(default),ctrl-opt-cmd-K,ctrl-shift-cmd-L,opt-shift-cmd-Loroff.panicForces: falsemakes it ask for busy vaults instead of forcing them.- Vaults are matched by their image file, so a volume that macOS renamed to
Personal 1still shows the right state. - Removing a vault in Settings only removes it from the list. VaultBar never deletes an image file.
vaultbar://unlock/<name>
vaultbar://lock/<name>
vaultbar://toggle/<name>
vaultbar://open/<name>
vaultbar://unlock/<name>?readonly=1
vaultbar://lockall
The name is URL-encoded (My%20Vault); an empty name means the default vault.
- unlock shows the password popup; it does nothing if the vault is already unlocked. With
openAfterUnlock, Finder opens the vault afterwards. - lock locks (asks before forcing a busy vault). toggle locks or unlocks.
- open opens the vault in Finder; if it is locked, it asks for the password first, then opens it. Cancel does nothing.
?readonly=1(or0) overrides the vault's read-only setting for that unlock. lockall locks every vault (asks before forcing a busy one).
The cask links vaultbar into your PATH (built from source: /Applications/VaultBar.app/Contents/MacOS/VaultBar
with the same arguments).
vaultbar status [--json]
vaultbar path [<vault>]
vaultbar lock [<vault>] [--wait <seconds>]
vaultbar lock --all [--wait <seconds>]
vaultbar unlock [<vault>] [--readonly] [--wait <seconds>]
vaultbar open [<vault>]
No <vault> means the default vault. status and path only read; lock, unlock and open send the matching
vaultbar:// link, which also starts VaultBar if it isn't running. unlock never takes a password (not from
arguments, the environment or stdin): it opens the same popup, and a person types it. --wait waits until the vault
is unlocked (then prints its path) or locked.
| Exit code | Meaning |
|---|---|
| 0 | done |
| 1 | locked / not mounted (path), or VaultBar couldn't be reached |
| 2 | no such vault (or no default vault) |
| 3 | --wait timed out |
| 64 | usage error (unknown command or option) |
vaultbar unlock Work --wait 60 && my-agent --root "$(vaultbar path Work)"; vaultbar lock WorkPick your Raycast script directory in Settings → Raycast Script Commands. VaultBar then keeps three scripts per
vault there, Unlock, Lock and Open (vaultbar-unlock-<slug>.sh, vaultbar-lock-<slug>.sh,
vaultbar-open-<slug>.sh). The slug is the vault name in lowercase, with spaces and symbols turned into dashes
(e.g. My Vault → my-vault). VaultBar updates the scripts on every launch and when you add, rename or remove a
vault. Each script only runs open "vaultbar://unlock|lock|open/<name>"; the password goes into VaultBar's popup,
never through Raycast. VaultBar only ever deletes scripts it wrote itself (marked
# @raycast.packageName VaultBar).
- The password is never stored: not on disk, in the Keychain, in the config, in logs, in process arguments, environment variables or the clipboard.
- It reaches
hdiutil attach -stdinpass/diskutil image --stdinpassphrase createonly through a pipe on the child process's stdin, closed right after writing. An empty password is refused before any tool runs, so the system's own disk-image password dialog (with its "Remember password in my keychain" box) never appears. - Password bytes are zeroed after use. Best effort: the Swift
Stringthe text field hands over can't be wiped. - Change password… uses
diskutil image --stdinpassphrase chpass(old and new password on stdin), then checks that the new one opens the image. It re-wraps the key; it does not re-encrypt the data, so copies of the image made before the change (backups, snapshots) still open with the old password. For a full re-key, create a new vault and copy the files over. - The command line and the URL scheme have no password parameter; unlocking always means a person typing.
- Notifications never name a vault (they can show on the lock screen). History is kept in memory only.
- Lock events are logged (vault name and reason only) under the
com.padina.vaultbarsubsystem:log show --predicate 'subsystem == "com.padina.vaultbar"' --info --last 1h. - Encryption is macOS's own (DiskImages, AES-256). VaultBar is a front end; it makes no network connections.
VaultBar keeps the vault itself locked, but macOS and your apps can keep copies or traces of what you opened:
- QuickLook thumbnails: previews of vault files stay in the QuickLook cache after locking. Clear it with
qlmanage -r cache. - Recent items: apps' Open Recent lists and Finder's Recents remember file names and paths (in
~/Library/Application Support/com.apple.sharedfilelist). The files stay locked; the names don't. - Screenshots of vault content land on your Desktop (or wherever screenshots go), outside the vault.
- Clipboard managers keep whatever you copied from vault documents.
- Local AI / LLM apps store conversations, tool results and logs (often in a folder in your home directory). Anything a model read from the vault can stay there.
- Spotlight: turn indexing off for each vault once (
sudo mdutil -i off "<mount point>").
Safe by construction: the volume's own Trash (.Trashes) and document versions (.DocumentRevisions-V100) live
inside the encrypted image; swap is encrypted on Apple silicon and with FileVault; Time Machine backs up the image's
encrypted bands, not the decrypted files.
Requires Xcode or the Xcode command line tools (Swift 6).
git clone https://github.com/roypadina/VaultBar.git
cd VaultBar
swift test
Scripts/package_app.sh # writes dist/VaultBar.app
ditto dist/VaultBar.app /Applications/VaultBar.app
open /Applications/VaultBar.appRELEASE=1 Scripts/package_app.sh also writes dist/VaultBar.zip. The package script builds a universal (arm64 + x86_64) app. Scripts/make_icons.sh regenerates the icons
from Assets/icons/*.svg (needs brew install librsvg). An end-to-end test with a throwaway vault in .scratch/:
VAULTBAR_E2E=1 swift test --filter endToEnd. Scripts/e2e_launchd.sh tests "always one copy running" against
launchd (hand-off, an upgrade, a crash) with a separate headless test build. See CONTRIBUTING.md.
brew uninstall --zap --cask vaultbarOr run vaultbar --unregister-login-item (or turn off Launch at login in Settings), quit it, drag
/Applications/VaultBar.app to the Trash, and delete ~/.config/vaultbar. Your vault images stay where they are.
--unregister-login-item locks every unlocked vault first. It locks what it can; if one can't be locked (e.g. it's
busy), the login item stays and it exits 1. --force force-locks busy ones (unsaved changes in open apps may be lost).
If the config exists but can't be read, or the list of mounted images can't be read, it changes nothing and exits 1.
Have an idea for VaultBar? Request a feature and say what you're trying to do; that matters more than the exact feature. Found a bug? Report it.
Code is welcome too: small, focused pull requests, and an issue first for anything bigger. See CONTRIBUTING.md.
Tipped on Ko-fi? Add your Ko-fi name to the request and it goes to the front of my queue. It's a thank-you, not a purchase: no promise on what ships or when.
Free, open-source Mac menu-bar apps and terminal tools, all on one site: apps.roypadina.synology.me.
- LanGuard — Wi-Fi off when you're wired. Back on when you're not.
- SmartHiddenBar — Hide the menu bar clutter. Reach it in one click.
- Window Organizer — Clear the desk in one keystroke.
- Obsidian Vault Git Watcher — Never leave a vault uncommitted again.
If VaultBar keeps your private files one click away (and locked when you walk off), you can support its development — it's optional and always appreciated.
A ⭐ on the repo helps just as much.
MIT © Roy Padina