Skip to content
elba.works

Guides/Elba vs FileVault

Elba vs FileVault: macOS full-disk plus folder-level fencing

FileVault encrypts your Mac's disk while it is off. Elba seals one folder while you are logged in. As with BitLocker on Windows, these are two layers of the same idea rather than competitors.

At a glance

Elba compared with FileVault
 ElbaFileVault
Unit of protectionA folder you chooseThe whole startup disk
Protects a stolen, powered-off MacYes, for the sealed folderYes, for everything
Protects while logged inYesNo
Recovery key held byOnly youYou, or your iCloud account
Cross-platformYesmacOS only
Admin rightsNot neededNeeded
PriceOne-time, falling yearlyIncluded with macOS

What FileVault covers

FileVault is very good at its job. Turn it on — and on a modern Mac you should — and a powered-off machine is a brick to anyone without your account password. Apple's Secure Enclave makes the key handling genuinely strong.

What it does not do is distinguish between the files on your Mac once you are logged in. Every process, every Time Machine backup, every iCloud Drive sync, and every person who sits at your unlocked desk sees the same plain filesystem.

The iCloud recovery option

FileVault offers to store your recovery key in iCloud. It is convenient, it has saved a great many people from disaster, and it means Apple can be compelled to assist in recovering your disk. Whether that matters is a question about your threat model, not about Apple's integrity.

Elba has no such option. There is no recovery key, no escrow, and no one to compel. The cost is that a forgotten passphrase is final.

The shared-Mac case

Separate macOS user accounts already keep files apart, so if everyone in the house has their own login you are largely covered. The folder layer matters when the account is shared, when the Mac is managed by an employer, or when a specific folder should stay closed even to you-in-a-hurry.

When FileVault alone is enough

Single-user Mac, own account, nothing synced you would mind, no one else ever touching the machine. FileVault covers the realistic threat and a second layer is optional comfort rather than necessity.

iCloud Drive and the Desktop-and-Documents setting

macOS offers to sync your Desktop and Documents folders to iCloud Drive, and a lot of people accept it without registering what it means: those files now exist on Apple's servers, encrypted in transit and at rest by Apple, with Apple holding keys unless you have enabled Advanced Data Protection.

Sealing a folder before it lands in that path means the copy that leaves your Mac is ciphertext that only your passphrase opens. That is the single most common reason Mac users add a folder layer on top of FileVault.

Time Machine keeps what you deleted

Time Machine is excellent and you should use it. It also means a document you deleted in March may still exist on the backup disk in November. If that document was sensitive, deleting the original did less than you thought.

A folder sealed from the start is backed up sealed, so the historical copies are ciphertext too. It is worth thinking about before you seal an existing folder: the older plaintext versions may already be in your backup history.

Who Elba is for

Elba is for the Mac user who has FileVault on and still keeps one folder — the medical records, the manuscript, the estate documents — that should not be readable by anyone who borrows the laptop for ten minutes.

Questions people actually ask

Should I use FileVault and Elba together?
Yes, that is the intended shape. FileVault for the machine, Elba for the folder.
Does Elba slow down a Mac?
No. It runs in a browser tab and only does work while sealing or opening files.
Is FileVault enough for HIPAA or similar?
Full-disk encryption is usually part of a compliance answer, not all of it. Talk to whoever owns compliance where you work.
Can Elba open files sealed on Windows?
Yes. The sealed format does not care which operating system created it.
Does Elba work in Safari?
Elba targets Chromium-based browsers, which on a Mac means Chrome, Edge, Brave, or Arc.
What if I forget the Elba passphrase?
The folder is unrecoverable. There is no equivalent of FileVault's iCloud recovery key.

Take the island

Elba is one HTML file. It runs locally in a Chromium browser, seals a folder with AES-256-GCM, never phones home, and becomes open source on 1 January 2030.

  1. €49MMXXVI· now ·
  2. €39MMXXVII2027
  3. €29MMXXVIII2028
  4. €19MMXXIX2029
  5. FreeMMXXX2030

the price falls each year · free to all 1 jan 2030

Take the island — €49
pay once · no account · nothing leaves

Compare Elba with other tools

All guides

Related guides