While it’s popular among third-party password managers to offer support for secure storage of files and other data beyond standard secrets like passwords, keys and certificates, macOS keychains are more limited. They can store secure notes, but those are currently only accessible in file-based keychains, and there’s no facility for larger files or arbitrary content. This article lists some of the other options provided by macOS, each of which is free, secure, and doesn’t rely on any external service, even iCloud. Because of the architectural differences between Intel Macs without a T2 chip and more recent models, I limit coverage to Intel Macs with T2 chips and Apple silicon Macs, with their Secure Enclave.
FileVault
We tend to overlook the importance of FileVault, but when enabled it provides excellent protection to the entire contents of the Data volume, normally including everything in your Home folder. However, it doesn’t cover volumes on external storage, unless they’re Data volumes in another boot volume group with FileVault enabled there. On internal storage, FileVault comes at absolutely no cost, as your password isn’t used to encrypt the volume, but controls access to the Volume Encryption Key (VEK) used for that purpose. For internal SSDs, this is performed through the Secure Enclave, thus practically impossible to hack or circumvent.
Apple provides full details in its Platform Security Guide, with a detailed account of the Secure Enclave across Apple’s different chips.
Read more at eclecticlight.co