Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there any built in command-line tools that I can encrypt and decrypt a text file (and provide it some sort of password).

share|improve this question
Built in = comes with the Mac, pre-installed? – wizlog Dec 21 '11 at 21:02
up vote 16 down vote accepted

openssl comes pre-installed on Mac OS X.

You can use the following commands:

# encrypt file.txt to file.enc using 256-bit AES in CBC mode
openssl enc -aes-256-cbc -salt -in file.txt -out file.enc

# the same, only the output is base64 encoded for, e.g., e-mail
openssl enc -aes-256-cbc -a -salt -in file.txt -out file.enc

# decrypt binary file.enc
openssl enc -d -aes-256-cbc -in file.enc -out file.txt

# decrypt base64-encoded version
openssl enc -d -aes-256-cbc -a -in file.enc -out file.txt

(copied from OpenSSL Command-Line HOWTO: How do I simply encrypt a file?)

These commands use 256-bit AES ecryption with Cipher Block Chaining (CBC), which is about as secure as it gets right now.

share|improve this answer
where do you enter your password? – codecompleting Jan 10 '12 at 22:38
Once you executed any of the above openssl commands, it asks you to enter aes-256-cbc encryption password. – Dennis Jan 10 '12 at 23:45
@codecompleting Or specify -pass pass:MYSECRETPASSWORD, although the password is then of course not hidden from ps, etc. – A-B-B Nov 10 '14 at 5:05
If you use a salt, you will still be able to decrypt the file on a separate machine using only the password, correct? (I understand that salts are to prevent rainbow tables, I just want to be sure I'm correct that the password is all that I would need to open the file on another box.) – Wildcard Apr 20 at 1:15
@Wildcard Yes, the salt (actually, initialization vector) gets stored with the ciphertext in the encrypted file. – Dennis Apr 20 at 1:40

Mac OS X has the ability to create encrypted container files (similar to e.g. Truecrypt), that can optionally grow with the amount of data placed in them. Use Disk Utility to do this.

In Disk Utility, select File » New » Blank Disk Image… with one of the sparse image formats. Select AES-128 or AES-256 as encryption.

From the command line, the same functionality is available via the hdiutil program.

share|improve this answer
A bit overkill for a single text file intended for command line access, isn't it? Can you open the file later via Linux et. al.? – Wildcard Apr 20 at 1:17
@Wildcard Possibly (scope has a tendency to change); and no, but wasn't part of the question. – Daniel Beck Apr 20 at 6:18

I've built a shell script for that. You can use it on Mac or on Linux.

#encrypt files with aes-256-cbc cipher using openssl

#encrypt files
if [ $1 == "-e" ];
    if [ -f "$2" ];
    openssl aes-256-cbc -a -e -salt -in "$2" -out "$2.aes"
       echo "This file does not exist!" 
#decrypt files
elif [ $1 == "-d" ];
    if [ -f "$2" ];
        openssl aes-256-cbc -a -d -salt -in "$2" -out "$2.decrypt"
        echo "This file does not exist!" 
#show help
elif [ $1 == "--help" ];
    echo "This software uses openssl for encrypting files with the aes-256-cbc cipher"
    echo "Usage for encrypting: ./encrypt -e [file]"
    echo "Usage for decrypting: ./encrypt -d [file]"
    echo "This action does not exist!"
    echo "Use ./encrypt --help to show help."

Simply save this in a text file in issue chmod +x file to make it executable. after that use ./filename --help to get infos.

share|improve this answer
Needless use of -a will needlessly bloat the output file. – A-B-B Nov 10 '14 at 5:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .