I wrote before about my odd set up for backups. I bought a new computer recently and wanted to create those odd backups again and I discovered that setting up encrypted sparse bundles was harder than I remembered! So I documented it this time for other people.

First, use Disk Utility to create an encrypted sparse bundle disk image and then mount it. It doesn’t matter what you call it. Just make sure that it is a sparse bundle image and not anything else. You also want to make sure that it is of a sufficient size to hold all of your backups. If your laptop disk is 1TB maybe make the sparse bundle 2TB or 4TB or something.

Next, you’ll want to tell your computer to use it for backups:

sudo tmutil setdestination /Volumes/mysparsebundle

After the backup starts immediately stop it. You’ll see a new sparse bundle inside the first sparse bundle. That new sparse bundle is the one with your backups in it. You will want to encrypt the new sparse bundle:

hdiutil convert /Volumes/mysparsebundle/laptopname.backupbundle \
    -format UDSB -encryption -o /Volumes/mysparsebundle/laptopname.sparsebundle

You can verify that you’ve encrypted it by running either of these commands:

hdiutil imageinfo laptopname.sparsebundle | grep Encrypted
hdiutil isencrypted laptopname.sparsebundle

Now that it is encrypted and you’ve verified that it is encrypted you can copy the encrypted sparse bundle off of the original sparse bundle and directly to the external drive:

mv /Volumes/mysparsebundle/laptopname.sparsebundle /Volumes/externaldrive/

You can now unmount and remove the old, original sparse bundle since you’ve copied the actual backup sparse bundle out of it.

Finally, you will need to mount laptopname.sparsebundle and tell your computer to back up to that file instead, like this:

sudo tmutil setdestination /Volumes/Time\ Machine\ Backups

And now you’re backing up to an encrypted sparse bundle. Since you interrupted the initial backup earlier you will want to start it for real now and let it finish. Note, though, that macOS will tell you that you are backing up an encrypted disk to an unencrypted disk. You know for a fact that that is wrong because you already verified that the sparse bundle is encrypted so you can ignore this warning.