Apple has quietly confirmed that macOS 28 will drop support for encrypted Mac OS Extended volumes, meaning any external drive still using encrypted HFS+ will stop mounting on a Mac once that update lands. The disclosure came via a new support document, not a keynote slide, and it affects an install base far larger than Apple probably wants to admit: anyone still running an old encrypted external hard drive for archival storage, backups, or a legacy media collection.
The document is blunt about the change: starting with macOS 28, “the Mac OS Extended file system format will be supported only for volumes (disks and other storage devices) that aren’t encrypted.” Unencrypted HFS+ drives are fine and will keep working. Encrypted ones will not. Apple gives no technical justification beyond that single sentence, which is exactly the kind of vague, take-it-or-leave-it phrasing that tends to annoy longtime Mac users, and did.
MacOS 27, currently in beta and due for public release in September 2026, still reads and writes encrypted HFS+ drives without issue. The real deadline is macOS 28, expected in fall 2027. But Apple says that starting with macOS 26, a Mac might pop up a notification if it detects an encrypted Mac OS Extended disk that won’t carry over, naming the affected volume directly. That is Apple’s early-warning system, and it is the first sign most users will actually see of this change.
You can also check manually right now. Open Disk Utility, select the volume, and look at the format description underneath its name. Apple’s own example of an affected format looks like this:
CoreStorage Logical Volume • Mac OS Extended (Case-sensitive, Journaled, Encrypted)
If a drive shows “Encrypted” next to Mac OS Extended, it’s on the list. Plain Mac OS Extended without encryption is untouched by this change.
Apple lays out two paths for anyone with an affected drive, and they are not interchangeable:
- Reformat: back up the drive’s contents first, then erase and set it up again in APFS or APFS (Encrypted) via Disk Utility. This wipes the data on the drive but guarantees it keeps working on future macOS versions.
- Decrypt: connect the drive, unlock it with its password, then Control-click its icon in Finder and choose Decrypt, entering the password again to start. This preserves the existing data without erasing anything.
Apple warns that decryption “takes time, especially for large volumes,” and you can track progress in Terminal if you want to watch it crawl. Once decryption finishes, you can optionally run Disk Utility’s Convert to APFS option without erasing the drive, then re-encrypt it afterward if you still want encryption. One important exception: this decryption path does not apply to encrypted Time Machine backup disks, so anyone using an old encrypted spinning drive for Time Machine needs a different plan entirely, and Apple’s document doesn’t spell one out.
APFS has been the default file system on the Mac since High Sierra in 2017, and Apple has been walking away from HFS+ ever since, just slowly. Encrypted HFS+ relies on CoreStorage, Apple’s legacy logical volume manager, which Apple quietly pulled from Disk Utility’s format-creation options back around Big Sur and Monterey. That was 2021. This support document is less a new decision than the formal end of a process that’s been running for five years.
There’s also a fair question nobody’s gotten a straight answer to: why strip only the encryption support and leave base HFS+ alive? If there’s a specific unpatched vulnerability in the encrypted CoreStorage path, Apple hasn’t said so. Separately, HFS+ carries a known year-2040 timestamp limitation, so anyone treating these drives as permanent archival storage has a second, unrelated expiration date to worry about regardless of what Apple does with encryption.
The practical takeaway is simple, if you’ve got an old encrypted external drive sitting in a drawer, plug it in now and check its format in Disk Utility, not in 2027 when macOS 28 ships and it stops mounting. Apple has given people over a year of runway here, which is more notice than it usually offers for this kind of thing. But a support document nobody reads until their drive stops working isn’t really a warning system, it’s a liability shield.
