APFS folder encryption?

From the feature list APFS supports per-file encryption. Hence by extension it should be possible to setup an encrypted folder (or at least just the files within that folder) with a password that is different than the user login password. Similarly, it should be possible to encrypt users' home directories with their own respective keys, and render them inaccessible to one another despite whatever their file permission says (similar to what Windows' NTFS able to do since the previous century).

The question is that how to do that from a user's point of view? I've yet to see any UI in the Finder that can do this in macOS High Sierra. Is there a way in the command-line to enable this?

Solution 1:

One possible way to do this without resorting to the command line is to create a resizable encrypted volume through Disk Utility. It acts as a folder that is decrypted during the mounting process. It supports APFS and AES 128/256.

To create a new blank encrypted folder:

Disk util > new image > new blank image > set Format: APFS > choose encryption scheme > set Image Format: read/write > OK.

To encrypt an existing folder:

Disk util > new image > new image from folder > APFS > choose encryption scheme > set Image Format: read/write > OK.

This will create the encrypted folder as a .dmg that is decrypted when you mount it. Once mounted it acts just as a normal folder.