Which encrypted items show a hint?

The password hints are not stored on the local computer as such.

Instead for APFS it is stored on the encrypted drive itself in the "volume passphrase hint" key bag. You can read the specifics here APFS File System Reference.

For HFS+ it is stored in the "PassphraseHint" entry of the "CryptoUsers" structure in the "com.apple.corestorage.lvf.encryption.context" structure in the CoreStorage XML plist on the encrypted drive. You can read the specifics here FileVault Drive Encryption

Note that password hints are only stored for passphrase (i.e. password) protected drives.

Therefore I cannot confirm your assumption. This is always the case.

Note: In the answer from lx07 I see that he concludes that the hint is not stored on the drive after looking for it with a hexeditor. That is not correct. The PLIST is compressed using DEFLATE and the hint itself might be base64 encoded. You'll need to decompress the data before searching for the hint, if you want to find it manually that way.

In addition take note of section 7 of the reference FVDE document (The encryption context plist) - namely that depending on your setup the PLIST containing hint could be located outside the encrypted partition, and instead be stored on the "Recovery HD" partition on the same physical drive. It can be stored either in unencrypted or encrypted form. In case of encrypted form, the AES-XTS key is the volume identifier of the encrypted volume (i.e. the key is stored non-encrypted on the drive).


For APFS volumes the hint is stored on the volume. See Apple File System Reference.pdf

Page 120

The volumeʼs keybag might contain a passphrase hint for the user (KB_TAG_VOLUME_PASSPHRASE_HINT), which you can display when prompting for the password.

Page 131

KB_TAG_VOLUME_PASSPHRASE_HINT The key data stores a userʼs password hint as plain text.

This will show a hint when you try to open it.

APFS volume

Encrypted HFS (macOS Extended) however doesn't have the Show Hint/Hide Hint button :

HFS volume

Unlike for APFS I could not find detailed documentation for the layout of CoreStorage volumes but looking with hex editor of an encrypted HFS volume the hint is not stored in plaintext. EDIT: See the answer by jksoegaard for how it is stored and link to FireVault Drive Encryption documentation.

This was tested on Mojave version 10.14.6 - whether the Show Hint button was shown on earlier versions I do not remember.

This issue of encrypted HFS+ volumes not showing hint is discussed more in this unresolved question - How do I get the password hint for an encrypted disk?