Encrypt Files with the Built-in security cms Command

macOS's security tool includes a CMS engine that encrypts and decrypts using keychain certificates.

macOScmssecurityencryptionMedium risk

Run `security cms -E -i file -o file.cms` to encrypt with one of your keychain identities and `security cms -D -i file.cms` to decrypt.

01Command

Command

$ # Encrypt (prompt lists your signing identities):
security cms -E -i secret.txt -o secret.txt.cms
# Decrypt back:
security cms -D -i secret.txt.cms -o secret.txt

02What it does

Few people notice that the `security` binary bundles a full CMS (cryptographic message syntax) engine — the S/MIME machinery Mail uses. With `-E` it encrypts a file to one of your own signing identities, producing a DER/SMIME blob; `-D` reverses it as long as the certificate and private key are present in any accessible keychain. It needs no extra installs, making it a handy zero-dependency alternative to gpg for single-user secrets.

03Risk

RiskMedium risk

RequirementsA signing identity (certificate + private key) in a keychain

!Warning: The output is binary unless you add encoding flags — don't paste it into text fields or emails untested.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

security — macOS Command Reference
SS64 · technical · 2026-09-17
Evidence: Documents the cms subcommand with -E (encrypt) and -D (decrypt).

Last verified: 2026-09-17 · Category: Security & Privacy

06Related solutions

Create an Encrypted Disk Image with hdiutil

macOShdiutilsecuritydisk-image

Build an AES-256 encrypted .dmg vault from the Terminal — no Disk Utility clicking required.

Low risk ✓ 2026-09-17

Verify an App's Code Signature with codesign

macOSGatekeepersignaturecodesign

Check whether an application bundle was signed properly and hasn't been modified since.

Low risk ✓ 2026-09-17