macOS 28 encrypted HFS+ to APFS conversion explained: drives and Time Machine

Apple confirmed this month that macOS 28 will no longer mount encrypted Mac OS Extended volumes. Unencrypted HFS+ drives are explicitly preserved and need no changes. The group with a real problem is smaller but specific: anyone running Time Machine to an encrypted HFS+ drive has no in-place migration path and will need to start a fresh backup chain before macOS 28 ships, according to Apple's support document.

The line Apple draws is worth stating plainly. If a drive shows both "Mac OS Extended" and "Encrypted" in Disk Utility, it will stop mounting under macOS 28. If it shows Mac OS Extended without the encrypted designation, nothing needs to change. Unencrypted volumes using Mac OS Extended will continue working without any action required, Apple confirms.

Apple is ending encrypted HFS+ support and most users have time to prepare, except one group

Mac OS Extended replaced the original Hierarchical File System in 1998 as part of Mac OS 8.1, designed for the hard drives and Fusion drives of that era, AppleInsider reported. Apple introduced APFS in 2016 and made it the default format in 2017, building it specifically for the SSDs now standard in every Mac, Macworld reported. The two formats have coexisted ever since, but macOS 28 is where that coexistence ends for the encrypted variant.

macOS 28, expected in 2027, will support Mac OS Extended only for volumes that are not encrypted, Apple states. Users with affected drives will need to either decrypt or reformat before upgrading.

Apple has built a warning system into the transition. Starting with macOS 26, Macs may notify users when an encrypted Mac OS Extended disk is connected, flagging it as incompatible with macOS 28, the support document states. Each notification will identify the affected volume by name, giving users a direct signal well before any upgrade forces a decision.

For most people with encrypted external drives, the path forward is inconvenient but manageable. For encrypted Time Machine users, the situation is different.

How to check whether you're affected and what Apple recommends

Open Disk Utility and select the volume. If the format field shows both "Mac OS Extended" and "Encrypted," that drive will not work with macOS 28. A volume showing Mac OS Extended alone is unaffected, Apple confirms. No need to wait for a system notification.

For encrypted external drives that are not Time Machine volumes, there are two paths.

The data-preserving route: decrypt first, then convert. Decryption takes time, especially on large volumes, 9to5Mac notes, but it leaves all files intact. Once decrypted, Disk Utility's Edit menu exposes a "Convert to APFS" option that completes the macOS 28 encrypted HFS+ to APFS conversion without erasing anything, per Apple's instructions. The result is an APFS volume with original data intact.

The faster route: erase and reformat. Back up the drive's contents elsewhere, then erase and reformat directly to APFS or APFS Encrypted. This permanently deletes every file on the volume, so a verified backup is a prerequisite, not an afterthought, Apple advises.

One technical footnote worth knowing about. During the initial transition to APFS, macOS could silently convert an encrypted HFS+ boot volume to encrypted APFS without rewriting any data. That capability reportedly still exists via the diskutil apfs convert command, but Michael Tsai notes that Apple has not documented it or surfaced it as a supported GUI option for external drives. It explains why the official two-step sequence decrypt, then convert can feel heavier than the underlying technology might require. For most users, the documented path is the right one.

The exception: encrypted Time Machine drive compatibility with macOS 28

Apple's decrypt-first option, the route that keeps data intact for ordinary external drives, does not apply to encrypted Time Machine backup disks, Apple warns. Time Machine users cannot decrypt their way out of the problem.

The reason is structural. HFS+-based Time Machine backups are built on directory hard links, a mechanism that constructs versioned snapshot history by linking directories across the drive rather than duplicating files. APFS does not support directory hard links. There is no conversion path, no migration tool, because the data structure underlying years of snapshots is incompatible with the new format, as Eclectic Light explains.

The consequence is straightforward: users upgrading to macOS 28 will need a freshly formatted APFS drive and a new Time Machine backup chain started from scratch. The old backup history stays behind. Accessing it afterward requires either a Mac still running macOS 27 or earlier, or a separate older startup disk kept running for that purpose, Tsai notes.

This is precisely why the macOS 26 warning system matters. Users who wait until the macOS 28 upgrade prompt to deal with their Time Machine drives face the least favorable sequence: the OS upgrades, the encrypted HFS+ drive stops mounting, and the backup history becomes inaccessible in a single step.

What to do before macOS 28 ships

The right action depends on what you have.

Encrypted external drive (not Time Machine): Open Disk Utility and confirm the volume shows both Mac OS Extended and Encrypted. If it does, decide whether the data needs to survive the transition. To keep it: decrypt the volume first, then use Disk Utility's Edit menu to convert to APFS. To start clean: back up the contents elsewhere, then erase and reformat to APFS or APFS Encrypted. Back up before doing anything, Apple advises.

Encrypted Time Machine backup drive: No in-place migration exists, Apple states. The decision is what to do with the existing history, not how to transfer it. If that backup record matters, keep the drive accessible via a Mac running macOS 27 or earlier. For ongoing protection, format a new drive as APFS Encrypted and start a fresh Time Machine series now. The sooner that chain starts, the more history it will carry by the time macOS 28 arrives, Eclectic Light recommends.

Unencrypted HFS+ volumes: No action needed. macOS 28 support continues, per Apple.

Apple has provided roughly a year of advance warning, and the macOS 26 notification system means affected drives will announce themselves by name before any forced decision point. For encrypted external drives, the migration is time-consuming but technically straightforward. For encrypted Time Machine users, the clock is already running: the new APFS backup chain only carries history from the day it starts, and macOS 28 is not waiting.