How to encrypt a backup on a Mac

Short answer: for a drive that stays home, tick Encrypt Backup in Time Machine. For anything that leaves the building or goes to somebody else's storage, encrypt before the bytes are written.

The difference is who has to be trusted: the drive, or nobody.

Four different things, often confused

FileVault encrypts your Mac's internal disk. It protects the machine, and it does nothing at all for the backup you write onto an external drive.
Encrypted Time Machine encrypts the backup volume. Someone who takes the drive gets nothing without the password. Anything with access to the Mac while the drive is mounted reads it normally.
An encrypted disk image is a file you unlock and mount. The contents are protected while it is locked, and readable to everything on the Mac while it is open.
Encrypting before the write means the data is already ciphertext before it reaches the destination. The destination never holds anything readable, so it does not have to be trusted at all.

The first three protect against losing the disk. Only the fourth protects against the storage itself, which is the relevant question the moment the backup lives in a cloud account or on a NAS.

Encrypting a Time Machine backup

System Settings, General, Time Machine.
Add Backup Disk, or select the existing one and choose to encrypt it.
Tick Encrypt Backup and set a password.

Encrypting a backup that already exists re-encrypts the whole disk in the background, which takes hours and sometimes days. Do it when you first add the disk if you can.

The password is stored in your Mac's keychain, which is convenient and also the trap: if the Mac dies, the keychain dies with it, and the password is the only way into the backup. Write it down somewhere else.

An encrypted disk image, by hand

hdiutil create -encryption AES-256 -stdinpass -size 200g \
  -volname Backup -fs APFS ~/backup.dmg

Mount it, copy into it, unmount it. It is a reasonable container for a drive that travels. It is a poor fit for a cloud folder, because the image is one enormous file and any change to its contents means re-uploading far more than you changed.

Encrypting before the write

By hand, this is an archive through openssl:

tar -cJf - ~/Documents | openssl enc -aes-256-cbc -pbkdf2 -out ~/Dropbox/documents.tar.xz.enc

The destination never sees plaintext, which is exactly right. What you get in exchange is a single opaque blob: no incremental updates, no restoring one file without unpacking everything, and one passphrase between you and all of it.

Doing that properly, with per-file encryption so a single document can come back on its own, is the part that is genuinely hard to hand-roll. Copy Shelter encrypts everything on your Mac before it is written anywhere, and there is no setting to turn that off. The key is generated on your machine and never transmitted, so the destination is storage, and not a party you have to trust.

Where the key lives

This is the part that actually loses people their data, more often than any attack.

Off the Mac being backed up. A key stored on the machine that died is a locked box with the key inside it.
Outside a password manager that syncs to that Mac, unless you can also reach that manager from somewhere else without the Mac.
Paper is a legitimate answer. It survives fire less well than a cloud, and it survives ransomware perfectly.
Test it. Once, restore something using only the key and a different machine. Finding out the key is wrong is a Tuesday problem or a catastrophe, depending entirely on when you find out.

Common questions

Does FileVault cover my Time Machine drive?

No. FileVault encrypts the internal disk only. The backup drive is a separate volume with its own encryption setting.

Can I encrypt a Time Machine backup after the fact?

Yes, and macOS re-encrypts the whole disk in the background. It works, it takes a long time, and the backup is not fully protected until it finishes.

Does encryption slow backups down?

Not noticeably on any Mac made in the last decade. AES is accelerated in hardware and the disk or the network is the bottleneck long before the cipher is.

What happens if I lose the password?

The backup cannot be opened, by you or by anybody. That is the property you were paying for. It is why the key belongs somewhere other than the Mac, written down.

Is it safe to put an encrypted backup in the cloud?

If it was encrypted before it left your Mac, yes: the provider holds bytes it cannot read. If you are relying on the provider's own encryption instead, you are trusting the provider, which is a different and much weaker statement.