Short answer: open System Settings, General, Time Machine, and look at your backup disk. It says Encrypted or it does not.
Nothing forced you to tick that box when you set the disk up, which is why a great many Time Machine drives are not encrypted and their owners believe they are.
In System Settings. General, then Time Machine. Each backup disk is listed with its details, and an encrypted one says so. This is the answer for most people.
In Terminal, for a definite answer:
diskutil apfs list | grep -A5 "FileVault"An encrypted Time Machine disk on a modern macOS is an APFS volume with FileVault enabled. If
FileVault reads No for the backup volume, the backup is not encrypted.
The blunt test. Unplug the drive, plug it into another Mac, and see whether it asks for a password before showing you anything. If it just opens, so would it for anyone else.
When you add a backup disk, macOS offers Encrypt Backup as a checkbox. It is a choice, presented once, at the moment you are trying to get on with something else. There is no later prompt, no reminder, and nothing in the ordinary interface nags about it.
People also confuse three different things that all sound like the same thing:
So "my Mac is encrypted" and "my backup is encrypted" are unrelated statements, and only one of them is usually true.
A backup is, by design, a complete copy of everything you care about, sitting on a small object that lives outside your Mac. Every document, every photograph, saved passwords in a keychain, tax records, the lot.
An unencrypted backup drive is that copy, readable by anybody who picks it up. Not a hacker, somebody who picks it up. Drives are stolen with laptop bags, left in offices, sold on, and handed to a repair shop. The threat is mundane and that is precisely why it gets skipped.
Off-site copies make it sharper. The whole point of an off-site copy is that it lives somewhere you are not, which means somewhere you are not watching it.
This is the part people do not want to hear. macOS cannot encrypt an existing Time Machine backup in place. The supported route is to remove the disk as a destination, erase it, add it back with Encrypt Backup ticked, and let the first full backup run again.
You lose the history. There is no way around it that Apple supports, and the workarounds involve converting the volume by hand in ways that can leave you with neither the old backup nor a new one.
Keep that password. Without it the backup cannot be opened, and Apple cannot help; that is what encryption means.
The reason this page exists is that encryption is a setting with a default, and defaults decide what most people end up with.
Copy Shelter encrypts everything before it is written anywhere, with a key generated on your machine and never transmitted. There is no switch, because there is no unencrypted mode to switch to. You choose a passphrase, a recovery key is written when the backup is created, and the same is true whether the destination is a drive on the desk or a folder in a cloud account somebody else runs.
That last part is the reason it is not optional. A backup written to a folder in Dropbox or Google Drive is a copy of everything you own sitting on a company's servers, and encrypting it before it leaves is the only version of that arrangement worth having. See how to encrypt a backup on a Mac for the do-it-yourself route.
No. FileVault encrypts your Mac's internal disk. The backup drive is a separate volume with its own separate setting, and turning on FileVault does nothing to it.
Not in place. The supported route is to remove the disk, erase it, add it back with Encrypt Backup ticked, and start again, which loses your history. Make sure you have another copy before you begin, because the procedure deletes your only backup while the new one runs.
Not meaningfully on any Mac from the last decade. Modern processors do this in hardware. The size is effectively unchanged. There is no practical reason to leave it off.
The backup cannot be opened, by you or by Apple. That is what encryption means. Write it down and keep it somewhere other than the machine being backed up.
In transit and at rest on their servers, with keys the provider holds, which protects it from someone stealing a disk in a data center and not from the provider or anybody who gets into your account. Proton Drive is the exception among the mainstream services. Encrypting before upload is the only version that is yours.
Related: how to encrypt a backup on a Mac, and backing up to an external drive.