How to Encrypt Your Mac with FileVault

The short answer. Turn it on. FileVault encrypts the startup disk so that the data on it is unreadable without your password or the recovery key, and on any Mac made since 2018 the encryption is done in hardware, so there is no performance cost to trade against it. The only thing that needs care is the recovery key: store it somewhere that is not the Mac, because losing both the key and the password means losing the data, permanently and by design.

This guide covers what FileVault does on each generation of hardware, how to enable it without locking yourself out, and the six things people assume it protects that it does not.

What FileVault actually does on a modern Mac

There are two different mechanisms at work, and the difference matters for understanding what you are buying.

On Intel Macs without a T2 chip, FileVault is full-volume software encryption. The CPU encrypts and decrypts every block as it is read and written, using XTS-AES-128 with a 256-bit key. On an SSD this is fast enough to be unnoticeable; on the spinning hard disks those machines shipped with, it was slow enough that Apple left it off by default.

On Macs with a T2 chip and on all Apple Silicon Macs, the storage is always encrypted, whether FileVault is on or not. The encryption engine is in the storage controller, not the CPU. What FileVault adds on these machines is not encryption but a condition: without it, the volume key is available to the hardware at boot, so a machine that is stolen can be started and read by someone who knows what they are doing. With it, the volume key is wrapped by a key derived from your password and held in the Secure Enclave, and the disk cannot be unlocked without it.

That is why the setting still matters on a machine whose disk is “already encrypted”. The encryption protects the data from being read off the flash chips; FileVault protects it from being read by anyone who has the whole laptop.

On Apple Silicon specifically, the Secure Enclave also enforces a delay after failed password attempts at boot, and it discards the volume key when the machine is shut down. Those properties only exist when FileVault is enabled — they are the practical reason a stolen MacBook with FileVault on is worth the scrap value of its parts, and one without it may not be.

Turning it on

System Settings → Privacy & Security → FileVault → Turn On.

You will be asked how you want to be able to unlock the disk if you forget your password. There are two options and the choice matters more than anything else in this article.

iCloud account. Apple holds a recovery key escrowed to your Apple ID, and you can retrieve it by signing in on another device. It is the option that survives losing a piece of paper, and it means Apple — and anyone who can authenticate as you to Apple — can unlock the disk.

A local recovery key. macOS generates a 24-character key and shows it exactly once. You write it down. Apple does not have it, cannot recover it, and if it is lost along with the password, the data is gone. This is the option for anyone who would rather not have a third party able to unlock their disk.

Choose deliberately rather than clicking through. The iCloud option is the right answer for most people, because the realistic failure mode is a forgotten password and the realistic threat is a stolen laptop rather than a compelled disclosure. The local key is the right answer if you are encrypting specifically because you do not want a third party in the path — and then the key has to go somewhere real: a password manager entry, a printed copy in a drawer, or both. A recovery key saved on the Mac it protects is not a recovery key.

Whichever you choose, the Mac then restarts and encrypts the volume in the background. On an Apple Silicon machine with FileVault already implied by the hardware, this is quick; on an older Intel machine with a large disk it can take hours, and the machine is usable throughout.

The recovery key, in detail

Three things about the key are worth knowing before you need them.

You can see it again. With the iCloud option, System Settings shows the key if you authenticate — it is stored, not merely displayed once. With a local key, FileVault settings offers Change Recovery Key, which generates a new one and invalidates the old, so a lost piece of paper is recoverable as long as you can still log in.

It can be regenerated from the command line. sudo fdesetup changerecovery -personal issues a new personal key and prints it. Useful when you have inherited a machine and do not know whether a key exists, or when you suspect the old one was exposed.

It is not the same as your login password. The password unlocks your account; the recovery key unlocks the volume. On a machine with several users, each user’s password can unlock the disk, and the recovery key is the backstop for when none of them work.

Store it where you store the things you would need after a fire: a password manager is the right place for most people, because it is encrypted, synced and accessible from a phone. 1Password, Bitwarden, KeePassXC and Strongbox all handle arbitrary text and all sync, which is what the situation requires. A note in the same Mac’s Notes app is the one place it must not go.

Several users, and who can unlock the disk

A FileVault-protected Mac can have several accounts, and each one that is authorised can unlock the disk at the login screen. The mechanism is a key wrapping: each authorised user’s password unwraps a copy of the volume key, so any of them can start the machine.

When you enable FileVault, macOS asks which users should be able to unlock it, and you have to enter each one’s password to authorise them. A user who is not authorised can still log in after someone else has unlocked the disk, but cannot start the machine themselves.

To see and change the list, System Settings → FileVault → Users, or from the command line:

sudo fdesetup list
sudo fdesetup add -usertoadd username
sudo fdesetup remove -user username

The practical consequence: if you change a user’s password, their key wrapping is updated automatically. If you reset a password through Recovery — the “forgot password” path — the account loses its FileVault authorisation, because the reset does not have the old password to unwrap the key. That is why a password reset on an encrypted Mac may leave the account unable to unlock the disk at the next boot, and why the recovery key is the thing you need at that moment.

Performance, battery and the honest cost

On Apple Silicon and T2 Macs: no measurable difference. The encryption is in the storage controller, the CPU is not involved, and the SSD’s throughput is unchanged. Battery life is unchanged. This is the reason the question is no longer interesting on current hardware.

On older Intel Macs with SSDs: a small cost in CPU time, generally under five percent in ordinary use, invisible in day-to-day work and visible in a benchmark.

On older Intel Macs with hard disks: a real cost, because the CPU is doing the encryption and the disk is already the bottleneck. Those machines are also old enough that the security argument is stronger than the performance argument, so the trade is usually still worth taking.

The one situation where FileVault has a genuine operational cost is a machine that reboots unattended — a headless Mac mini, a build server, a media server. An encrypted Mac cannot boot without someone entering a password, so FileVault and unattended reboot are incompatible unless the machine stays awake and never restarts. If you run a Mac in a cupboard, leave it off and secure the physical access instead.

What FileVault does not protect

This is the part people get wrong, and each of these is a real gap rather than a technicality.

The running, unlocked Mac. FileVault protects data at rest. Once you have logged in and the volume is unlocked, everything is readable by anything running as you. Encryption does not stop malware, a shoulder-surfer, or someone who walks up to an unlocked machine.

Backups. A Time Machine destination has its own encryption setting and it is off unless you turn it on. An unencrypted backup drive contains a complete copy of everything FileVault was protecting, and it lives in a bag rather than on a desk. Turn on Encrypt backups when you set the destination up; it cannot be enabled later without erasing the drive and starting again.

External drives. A USB SSD or a thumb drive is not covered. The answer is to format them as APFS (Encrypted) or Mac OS Extended (Journaled, Encrypted) in Disk Utility, which encrypts the whole volume with a password of its own. For a drive that moves between Macs, that is the right shape: the password travels with the drive rather than with the machine.

Cloud storage. Files synced to iCloud Drive, Dropbox or any other service are encrypted in transit and at rest on the provider’s servers, under the provider’s keys. FileVault has no effect on them. If the requirement is that the provider cannot read the files, the tool is client-side encryption: Cryptomator creates an encrypted vault inside a normal cloud folder, and the provider sees only ciphertext.

Screenshots, print queues and swap. All of these live on the encrypted volume, so they are covered at rest. They are not covered while the machine is running, which is the same caveat as the first point.

Your Apple ID and the services tied to it. Find My, iCloud Keychain and Messages are protected by the account, not by the disk. A stolen Mac with FileVault on still shows its location to Find My, which is a feature rather than a leak.

Encrypting everything else

If the goal is “my data is not readable if the hardware is lost”, FileVault is one of four pieces.

The order of importance is not the order of the table. The backup drive is the most commonly lost item and the most commonly unencrypted; it is usually the weakest link in an otherwise careful setup.

Where FileVault sits in the rest of macOS security

FileVault is one layer of five, and the layers answer different questions. Knowing which is which stops you from expecting one to do another’s job.

The important thing about the table is that none of the rows is a substitute for another. FileVault protects a disk that has been taken; Gatekeeper and XProtect protect a machine that is running; SIP protects the system from being changed by something that got past the other two. A Mac with FileVault on and Gatekeeper off is a machine whose data is safe when it is off and compromised while it is on, which is the wrong half.

Two of these are worth a moment more. Notarisation does not mean Apple has audited the app; it means Apple scanned it for known malware at submission time and issued a ticket. XProtect updates silently in the background and is the part that catches malware after the fact. Neither is a substitute for not installing things you do not trust.

Buying or selling a used Mac

FileVault changes both transactions, and the failure mode is expensive in both directions.

Selling. Sign out of iCloud first, which removes the machine from Find My and clears Activation Lock, then erase with Erase All Content and Settings. If you erase without signing out, the next owner gets a machine that demands your Apple ID at setup, and the only fix is for you to sign in elsewhere and remove it manually — which you cannot do if you have already handed it over and wiped your account. The order is not optional.

Buying. A used Mac that arrives with Activation Lock still on is unusable until the seller removes it, and no amount of reinstalling changes that: the lock lives on Apple’s servers, keyed to the machine’s serial number. Check before you pay. If the seller cannot demonstrate that the machine boots to the setup assistant with no lock, do not buy it.

FileVault itself is not a problem for a buyer, because erasing destroys the key and the new owner starts clean. What can be a problem is a machine sold with the disk still encrypted and the seller’s account still on it — which is the same Activation Lock situation, seen from the other side.

Turning it off, and why you probably should not

System Settings → Privacy & Security → FileVault → Turn Off. Decryption runs in the background and takes as long as encryption did.

The legitimate reasons to turn it off are narrow: a machine that must reboot unattended, a machine being recycled where you will erase it anyway, or a diagnostic step when a disk is failing and you want the raw volume readable. On Apple Silicon, turning FileVault off does not decrypt the disk — the hardware encryption stays — it only removes the password requirement at boot, which is strictly worse.

If you are turning it off because a repair shop asked you to, ask why. A shop that needs your password can work on an encrypted Mac; one that needs the encryption removed is one you should ask a second question about.

Troubleshooting

“FileVault is already on” but the setting shows off. On T2 and Apple Silicon machines the disk is encrypted regardless; the setting reflects whether the volume key requires a password. If the toggle is off and you want the protection, turn it on; it is fast because the data is already encrypted.

Encryption appears stuck at a percentage. Check the real progress with diskutil apfs list, which reports the percentage for the volume. The System Settings figure updates lazily and can sit at 3% for an hour while the work continues.

A user cannot unlock the disk after a password reset. Expected — see the section above. The recovery key unlocks the disk; then re-authorise the user with sudo fdesetup add -usertoadd.

The Mac will not boot past the login screen. This is what FileVault looks like when the key cannot be unwrapped: the login screen appears before macOS has started, and a wrong password simply returns you to it. Try each authorised user, then the recovery key. If neither works, the data is gone and the machine needs erasing and reinstalling.

You inherited a Mac and do not know the state. fdesetup status reports whether FileVault is on, and fdesetup list reports which users can unlock it. If it is on and you are not on the list, you need the previous owner’s password or the key — there is no other route.

FAQ

Does FileVault protect against a thief who removes the SSD? On Apple Silicon the storage is soldered and the keys live in the Secure Enclave, so removal is not a realistic attack. On Intel Macs with removable drives, the drive is encrypted at the hardware level on T2 machines and by software otherwise; in both cases the data is unreadable without the key. The practical answer is yes.

Is FileVault the same as a firmware password? No. A firmware password, on Intel Macs, prevents the machine booting from another volume; it is a separate setting and Apple has deprecated it on newer hardware. FileVault protects the data. On Apple Silicon the equivalent protections are Activation Lock, tied to Find My, and the boot security policy in Recovery.

Can I use FileVault with a Windows partition? Boot Camp is not supported on Apple Silicon, and on Intel Macs a FileVault-encrypted macOS volume and a BitLocker-encrypted Windows volume are independent. Windows cannot read the macOS volume and vice versa, which is the intended behaviour.

What happens to FileVault when I erase the Mac? Erase All Content and Settings destroys the volume encryption key, which makes the data unrecoverable immediately rather than overwriting it. On Apple Silicon that is the only secure erase that matters, and it is why a FileVault Mac can be sold without a wipe utility.

Should I use the institutional recovery key? Only if you are managing machines for other people and need a key that is not tied to one person’s Apple ID. For a personal Mac it adds a key you have to store and manage for no benefit over the personal one.

Does FileVault affect Time Machine’s local snapshots? No, and that is worth knowing because the snapshots live on the same encrypted volume and are covered by the same key. They are deleted when the volume is erased, along with everything else.

Can I enable FileVault while the machine is on battery? Yes. Encryption runs in the background and is throttled when the machine is unplugged, so it takes longer but does not fail. Plugging in for the first hour is a reasonable idea on a large disk.

What if I forget which recovery method I chose? Open System Settings → Privacy & Security → FileVault and read the line under the toggle. With the iCloud option there is a Show Recovery Key button; with a local key there is a Change Recovery Key option and no way to see the old one, which is the correct behaviour — a key you can read from the machine is a key an attacker can read from the machine.