What is FileVault on a Mac, and should you turn it on?

MacUpdated

FileVault is the encryption built into macOS. Apple describes it as a built-in encryption capability to secure all data at rest. With it on, your login password, or a recovery key, is needed before anyone can read what's on the Mac's disk.

Quick answer

FileVault encrypts the whole disk using AES-XTS. Macs with Apple silicon or a T2 chip already encrypt data automatically, and turning on FileVault adds the need for your login password. Turn it on in System Settings > Privacy & Security > FileVault, and choose your iCloud account or a recovery key in case you forget your password.

What does FileVault encrypt?

Apple's Platform Security guide says FileVault uses the AES-XTS algorithm to protect full volumes on internal and removable storage. After you turn it on, your credentials are needed when the Mac starts up.

Apple says that without valid login credentials or a recovery key, the internal volumes stay encrypted and protected from unauthorised access, even if the storage is removed and connected to another computer.

Apple names one gap. On older Macs without a T2 chip, and on external drives, all existing files are encrypted once FileVault is on, but data that was added and then deleted before you turned it on isn't encrypted and may be recoverable with forensic tools.

How does FileVault work on Apple silicon and T2 Macs?

If you have a Mac with Apple silicon or an Apple T2 Security Chip, Apple says your data is encrypted automatically. FileVault provides an extra layer by keeping someone from getting at that data without your login password. On a Mac without either chip, you need to turn FileVault on to encrypt your data at all.

On these Macs, every internal volume gets an encryption key by default, and all FileVault key handling happens in the Secure Enclave, so the keys are never exposed directly to the processor. With FileVault off, that key is protected only by a hardware identifier in the Secure Enclave. Turning FileVault on ties it to your password as well. Apple says turning it on later is immediate, because the data has already been encrypted.

Two other things change. Apple says that when you turn on FileVault you need a password to log in when your Mac wakes from sleep or leaves the screen saver. And when FileVault is on, automatic login is disabled.

Should I turn on FileVault?

Apple points to it for anyone who keeps sensitive information on a Mac, giving the example of a company's financial data on a laptop. Its checklist for setting up a secure Mac includes it. The NCSC's macOS guidance for organisations says to enable encryption.

The thing to weigh is recovery. If you forget your password and also lose your recovery key, Apple says you won't be able to log in, and your files and settings will be lost forever. Set it up with a recovery method you'll still have in a year's time.

How do I turn on FileVault?

You need to be an administrator on the Mac.

  1. Choose Apple menu > System Settings, click Privacy & Security in the sidebar, then click FileVault. You may need to scroll down.
  2. Turn on FileVault. You might be asked for your password.
  3. Choose how to unlock your disk and reset your password if you forget it: "Allow my iCloud account to unlock my disk", "Set up my iCloud account to reset my password" if you don't use iCloud yet, or "Create a recovery key and do not use my iCloud account".
  4. Click Continue.
  5. If you see an Enable Users button, click it, select each user, enter their login password and click OK. Each user unlocks the disk with their own login password.

Recovery key or iCloud account: which should I pick?

Apple describes the iCloud option as convenient if you use iCloud or plan to, because you don't need to keep track of a separate key. If you forget your login password, you can reset it using your Apple Account.

The recovery key is a 24-character code of letters and numbers that macOS creates for you. Apple says to keep a copy somewhere other than your encrypted startup disk, copy it exactly, and keep it somewhere safe you'll remember, but not in the same place as your Mac, where it can be found. You can use the key to unlock your startup disk or to turn FileVault off.

What happens if I lose my FileVault recovery key?

Apple lists a few places to look.

  1. The key is stored in your keychain. Apple's Platform Security guide says it can be viewed in System Settings under Privacy & Security > FileVault, and retrieved with the Passwords app.
  2. If the Mac asking for it runs macOS Tahoe 26 or later, the key might be in the Passwords app on another of your devices signed in to the same Apple Account, with iCloud Passwords & Keychain turned on. Search for "recovery key".
  3. When resetting your password, you may be offered the option to sign in with your Apple Account instead.

Apple points out that a FileVault recovery key isn't the same as an Apple Account recovery key. If nothing works, Apple's last resort is to erase the Mac, which permanently removes each user account, its password and its data.

Does FileVault slow down a Mac?

Apple's FileVault pages don't make a claim either way about everyday speed. They do say that on Apple silicon and T2 Macs, encrypted internal storage uses the chip's AES Engine, and that turning FileVault on is immediate because the data is already encrypted.

What FileVault doesn't cover

FileVault's job is the data at rest. Apple says it keeps someone from getting at your data without entering your login password. Someone who knows that password can enter it like you would, and Apple's FileVault pages don't describe any record of who did.

Where Failshot fits

Your password is the first layer. Failshot is the second: second layer device security for your Mac. While it's on, it photographs whoever unlocks your Mac, then, with Pro, records a 5-second video, and its window tells them the unlock was photographed. With the Mac's built-in camera, the green light comes on.

With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on.

It's an extra layer beside FileVault. Failshot is a free download for macOS 14 or later, and free to use. Pro adds video, email alerts and the encrypted vault. Try Failshot Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel.

New MacBook Pro? The New MacBook Pro guide covers buying one, setting it up and what to do with your old Mac.

More questions

Is FileVault on by default?

Apple says Macs with Apple silicon or a T2 chip encrypt data automatically, and that turning on FileVault adds an extra layer by requiring your login password. To see whether it's on, go to System Settings > Privacy & Security > FileVault.

Can I turn off FileVault?

Yes. Apple says a FileVault recovery key can be used to turn off FileVault as well as to unlock your startup disk, so keep it even after setup.

Where do I find my FileVault recovery key?

Apple's Platform Security guide says the key is stored in the keychain and can be retrieved with the Passwords app. On macOS Tahoe 26 or later, it may also be in the Passwords app on another device signed in to the same Apple Account.

Does FileVault protect a stolen Mac?

It protects the data on the disk. Apple says that without valid login credentials or a recovery key the internal volumes stay encrypted, even if the storage is removed. For the Mac itself, turn on Find My Mac and Activation Lock. See Mac Activation Lock and MacBook stolen: what to do.

Does FileVault encrypt external drives?

Apple's Platform Security guide says FileVault protects full volumes on internal and removable storage. It adds that encrypting removable storage doesn't use the Secure Enclave, and works the same way as on an Intel Mac without the T2 chip.

Sources