macOS · Privacy & Security
Protect Your Mac with FileVault
FileVault encrypts the entire startup disk on your Mac, so your data stays protected even if the device is lost or stolen. Only someone with your password or recovery key can unlock and read the disk.
How to open FileVault Disk Encryption
- Open System Settings → Privacy & Security → FileVault.
- Click 'Turn On' next to FileVault.
- Choose how to store your recovery key.
- Restart your Mac to begin encryption.
What you should know
- Encryption happens in the background and you can keep using your Mac while it completes.
- You can unlock your disk with your login password, or an iCloud account, or a recovery key you store safely.
- Losing both your password and recovery key means your data cannot be recovered.
- FileVault is available for both Intel and Apple silicon Macs.
Store your FileVault recovery key somewhere safe and separate from your Mac — without it (or your password), encrypted data is permanently inaccessible.
Why it matters
Without FileVault, anyone who gets physical access to your Mac's drive — after theft or loss — can pull files directly off it by booting from another disk, bypassing your login password entirely. FileVault makes the entire disk unreadable without the correct credentials, which is especially important on laptops that travel with you. It's a one-time setup that runs quietly in the background, so there's little reason not to have it on.
Best practices
- Turn on FileVault as soon as you set up a new Mac, before you accumulate sensitive data.
- Store your recovery key in a password manager or a secure physical location, never in an unencrypted note on the same Mac.
- Link FileVault recovery to your Apple Account so Apple can help you regain access if you lose your password.
- Avoid disabling FileVault for performance reasons — modern Macs handle encryption with negligible slowdown.
Common problems and fixes
- Forgot both the login password and the recovery key.
- Without either credential, FileVault-encrypted data is permanently unrecoverable — this is exactly why storing the recovery key safely up front matters, since there's no bypass that preserves the data.
- Encryption seems to be taking a very long time.
- Initial encryption runs in the background and can take several hours on drives with lots of data; you can keep using the Mac normally while progress is shown in Privacy & Security → FileVault.
- A second user on the Mac can't unlock the disk at startup.
- Add every user account that needs to log in through Privacy & Security → FileVault's 'Enable users' option, since only enabled users can unlock an encrypted disk at boot.
Tips and tricks
- Check FileVault's current encryption progress anytime via Privacy & Security → FileVault, which shows a percentage while the initial pass is running.
- Use `fdesetup status` in Terminal for a quick command-line check of FileVault's on/off state.
- If your recovery key is stored with your Apple Account, you can retrieve it later at iforgot.apple.com if you're locked out but remember your Apple Account password.
Frequently asked questions
Does FileVault slow down my Mac?
On any Mac with an Apple silicon chip or a recent SSD, the performance impact is essentially unnoticeable because encryption is handled by dedicated hardware.
What happens if I lose my recovery key?
If you still know your login password you're fine, but if you lose both your password and recovery key, the encrypted data cannot be recovered by Apple or anyone else.
Is FileVault the same as my login screen password?
No — your login password unlocks your user account, while FileVault encrypts the entire disk at a lower level so the data stays unreadable without the password or recovery key even if the drive is removed.
Related settings
- Time Machine BackupTime Machine automatically backs up your entire Mac — apps, accounts, preferences, and files — to an external or network drive, so you can restore individual files or your whole system if something goes wrong.
- Apple Account & iCloud SynciCloud settings control which of your apps and data — Photos, Mail, Contacts, Find My Mac, and more — stay in sync across all your Apple devices, plus your iCloud storage plan.
- Camera & Microphone PrivacyPrivacy & Security settings let you review and control exactly which apps are allowed to use your Mac's camera and microphone, so you always know what has access to audio and video.
- Erase & Reset MacErase All Content and Settings lets you wipe your Mac back to factory defaults — useful for major troubleshooting, or before selling, trading in, or giving away your device.
More Privacy & Security guides for macOS
- Privacy & SecurityThe Privacy & Security settings pane is the central hub for controlling app permissions, FileVault encryption, Gatekeeper protections, Lockdown Mode, and analytics sharing — essentially every major security and data-access decision on your Mac in one place.
- App PermissionsBeyond camera and microphone, macOS tracks separate permissions for things like Full Disk Access, Files & Folders, Automation, Accessibility, and Local Network — each controlling exactly what a specific app is allowed to see or control on your Mac.
- Activation Lock (Find My Mac)Activation Lock automatically protects your Mac the moment Find My Mac is turned on, requiring your Apple Account password or device passcode before anyone can turn off Find My, erase the Mac, or reactivate it after an erase — making a lost or stolen Mac far less useful to whoever has it.
- Location ServicesManage system-wide Location Services and grant or deny individual apps and system features permission to use your Mac's estimated location.
- Full Disk AccessAuthorize specific apps, usually backup, security, or automation tools, to read protected locations across your entire disk that are normally off-limits.
- Screen Recording PermissionControl which apps are allowed to record or capture the contents of your screen, a permission required by screen-sharing, recording, and streaming tools.