FileVault encrypts the Mac startup disk so someone cannot read the files without a login password or recovery method. It is especially useful for laptops that may be lost or stolen.
This guide applies to FileVault in System Settings on recent macOS versions.
Does This Affect You?
Use FileVault if you want full-disk protection. It does not change normal daily use; after setup, you sign in the same way you already do.
Turn On FileVault
- Open System Settings.
- Select Privacy & Security.
- Open FileVault.
- Click Turn On and enter an administrator password if prompted.
- Choose how you want recovery handled: allow your iCloud account to unlock the disk, or create a local recovery key.
- If you choose a recovery key, write it down and store it somewhere away from the Mac.
- Click Continue and restart if macOS asks.
- Let encryption finish in the background. You can check progress in FileVault settings.
Important FileVault Notes
Do Not Lose the Recovery Key
If you choose a local recovery key and later forget both the Mac password and the key, the encrypted data cannot be recovered. Apple cannot bypass FileVault for you.
Turn FileVault Off
Return to System Settings > Privacy & Security > FileVault and choose Turn Off. Decryption runs in the background and can take time.
What FileVault Protects
FileVault protects data at rest, including against someone removing the drive or starting from another disk. It does not stop phishing, malware, or a person who already knows your login password.
Encrypt One Folder Instead
If you only need a secure folder, use Disk Utility to create an encrypted disk image instead of encrypting the entire startup disk.
Sources
- Apple Support: Turn on FileVault on Mac
- Apple Support: Use a FileVault recovery key
- Apple Platform Security: FileVault