How to Enable FileVault Disk Encryption on Mac

If your MacBook were stolen tomorrow, the thief would have your laptop — but would they have your data? Without disk encryption, the answer is often yes: the drive can be read by booting from external media, bypassing your login password entirely. FileVault, Apple’s built-in full-disk encryption, closes that hole by scrambling everything on the drive unless an authorised user signs in. Turning it on takes a few minutes, costs nothing, and on modern Macs has no noticeable effect on speed. This guide shows how to enable it and — just as important — how to store the recovery key safely.

Quick Answer

Open System Settings, go to Privacy & Security, scroll to FileVault, and click Turn On. Choose how to unlock the disk if you forget your password: either with your iCloud account, or with a Recovery Key that FileVault generates. If you choose the Recovery Key, write it down and store it somewhere safe away from the Mac — without your password or this key, nobody, including Apple, can recover your data. Encryption then completes in the background while you keep working.

What FileVault Actually Does

FileVault encrypts the entire contents of your startup disk with strong XTS-AES-128 encryption tied to a 256-bit key. In plain terms:

• With the Mac off, the drive is unreadable gibberish to anyone without a valid login password or the Recovery Key.
• When an authorised user logs in, the disk unlocks and the Mac behaves completely normally.
• It protects against the classic theft scenario: removing or reading the drive through another computer or a recovery boot.
• It does not protect data while you are logged in — malware running in your session, or someone using your unlocked Mac, can still see files. FileVault is about the powered-off or locked-out state.

On Macs with Apple Silicon or a T2 chip, the storage is already encrypted at the hardware level; FileVault adds the crucial step of tying that encryption to your password, so credentials — not just possession — are required to unlock. Apple’s FileVault overview on Apple Support explains the design in more depth.

Step by Step: Turn On FileVault

1. Plug the Mac into power — encryption of a large drive takes a while, and you do not want the battery dying mid-process.
2. Open System Settings, then Privacy & Security. (Older macOS: System Preferences, then Security & Privacy, then the FileVault tab.)
3. Scroll to FileVault and click Turn On. Enter your admin password if asked.
4. If other user accounts exist on the Mac, you may be asked to enable each user to unlock the disk by having them enter their passwords — anyone not enabled cannot start the Mac past the unlock screen.
5. Choose your recovery method (see the next section — this choice matters).
6. Click Continue. Encryption begins in the background; check progress any time in the same settings panel.

You can keep using the Mac, restart it, and work normally during encryption. A nearly full or very large drive can take several hours to finish, but most modern Macs encrypt quickly because the data is already hardware-encrypted.

The Critical Choice: iCloud Unlock vs Recovery Key

If you forget your login password with FileVault on, logging in requires a backup plan. FileVault offers two:

Option A: Allow iCloud account to unlock

• Your Apple account can reset the password and unlock the disk.
• Convenient, and the recovery key is stored by Apple tied to your account.
• Best for most home users — as long as your Apple account itself has a strong password and two-factor authentication.

Option B: Create a Recovery Key

• FileVault displays a long code (groups of letters and numbers). This is shown once.
• Write it down or print it, and store it away from the Mac: a password manager, a sealed envelope at home, or a trusted person’s keeping.
• Apple does not keep a copy. Lose both your password and this key, and the data is permanently unrecoverable — by design.

Neither choice is wrong, but the key rule is: never store the Recovery Key on the Mac it protects, and never skip recording it. Our guide on resetting a forgotten Mac login password shows how the recovery key rescues you at the login screen.

Using a Mac with FileVault On

Day to day, almost nothing changes:

• The login screen appears earlier in startup (it is actually the disk-unlock screen) and may show only enabled users.
• Remote management and some startup options ask for an enabled user’s password first.
• Performance on Apple Silicon and T2 Macs is effectively identical, because encryption happens in dedicated hardware.
• Time Machine works as usual; encrypt your backup too (a separate option in Time Machine settings) so the backup is not the weak link.

How to Turn FileVault Off (If You Ever Need To)

1. Open System Settings, then Privacy & Security, then FileVault.
2. Click Turn Off and authenticate.
3. Decryption runs in the background, like encryption did.

Legitimate reasons to turn it off are rare — mostly troubleshooting exotic startup problems — and you should turn it back on afterwards. Selling the Mac is not one of them; erasing the Mac handles that properly.

FileVault on a Second-Hand or Shared Mac

If you bought the Mac used, check FileVault’s state before storing anything personal on it: if it is on but the only recovery method belongs to the previous owner, a forgotten password could lock you out of your own computer. In that situation, turn FileVault off (decrypt fully), then turn it back on so the recovery method is created under your account. On shared family Macs, decide the recovery arrangement together — the person most likely to forget a password should not be the only one who knows where the key lives.

Common Mistakes and Helpful Tips

• Losing the Recovery Key. The single biggest FileVault mistake. Record it in two safe places before you click past the screen; the Mac will not show it again.
• Storing the key in a note on the same Mac. If the Mac is locked or stolen, the note is useless — or worse, accessible to the thief when unlocked. Keep it elsewhere.
• Forgetting other users cannot unlock. On shared Macs, enable every regular user at setup, or they will be stuck at the pre-boot login with no way in.
• Assuming FileVault replaces backups. Encryption protects confidentiality, not existence. If the drive fails, only a backup saves your data.
• Skipping the backup encryption. An unencrypted Time Machine drive beside an encrypted Mac defeats the purpose — enable encrypted backups.

Conclusion

FileVault is the highest-value security setting on any Mac: one toggle in Privacy & Security, a careful decision about recovery, and your entire drive becomes unreadable to anyone without your password. Enable it, record the Recovery Key safely away from the Mac, enable every regular user to unlock, and encrypt your backups too. Five minutes of setup buys permanent peace of mind against the lost-or-stolen scenario.

Frequently Asked Questions

Does FileVault slow down my Mac?

On any Mac with Apple Silicon or a T2 security chip, no — encryption is handled by dedicated hardware and everyday performance is unchanged. Very old Intel Macs without those chips may feel a small cost, which is still worth the protection.

What happens if I forget my password AND lose the Recovery Key?

If you chose a personal Recovery Key (not iCloud unlock), the data cannot be recovered by anyone, including Apple. That is the intended design. You can erase the Mac and start again, but the old files are gone — which is why storing the key safely matters so much.

Is FileVault the same as a firmware password?

No. FileVault encrypts your data. A firmware password (older Intel Macs) only blocks booting from other devices and does not encrypt anything. Apple Silicon Macs rely on FileVault plus Activation Lock instead.

Should I turn FileVault on before selling my Mac?

There is no need. When you erase the Mac (Erase All Content and Settings on modern macOS), the encryption keys are destroyed, making the data unrecoverable anyway. FileVault is for Macs you keep and use.

Can I check whether FileVault is already on?

Yes: System Settings, Privacy & Security, FileVault shows its state at a glance. Some Macs arrive with it enabled from setup if you chose that option, so it is worth a quick look.