What is FileVault?
FileVault is the native disk encryption technology built into macOS. By using XTS-AES-128 encryption, it ensures that if a MacBook is lost or stolen, the data on the solid-state drive is mathematically unreadable without the user’s login password or a dedicated Recovery Key.
While most home users enable FileVault during the initial Mac setup screens or through the System Settings app, enterprise IT administrators who deploy dozens of Macs using Mobile Device Management (MDM) scripts need a way to manage encryption invisibly.
The fdesetup (Full Disk Encryption Setup) command is the official macOS Terminal utility designed to enable, disable, and monitor FileVault completely from the command line.
Step 1: Open the Terminal
Because modifying full disk encryption alters the core security architecture of the Mac, you must run all modifying commands with root privileges.
- Press Command + Space to open Spotlight Search, type
Terminal, and press Enter. - Prefix your commands with
sudo.
Step 2: Checking FileVault Status
Before you attempt to enable encryption, you should check if the disk is already encrypted, or if it is currently in the middle of encrypting in the background.
You do not need sudo to check the status. Simply run:
fdesetup status
The output will be very clear, such as “FileVault is On.” or “FileVault is Off.” If the drive is currently encrypting, it will output a percentage, such as “Encryption in progress: 45%.”
Step 3: Enabling FileVault from the Terminal
To turn on FileVault encryption, you must use the enable flag. However, because the system requires a user password to generate the encryption keys, simply running sudo fdesetup enable will cause the Terminal to pause and prompt you to manually type a username and password.
If you are writing an automated bash script, you cannot pause and wait for a human to type. You must pass the credentials securely. The best way to do this is using the -defer flag.
sudo fdesetup enable -defer /var/tmp/recovery_key.plist
The -defer flag tells macOS: “Turn on FileVault, but do not ask for a password right now. Wait until the very next time the user logs in, prompt them for their password graphically, and use that to start the encryption.”
The file path at the end of the command dictates where macOS will quietly save the emergency Recovery Key XML data once the encryption begins.
Step 4: Exporting the Personal Recovery Key
If you already have FileVault enabled, and a user has lost their printed Recovery Key, you can force the Mac to generate a brand new key and output it directly to the Terminal window.
To generate a new key and print it to the screen, run:
sudo fdesetup changerecovery -personal
The Terminal will prompt you for an administrator password, and then output a 24-character alphanumeric string (e.g., ABCD-1234-EFGH-5678-IJKL-9012). The old recovery key is instantly invalidated.
Step 5: Disabling FileVault
If you need to decrypt a drive—perhaps because you are selling the Mac or troubleshooting severe disk corruption—you can easily turn FileVault off.
Run the following command:
sudo fdesetup disable
The Terminal will prompt you for your administrator username and password. Once verified, the decryption process will begin silently in the background, and you can continue to use the Mac normally while it finishes.