How to Set a Firmware Password on an Intel Mac using Terminal

Protecting the Hardware Layer

If your MacBook is stolen, a standard user account password will not protect your data if the thief knows what they are doing. They can simply boot the Mac into macOS Recovery Mode (holding Command + R during boot), open Disk Utility, wipe the entire drive, and reinstall the operating system to sell the computer.

To prevent this, you must set a Firmware Password. A firmware password acts at the deepest hardware level (EFI), requiring authentication before the Mac is allowed to boot from an external USB drive, enter Recovery Mode, or reset the NVRAM.

Note: This guide applies specifically to older Intel-based Macs. On modern Apple Silicon (M1/M2/M3) Macs, firmware passwords have been replaced by the Activation Lock feature tied to your Apple ID.

Using the firmwarepasswd Utility

While you can set a firmware password by booting into Recovery Mode and using the GUI utility, system administrators managing fleets of Intel Macs need a way to script this deployment. The built-in firmwarepasswd command-line tool provides exactly this functionality.

1. Open the Terminal application.
2. To set a new password, run the following command (you must use sudo because it modifies core EFI variables):

sudo firmwarepasswd -setpasswd

3. Press Enter. The terminal will prompt you to type a new password. Type it carefully (the characters will remain invisible for security) and press Enter.
4. It will ask you to verify the password by typing it a second time.

Verifying the Firmware Status

Once the password is set, you can verify that the EFI lock is active by checking the status flag:

sudo firmwarepasswd -check

The command should return Password Enabled: Yes.

From this moment forward, if anyone attempts to interrupt the normal boot process (e.g., holding the Option key to boot from a Kali Linux USB drive), they will be met with a stark black screen displaying a padlock icon and a password field. Without the correct password, the Mac cannot be wiped or manipulated.

Removing a Firmware Password

If you are decommissioning the Mac and preparing to sell it, you must remove the firmware password, otherwise the new owner will be permanently locked out.

sudo firmwarepasswd -delete

You will be prompted to enter the current firmware password to authorize the removal. Once authenticated, the EFI lock is lifted, and the Mac returns to its standard factory security posture.

Critical Warning: If you lose or forget the firmware password, there is absolutely no way to bypass it. You cannot reset it using your Apple ID. Your only recourse is to take the physical machine to an Apple Store with original proof of purchase, and they will use proprietary hardware tools to wipe the logic board.