If you lose your MacBook in a coffee shop, or if it is stolen from your car, the physical hardware is usually the least of your concerns. Your laptop contains your personal emails, banking documents, saved passwords, and private photographs. If your hard drive is not encrypted, a thief can simply remove the drive, plug it into another computer, and read all of your files without ever needing to know your login password.
To prevent this catastrophic breach of privacy, Apple includes a military-grade encryption system called “FileVault” directly in macOS. When enabled, FileVault mathematically scrambles every single piece of data on your hard drive. Without your specific login password (or a master recovery key), the data is completely unreadable garbage.
How to Enable FileVault
Turning the encryption on takes only a few clicks, and it operates entirely in the background without noticeably slowing down your Mac.
- Click the Apple Logo in the top-left corner of the screen.
- Select System Settings (or System Preferences on older Macs).
- Scroll down the left-hand sidebar and click on Privacy & Security.
- Scroll down the main panel until you find the section labelled FileVault.
- Click the button that says Turn On…
You will be prompted to enter your Mac’s administrator password to authorize the change.
Choosing Your Recovery Method (Crucial Step)
This next screen is the most important part of the entire process. Because FileVault encryption is unbreakable, if you forget your Mac login password, you will permanently lose access to all your files. Apple cannot help you recover them. Therefore, you must choose a backup recovery method.
You will be presented with two choices:
- iCloud Account: This is the recommended option for most people. If you forget your Mac password, you can use your Apple ID and iCloud password to instantly decrypt the drive and regain access.
- Recovery Key: If you are highly security-conscious and do not trust cloud servers, you can choose to generate a random 24-character alphanumeric Recovery Key. You must write this key down on a physical piece of paper and lock it in a safe. If you lose this piece of paper and forget your Mac password, your data is gone forever.
Once you make your choice and click Continue, the encryption process will begin in the background. You can continue using your Mac normally while it encrypts.
If you own a modern Mac with Apple Silicon (an M1, M2, or M3 chip), the encryption process is virtually instantaneous because the hardware is actually encrypting data all the time by default; turning on FileVault simply adds your personal user password to the master lock.