What is FileVault Encryption?
FileVault is the built-in disk encryption program in macOS. It uses XTS-AES-128 encryption with a 256-bit key to prevent unauthorised access to the information on your startup disk. Without your login password, your data remains completely scrambled and unreadable, even if someone removes the physical drive from your Mac.
Why You Should Enable FileVault
If your MacBook is lost or stolen, physical possession of the device often means access to your files. Someone could potentially boot your Mac into Target Disk Mode or physically extract the drive to bypass your macOS password screen. Enabling FileVault ensures that your photos, financial documents, passwords, and personal data are useless without the decryption key.
How to Turn On FileVault on Your Mac
Enabling FileVault is a straightforward process, but you must ensure your Mac is connected to power during the initial encryption setup.
- Click the Apple menu () in the top-left corner of your screen and select System Settings.
- Scroll down the left sidebar and click on Privacy & Security.
- Scroll down to the FileVault section.
- Click the Turn On… button.
- You will be prompted to enter your administrator password to unlock the settings.
Choosing How to Unlock Your Disk
Once you click “Turn On”, macOS will ask how you want to unlock your disk and reset your password if you ever forget it. You have two options:
Option 1: Use your iCloud account (Recommended for most users)
This allows you to use your Apple ID credentials to unlock your drive if you forget your Mac login password. This is the safest and most convenient option for most people.
Option 2: Create a recovery key
If you prefer not to link your encryption to iCloud, you can generate a recovery key. Warning: This is a string of letters and numbers that you must keep safe. If you forget your login password and lose this recovery key, your data will be lost forever. Apple cannot help you recover it.
What Happens During Encryption?
After making your selection, the encryption process will begin in the background. You can continue using your Mac normally while this happens. The process only continues while your Mac is awake and plugged into AC power. Depending on the size of your drive and the amount of data, this can take several hours.
How to Check FileVault Status
If you want to monitor the progress or confirm that your drive is fully encrypted:
- Return to System Settings > Privacy & Security.
- Look under the FileVault section.
- It will state whether FileVault is “Turned On” or if it is currently “Encrypting”.
Common Mistakes to Avoid
- Losing the Recovery Key: If you chose to generate a recovery key instead of using iCloud, do not store it on the Mac itself. Write it down and keep it in a secure physical location, or store it in a secure third-party password manager.
- Forgetting the login password: FileVault relies on your macOS login password. Ensure it is memorable but strong.
Next Steps
Once FileVault is enabled, your Mac is significantly more secure against physical theft. For additional security, ensure you have enabled the Find My Mac feature and set a firm firmware password if you are using an Intel-based Mac.