How to Enable and Configure macOS FileVault Encryption via Terminal

FileVault provides full-disk, XTS-AES-128 encryption for macOS startup volumes, protecting sensitive data if a Mac is lost or stolen. While enabling it via the System Settings graphical interface is easy for individual users, system administrators managing fleets of devices often need to trigger the encryption process programmatically. Apple provides the fdesetup command-line utility specifically for managing FileVault architecture.

Understanding fdesetup

The fdesetup tool requires root privileges and allows administrators to check FileVault status, enable encryption, manage authorized users, and retrieve recovery keys without interacting with the GUI.

Step 1: Check Current Encryption Status

Before attempting to encrypt a volume, verify its current state by opening the Terminal and running:

fdesetup status

If the output is “FileVault is Off,” you can proceed with enablement.

Step 2: Enable FileVault (Interactive)

The simplest way to enable FileVault via the command line is to run the enable command, which will prompt you for an authorized user’s credentials:

sudo fdesetup enable

You will be asked to enter the username and password of an administrator account. Once authenticated, the system will generate a Personal Recovery Key (PRK). Write this key down immediately. The encryption process will begin in the background upon the next system restart.

Step 3: Enable FileVault Programmatically (Non-Interactive)

In enterprise environments, waiting for interactive prompts breaks automation scripts (like those used in MDM deployments). You can pass credentials securely via a Plist configuration to achieve zero-touch encryption.

First, create a Plist file holding the credentials of the user who will be authorized to unlock the disk. This requires the username and password in plain text, so ensure this script/file is executed securely and deleted immediately afterward.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Username</key>
    <string>admin_username</string>
    <key>Password</key>
    <string>admin_password</string>
</dict>
</plist>

Save this as credentials.plist. Then, pipe the file into the fdesetup command:

sudo fdesetup enable -inputplist < /path/to/credentials.plist

The command will output the generated Personal Recovery Key to the console, and the encryption process will be staged for the next reboot. You can then securely parse this output in your deployment script and escrow the recovery key to your management server.