While FileVault encrypts the data on your macOS drive, it does not prevent a malicious actor with physical access to your Mac from booting into Recovery Mode, wiping the hard drive, and installing a fresh copy of macOS. If you want to completely lock down the hardware and prevent unauthorized users from altering the boot sequence or reinstalling the OS, you must set a Firmware Password.
Note: This guide applies specifically to Intel-based Macs. Apple Silicon (M-series) Macs handle boot security differently, relying on the Secure Enclave and Activation Lock tied to your Apple ID, eliminating the traditional Firmware Password utility.
Why Set a Firmware Password?
A firmware password blocks access to all alternate boot modes. If a user attempts to hold the Option key to boot from a USB drive, or holds Command + R to boot into Recovery Mode, the Mac will display a padlock icon and demand the firmware password before proceeding. This is critical for enterprise devices deployed in public areas.
How to Set the Firmware Password
- Shut down your Mac completely.
- Press the power button, then immediately press and hold Command + R on the keyboard.
- Release the keys when you see the Apple logo or a spinning globe. The Mac will boot into macOS Recovery.
- When the macOS Utilities window appears, ignore it and look at the menu bar at the very top of the screen.
- Click on Utilities in the menu bar, then select Startup Security Utility (on older macOS versions, this may be called Firmware Password Utility).
- A small window will appear. Click the Turn On Firmware Password… button.
- Enter a strong, memorable password in the “New password” field, and type it again in the “Verify” field.
- Click Set Password.
- Quit the utility, click the Apple menu (), and select Restart.
WARNING: Do Not Lose This Password
A firmware password is not tied to your standard macOS user account or your Apple ID. If you forget the firmware password, you cannot reset it yourself. You will be permanently locked out of all recovery tools and alternative boot disks. The only way to remove a forgotten firmware password is to schedule an appointment with an Apple Store or Apple Authorized Service Provider and present the original proof of purchase (receipt) for the computer.